HDPA (Greece) - 4/2020

HDPA - 4/2020
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 5(2) GDPR Article 15(1) GDPR Article 15(3) GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	20.03.2020
Published:
Fine:	5000 EUR
Parties:	Centre for speech therapy
National Case Number/Name:	4/2020
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	HDPA (in EL)
Initial Contributor:	n/a

The HDPA fined € 5.000 private centre for speech therapy because it did not fulfill the right of access exercised by a parent, who had the parental responsibility but not the custody, on behalf of his minor child. The controller also ignored HDPA's previous order to comply with the parent's request, thus violating Article 15(1) and (4) GDPR as well as the principle of accountability pursuant to Article 5(2) GDPR.

English Summary

Facts

The complainant requested twice via e-mail all data that the Centre as data controller held on his minor child. The controller refused to provide the data because of the complainant's ex-wife's (and mother's of his child) refusal. The controller argued that the mother had custody.

The HDPA first asked the controller to immediately fulfill the complainant's request according to Article 15(1) and (3) GDPR and inform the authority accordingly. It invoked is own case law, according to which any parent who has parental responsibility of the child may have the right of access according to Article 15, even if they don't have custody, unless there is a specific court decisions ordering otherwise e.g. prohibition of communication with the child. The controller did not comply and it did not notify the HDPA of any decision it took with this regard.

Dispute

May a data controller refuse to fulfill the right of access without any response of a parent who exercise it on behalf of their minor child, if this parent has parental responsibility but not custody?

Holding

The HDPA, as had initially decided, found that the controller should have fulfilled the complainant's right of access or should have justified its refusal to do so -especially after the HDPA's initial order. Thus, it found that the controller had violated Article 15 (1) and (3) as well as the principle of accountability as provided for in Article 5(2) GDPR.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

