HDPA (Greece) - 39/2021

HDPA (Greece) - 39/2021
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 5(1) GDPR Article 12(3) GDPR Article 15 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	03.09.2021
Published:	15.09.2021
Fine:	None
Parties:	Anonymous data subject Municipal Transport Company of Rhodes "RODA"
National Case Number/Name:	39/2021
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	Greek DPA (in EL)
Initial Contributor:	FD

The Greek DPA fined RODA, a transportation company, €8000 for violating the principle of data minimization and the right of access in the context of a dispute between RODA and an ex-bus driver. The company unnecessarily issued a 'certificate of service' indicating the driver had been fired because of a criminal act, and did not reply to his request of a copy of the video of the bus on the day of the incident

English Summary

Facts

A bus driver ("X") working for the Municipal Transport Company of Rhodes ("RODA") was dismissed following a controversial incident. After having been dismissed, X asked RODA to provide him with a certificate of service. According to the applicable Greek law, such certificate should indicate the identity of the individual concerned, the type of occupation, as well as the period of employment. RODA however delivered a certificate which also included, in addition to the legally required information, the fact that X had been fired because of a criminal act. X considered that adding this information on the certificate was disproportionate and could cause him prejudice.

Exercising his right to access under Article 15 GDPR, X requested RODA to provide him with a copy of the video-tape from the bus camera in order to verify what had happened on the day of the controversial incident. In accordance with Article 12(3) GDPR, RODA had the obligation to answer that request within one month upon receipt. RODA however never replied to X's request.

X considered that by acting this way, RODA had infringed the GDPR. He therefore lodged a complaint with the Greek DPA. During the procedure, RODA explained that it had orally informed X of the fact that the video-tapes of the bus were systematically deleted after 7 days. X, however, denied having received that information.

Holding

After considering all the facts of the case, the Greek DPA found that RODA had breached Article 5(1) GDPR (principle of data minimisation), as well as Article 12(3) and 15 GDPR (right of access by the data subject - obligation to reply within a month). In particular, the Greek DPA considered that, by adding on the certificate of service an information that was unnecessary and which could cause prejudice to the data subject, RODA had infringed the principle of data minimisation. Furthermore, by not replying to X's request to be provided with a copy of the video-tape, RODA had infringed its obligation with respect to access requests. The Greek DPA therefore decided to impose on RODA a fine of 5,000 EUR for breach of Article 12(3) and 15 GDPR, and a fine of 3,000 EUR for breach of Article 5(1)(c) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

                                                              Athens, 03-09-2021

                                                               No. Prot.2001



                              DECISION 39/2021

                                    (Department)

   The Personal Data Protection Authority

Department at its headquarters on 26.05.2021 at the invitation of its President,

in order to examine the case referred to in the background hereof.

Attended by the Vice President G. Batzalexis, disabled by the President

of the Authority K. Menoudakou, the regular members of the Authority S. Vlachopoulos and K.

Lambrinoudakis, as rapporteur and the alternate member of the Authority G. Tsolias,

to replace the regular member Ch. Anthopoulos, who, although summoned
legally in writing, did not attend due to disability. You were present without right

K. Karveli, Specialist Scientist-Lawyer, as Assistant Rapporteur,

who left after the discussion of the case and before the conference and the

decision making and E. Papageorgopoulou, employee of the administrative department

Affairs of the Authority, as Secretary.



   The Authority took into account the following:

   With the no. prot. Γ / ΕΙΣ / 1084/20 and Γ / ΕΙΣ / 2648/20 his complaints to the
Authority, A complains to the Municipal Transport Company of Rhodes "RODA" for not

legal processing of his personal data.

   Specifically with the no. prot. Γ / ΕΙΣ / 1084/20 his complaint complains that

following his dismissal from the Municipal Transport Company of Rhodes

"RODA", asked for a certificate of previous service that he worked in the company, which

granted, but adding in breach of the principle of proportionality

that he was fired for a criminal act, thereby provoking, as

claims, damage to his interests.