At the invitation of the President, the Hellenic Data Protection Authority met, at the invitation of its President, to a Chamber in a Chamber at its headquarters on 12/3/2020, at 11.00 hours, at the time of the adjournment of the meetings of 04/3/2020 and 26/2/2020, in order to examine the case referred to in the previous record. The meeting was attended by videoconference held by Georgios Batzaleas, Deputy President, excused by the President of the Authority, Mr Konstandinos Menohydros, and attended by the alternate members Evangelos Papakonstantinou, and Mr Emmanouil ΔΟRoperakis as the rapporteur. They were not represented because they were prevented from attending, although the regular members Konstantinos Lamprinyoudakis, Haralambos Anthopoulos and Eleni Martsoukou were duly summoned in writing. At the hearing, at the request of the President without the right to vote, Ms Maria Alikaakou, a specialist scientist/auditor as assistant rapporteur and Georgia Palaioologist, an official of the Administrative Department of the Authority, as secretary.
The Authority took note of the following:
With letter NoC/ΕΙΣ/3027/22.4.2019 lodged with the Authority an action against the ‘Standard Centre for Speech and Special Needs Education — DIMITRA’ (hereinafter referred to as ‘Centre’), established in... IDEM.In particular, in the present action, A denounces the Centre’s refusal to grant the right of access and, in particular, to grant him the data requested by him relating to his minor child. 
More in detail, according to the respondent, on...2018 by email, the applicant asked the Centre to provide him with the number of sessions  ‘by type of session and month in the autumn of 2018’, to which his minor child had been submitted. This request, reiterated on...2019 The Centre refused to accede to the Centre for the same reasons and a subsequent request from the applicant on...2019, in which it also called for the tax documents issued for the above meetings.
In fact, the Centre in its reply to the letter to the Authority, in the context of its examination of the appeal in question, stated that the failure to comply with the applicant’s request was due to the fact that the applicant’s mother and his former spouse were the mother of the minor who had parental custody and that, consequently, it was not sufficient to allow the Centre to make the requested grant (‘ The medical information of the father and holder of parental responsibility has been carried out by us within the limits of our responsibilities and the limits given by our principal mother’).The award of the tax documents, according to the Centre, could be requested by the applicant  ‘in a court of inquiry’ between the two former spouses  ‘by means of the documentation procedure’.’
As a result, the Authority sent letter ref. Document c/ΕΞ/3027-2/11.11.2018, in which it  requested the Centre to give immediate effect to that right of Pooladvantageous £in accordance with Article 15 (1) and (3) I (k) and to
He informed thereof accordingly.In more detail, the Authority noted, inter alia, that the issue of the right of access of the parent, who exercises parental responsibility and does not have custody, to the data of his/her minor child has already been resolved by the Authority. In particular, according to the established case law of the Authority (see, for example, Decisions 24/2009 and 53/2010) the holder of parental responsibility is in principle entitled to access Article 15 GDPR, in conjunction with Articles 128 and 1510 of the Civil Code, to the elements relating to their minor child, unless a judicial decision provides otherwise, e.g. a decision by the other parent as the holder of parental responsibility, a decision prohibiting contact with the child, etc. The controller is obliged directly to fulfil that right.
As regards, in particular, the issue of the granting of the requested tax documents to the applicant, the Authority, having as information from the completed file of the case that the relevant vouchers were issued in the name of the mother, stated in its above letter that the judgement concerning the possibility of granting them to the applicant falls outside its competence because they contain the personal data of a third party, namely the mother of the minor child. In particular, the Authority noted that the relevant crisis is a matter for the controller, who must decide whether or not to grant it under the conditions set out in Article.6 (1) GDPR.The relevant decision of the controller, whether positive or negative, should be documented under the basic principle of accountability of Art. 5 (2) GDPR.
The applicant then reverted to his letter ref. C/ΕΙΣ/8051.21.11.2019, by e-mail, with attachments, informing the Authority that the right of access, as clarified in the Authority’s document, had not yet been granted.
For the above reasons and for the additional reason that the Centre did not inform the Authority of its own actions after it was sent by letter ref. C/¬ ΕΞ/3027 2/11.11.2018, as requested in the latter, the Authority invited the parties to the 08.1.2020 plenary sitting and subsequently a deadline for the submission of statements.
At the hearing held in 08.1.2020, the Director, who had submitted a delegation of power, pursuant to which he was authorised by the brother of A to attend the meeting instead and Ms Sofia Vlachou Zounel, his lawyer, has been authorised to attend the hearing. He also appeared to be a lawyer of the ‘Standard Centre for Speech and Special Needs Education — Dimitra Dimitra’, and the Dimitris Vlassopoulou. Those parties, having made oral submissions, subsequently submitted their respective pleadings to the Authority.
The complainant’s side at the hearing, but also with letter ref. C/ΕΙΣ/528/22.1.2020 note to the Authority reiterated, inter alia, that the Centre continues to refuse to grant the requested documents and noted that the refusal of the Centre is inadmissible and is not based on a detailed statement of reasons.
The test centre at the hearing of 08.1.2020, but also with letter ref. C/ΕΙΣ/564/23.1.2020 to the Authority has argued that it is not entitled to grant the requested documents because of the opposite position of the mother of the minor and lack of consent on the part of the minor. In particular, as regards the tax vouchers, both at the hearing and in writing in the memorandum, it was specified by the Centre that they are issued in the name of the minor child and not, as initially considered, in the name of the mother. However, with this last clarification, the Centre pointed out that the tax documents  ‘although they are issued in the name of the minors, who do not have the consent of the mother, did not pass them on to the father of the minors, since the issue in the name of the minors serves a purely public purpose, in particular the public interest rate of reimbursement by the body with care.’In addition, the Centre argued that the applicant could obtain the requested documents through the process of demonstrating the documents of Article 450 et seq. Code of the Code of Civil Procedure and by means of the procedure laid down in Article 1445 of the Civil Code, that is to say, to be provided to the applicant by means of the intervention of the competent Public Prosecutor.
The Authority, from the hearing, from the file of the case file as well as from the submissions submitted to the Authority and after hearing the rapporteur and the Assistant Rapporteur, who left after the case was discussed and before the conference and decision and after a thorough discussion,
AFTER DUE CONSIDERATION
1.	Because Article 5 of the General Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (hereinafter referred to as ‘GDPR’) sets out the principles which should govern processing. In accordance with the accountability principle set out in that Article and as expressly set out in the second paragraph thereof, the controller ‘shall be responsible and able to demonstrate compliance with paragraph 1 (‘accountability’).’; This principle, which is a cornerstone of the GDPR, implies the possibility for the controller to be able and should be able to demonstrate compliance. In addition, it allows the controller to legally monitor and document a processing that it carries out in accordance with the legal bases provided by the GDPR and the national data protection law.
2.	Because in accordance with Article 15 (1), (3) and (4) of the GDPR “1. The data subject shall have the right to obtain from the controller confirmation as to whether or not the personal data concerning him or her are being processed and, if so, the right of access to the personal data in the following information: [...] 2.[...] 3. The controller shall provide a copy of the personal data undergoing processing.[.] 4. The right to receive a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.’;
3.	As, pursuant to Article 12 (3) and (4) of the GDPR, “The controller shall provide the data subject with information on the action taken on request pursuant to Articles 15 to 22 without delay and in any case within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.[.] 4. Where the controller does not act on the data subject’s request, the data subject shall, within one month of receipt of the request, inform the data subject of the reasons for not taking the action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.’;
4.	In accordance with the provisions of Article 58 (2) of the GDPR in conjunction with Article 15 (4) et seq. of Law Ν.4624/2019, the supervisory authority has the remedial powers provided for in those provisions with regard to the controller, where the controller has infringed provisions of the GDPR and Law 4624/2019.
5.	Whereas, according to Article9 Ν.4624/2019 ‘The supervision of the application of the provisions of the GDPR, of the present and of other provisions concerning the protection of individuals with regard to the processing of personal data in Greece shall be exercised by the Authority established by Law 2472/1997 (GG I 50).’;
6.	Whereas, pursuant to Article 3 (a) of Law 4624/2019, the provisions of that law apply to private operators, inter alia, where ‘(a) the controller or processor processes personal data within the territory of Greece;
7.	As according to the established case law of the Authority (see, for example, Authority Decisions 24/2009 and 53/2010, published on the Authority’s website http://www.dpa.gr/ www.dpa.gr) the holder of parental responsibility for his/her minor child (Article)128 and 1510 RR) is in principle a legal representative of the right of access referred to in Article 15 above to the elements referring to the minor child of the child (see, for example, Authority Decisions 24/2009 and 53/2010 of the Authority, published on its website http://www.dpa.gr/ www.dpa.gr), unless a court decision provides otherwise (e.g. a decision establishing the other parent as the holder of parental responsibility, a decision prohibiting contact with the child, etc.).
8.	In the present case, the applicant has exercised his right of access on behalf of his minor child to the Centre by exercising parental responsibility. In particular, the applicant asked the Centre for the number of sessions given to his minor child in the month of... 2018 and the corresponding tax documents issued in the name of the minor. That request was not satisfied by the Centre because the minor’s mother did not comply with the disclosure of the information requested to the applicant. In particular, as regards the refusal to grant tax documents, the Centre pointed out that they are the data of the mother and that ‘the  issue in the name of the minors serves a purely public purpose, and in particular the recovery of the amount by the social security institution of the person with care’.Thus, in essence, the Centre claimed that the financial documents relate to the mother, in spite of the child’s child, but did not clearly deny that they are the personal data of the minor. That argument of the Centre is, moreover, as such, on the ground that even if it were accepted that the supporting documents contain information which is indirectly related to the mother (for example, the payment of a specific amount on behalf of the minor child), that does not mean that the child does not contain any information relating to the minor, one of which appears in his name and therefore constitutes, in the strict sense of the term, personal data of the minor.
9.	In view of the fact that, even on the assumption that the abovementioned tax vouchers also constitute personal data of the mother, as the amount paying for them, the father’s right of access to the data of his child may be limited and, therefore, only prohibited if the rights and freedoms of others, namely the mother, are adversely affected, in accordance with Article 15 (4) of the GDPR.The simple refusal and opposition of the mother to obtain from the Centre the requested documents together with the absence of any adverse effect on the rights and freedoms of the mother may under no circumstances constitute an obstacle to the granting of the right of access. Furthermore, the Centre, within the framework of the principle of accountability, had to examine whether there was an issue of an adverse effect on the rights and freedoms of the mother with a view to failing to meet this right of access.
10.	Finally, as the Centre did not comply with the Authority’s mandate to grant the applicant’s right of access to the personal data of his/her minor child, as is apparent from letter ref. Letter ref. c/ΕΞ/3027-2/Π.Π.2018 from
On those grounds,
A ρx or:
1.	Instruct the Centre to issue the documents referred to in the history of this Decision to Mr A., including tax documents, on the grounds set out in the grounds hereof, in accordance with Article 58 (2) (c) of the Treaty on European Union.
2.	It imposes on the Centre an administrative fine of three thousand euros (EUR 3.000) for failure to comply with the right of access in accordance with Articles 58 (2) (i) and 83 (5) (b) GDPR. 
3.	It shall impose on the Centre an administrative fine  of EUR 5.000 for non-compliance with the Authority’s mandate pursuant to Article 83 (5) (e) and (6) of the GDPR.