                                                                              1 Also with the second with no. prot. G / EIS / 2648/20 denounces him denounces

the company for not satisfying its right of access. Particularly,

following a lawsuit filed against him for embezzlement from
company, as a former employee in the position of collector, requested from

company for judicial use of his defense, as a defendant in criminal

trial, upon his request to be provided with a copy of the videotape

material that recorded the closed circuit television of the bus at the location

of the bus driver on the day of the incident in question on….

But, as he complains, the company never responded to his request,
by tacitly rejecting it, in violation of the provisions of articles 12 par. 3

and 15 of the GCC.

   Following these, the Authority sent to the complainant no. prot.

G / EX / 1084-1 / 6.4.20 and G / EX / 2648-1 / 22.6.20 documents for providing clarifications on

of the complainants, which no. prot. Γ / ΕΙΣ / 4683 / 20Reply document

told her the following: a) the videotaping and videotaping that
carried out is not illegal, but is exceptionally permitted, as is

use of the material in question, where there are reasons of public interest, which

concern the prevention of crimes, the protection of the law

interests and the protection of private and family life, b) all

company employees, drivers and collectors, have been informed and
know about the specific processing, and c) the certificate issued

is legal, true and fully compliant with

reality.

    Then the Authority with the no. prot. G / EX / 567 / 4.2.21 and G / EX / 568 / 4.2.21

respectively called G. Lampadakis, his attorney

complainant A and the complained Municipal Transport Company
Rhodes "RODA" to attend the meeting of the Authority on 10.02.2021,

in order to discuss the above complaint.

   During the hearing, which took place on 24.02.21, after a postponement

from the discussion of 10.02.21, his attorneys were present

complainant George Lampadakis and Elias Zografidis and on her behalf



                                                                            D. Tsikkis, President of the Municipal Transport Company "Roda"

company after the power of attorney of lawyer Spyridoula Pasari.

   The plaintiff's attorneys both at the hearing
procedure as well as with no. prot. Γ / ΕΙΣ / 1546/21 their memorandum to the Authority

stated the following: a) the defendant has not satisfied to date

the complainant's right of access to the videotaped in question, nor

has answered something relevant to his request b) although his case

criminal hearing was put on file, the complainant needs the disputed

material in his defense in his civil action for damages by
complained, c) during the hearing the legal representative of

company reported that the videotaped material has been deleted and that it has

informed the complainants orally, while this did not happen

stated the complainant in her reply to the Authority in 2020, d) h

Certificate of previous service contained personal data not necessary, relevant,

and depending on the intended purpose, in violation of the provisions of
articles 678 of the Civil Code and 5 of the GCC, e) at a later date requested to

re-issued a certificate, which again although did not state that

dismissed for a criminal offense, indicated when dismissed due to a complaint

before the agreed time for an important reason, and f) finally, with a third news

his application and at the same time a complaint to the Labor Inspectorate, h
The complainant issued him a new certificate in which he referred to

recruitment and dismissal decisions, so even this third certificate does not meet

the criteria of 678 of the Civil Code, if one can with the numbers of the decisions

to refer to DIAVGEIA and to see the full text of his dismissal, where

appears as a mocker.

   The President of the Municipal Transport Company of Rhodes "RODA" D. Tsikkis
and the attorney S. Pasari, both during the hearing and

and with no. prot. G / EIS / 1862/21 their memorandum to the Authority stated the following:

(a) personnel processing has been processed in relation to the certificate of previous service

data only in the light of the right of access, provided that the attestation

was not transmitted to third parties, in any case following the new one from 23.12.20

At the request of the complainant, the company issued a new certificate with correct

                                                                            3 repetition in which only the time of its recruitment, the time period, is indicated

period of his employment and the type of his work, b) the recording of

personal data from the video camera that is
mounted inside the buses above the driver's seat

videotaped only the issuance transaction we observe between driver and passenger,

without depicting faces and without sound, and the data collected through

of the video surveillance system are not stored in an archiving system,

and the duration of their observance is limited to seven (7) days, after the end of

which are automatically deleted, c) υλικό its material was automatically deleted
camera, a fact of which he was aware and of which he had been orally informed o

complainants and d) from 3.3.21 the BoD has voted in favor. of the company written

CCTV policy attached to the Authority.


    The Authority, after the hearing and examination of the evidence

of the dossier and after hearing the rapporteur and the assistant rapporteur, who
left after the case was discussed and before the conference and reception

decision, after a thorough discussion





                     THOUGHT ACCORDING TO THE LAW


   1. According to the provisions of article 5 par. 1 lit. a ', b' and c 'of the GPD

personal data should a) be submitted to lawful and

fair processing in a transparent manner in relation to the data subject

(principles of legality, objectivity and transparency), b) collected for

specified, explicit and lawful purposes and not to be subject to
further processing incompatible with these purposes (principle of

(c) are appropriate, relevant and limited to

necessary for the purposes for which they are processed (principle

data minimization).

   Furthermore, according to article 12 par. 3 of the GKPD, “the controller

provides the data subject with information about the action that


                                                                            4π ικ α δ τ ά 1έ 2χ

delay and in any case within one month of receipt of the request.

This period may be extended by a further two months, provided that
required, taking into account the complexity of the request and its

number of requests. The controller informs the subject of

data for the said extension within one month of receipt of the request,

as well as for the reasons of the delay ".

   Finally, according to Article 15 of the GIP, the data subject has the

right to receive confirmation from the controller of the
whether or not the personal data concerning it exist

processing.

   2. Also, according to article 678AK "At the end of the contract o

employee may require from the employer a certificate of the type and

the duration of his work. Only if the employee specifically requests it is confirmed

and the quality of his work and his conduct ".
   3. In the present case, on the basis of what emerged from the hearing

procedure and from the examination of the data in the file, the complainant

Rhodes Municipal Transport Company "RODA", as responsible for processing, a)

in violation of the provisions of article 5 par. 1 lit. c of the GKPD, granted

to the complainant after his dismissal from the company, a certificate
in which it was listed, apart from its type and duration

and the information that he was dismissed due to a criminal act and b) against

Violation of the provisions of Articles 12par.3 and 15 of the GCPD, never answered

in writing to the complainant's request of 22.7.19 for a copy

of the videotaped material recorded by his closed circuit television

bus in the driver's seat on the day of the incident
controversial incident on 23.2.20, tacitly dismissing it.

   Consequently, there is a violation of the above-mentioned provisions

principle of proportionality (article 5 par

right of access, as well as not being informed of his request

complainant for access to data concerning him (articles 12 par. 3 and

15 ΓΚΠΔ).

                                                                            5 4. In view of the above, the Authority, taking into account its weight

infringement proved and the insult inflicted by it on

complainant, considers that it should be imposed on the complainant in application

of the provision of article 58 par. 2 ed. i) of the GCC effective, proportionate and

a deterrent administrative fine, in accordance with Article 83 of the GIP 1.

    Because the violation found by the Authority of the provisions of Articles 5

par. 1 item c), 12 par. 3 and 15 GPA are subject to the cases of enforcement

administrative fines of article 83 par. 5 ed. a 'and b' GKPD.





                             FOR THOSE REASONS

                                      The beginning


Imposes on the Municipal Transport Company of Rhodes "RODA", as responsible

for reasons set out in detail in its rationale

present, the proportionate and dissuasive administrative fine imposed

appropriate to the case, according to the specific circumstances

a) of five thousand (5,000.00) Euros, for the violation of the provisions

of articles 12 par. 3 and 15 GPA and b) amounting to three thousand (3,000.00) Euros,

for the violation of the provisions of article 5 par. 1 lit. c of the GCC, ie

a total of the administrative fine of eight thousand (8,000.00) Euros.



        The Deputy Chairman The Secretary





         George Batzalexis Irini Papageorgopoulou







1
 See OE29, Guidelines and the implementation and determination of administrative fines for the purposes of regulation 2016/679 WP253,

p. 6


                                                                                  6