HDPA (Greece) - 34/2023: Difference between revisions
Inder-kahlon (talk | contribs) (Created page with "{{DPAdecisionBOX |Jurisdiction=Greece |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoGR.jpg |DPA_Abbrevation=HDPA |DPA_With_Country=HDPA (Greece) |Case_Number_Name=34/2023 |ECLI= |Original_Source_Name_1=HDPA |Original_Source_Link_1=https://www.dpa.gr/sites/default/files/2023-11/34_2023%2520anonym.pdf |Original_Source_Language_1=Greek |Original_Source_Language__Code_1=EL |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Sour...") |
Inder-kahlon (talk | contribs) mNo edit summary |
||
| Line 68: | Line 68: | ||
=== Facts === | === Facts === | ||
The company PEIRAIOS LEASING posted an advertisement for the property owned by CPB LEASING, in that advertisement there was a photo of the complainant's car parked next to it. The property was previously owned by the complainant's father before it was seized. The complainant claimed that the license plate of his car was visible in the photograph, causing his social circle to become aware of the loss of his family property. | The company [https://publicity.businessportal.gr/company/7480501000 PEIRAIOS LEASING] posted an advertisement for the property owned by CPB LEASING, in that advertisement there was a photo of the complainant's car parked next to it. The property was previously owned by the complainant's father before it was seized. The complainant claimed that the license plate of his car was visible in the photograph, causing his social circle to become aware of the loss of his family property. | ||
The complainant submitted a request to object and for erasure of the personal data concerning him, i.e. the license plate, to the DPO of the PEIRAIOS LEASING. The DPO responded, stating the car's registration number is not visible, but in order to avoid any concern the photograph has already been removed from their website but it will remain in the company's archives as proof of the fact that the registration number of the car is not visible. | The complainant submitted a request to object and for erasure of the personal data concerning him, i.e. the license plate, to the DPO of the PEIRAIOS LEASING. The DPO responded, stating the car's registration number is not visible, but in order to avoid any concern the photograph has already been removed from their website but it will remain in the company's archives as proof of the fact that the registration number of the car is not visible. | ||
| Line 77: | Line 77: | ||
=== Holding === | === Holding === | ||
After reviewing the case, the Authority first concludes that since the complainant had originally submitted a complaint against Piraeus Leasing and another similar complaint against CBP Leasing (which was renamed to PIRAEUS FINANCIAL LEASING SINGLE MEMBER S.A.). However since both of these companies ceased to exist, the beneficiary by Formation for both companies for any pending lawsuits is now the PEIRAIOS LEASING M.A.E. Therefore, the defendant party in this case becomes the PEIRAIOS LEASING M.A.E. and the two complaints are considered together because of their relevance and because they have been filed by the same complainant against the same now defendant company. | After reviewing the case, the Authority first concludes that since the complainant had originally submitted a complaint against Piraeus Leasing and another similar complaint against CBP Leasing (which was renamed to [https://publicity.businessportal.gr/company/3877401000 PIRAEUS FINANCIAL LEASING SINGLE MEMBER S.A.]). However since both of these companies ceased to exist, the beneficiary by Formation for both companies for any pending lawsuits is now the [https://publicity.businessportal.gr/company/162425301000 PEIRAIOS LEASING M.A.E.] Therefore, the defendant party in this case becomes the PEIRAIOS LEASING M.A.E. and the two complaints are considered together because of their relevance and because they have been filed by the same complainant against the same now defendant company. | ||
Then the Hellenic Data Protection Authority found that the data controller PEIRAIOS LEASING M.A.E. has processed personal data of the complainant in violation of the GDPR. As such, the DPA issued a fine of: | Then the Hellenic Data Protection Authority found that the data controller PEIRAIOS LEASING M.A.E. has processed personal data of the complainant in violation of the GDPR. As such, the DPA issued a fine of: | ||
a) €10,000 for the breach of the data minimisation principle outlined in Article 5(1)( | a) €10,000 for the breach of the data minimisation principle outlined in [[Article 5 GDPR|Article 5(1)(c)]] of the GDPR. | ||
b) €10,000 for the violation of Articles 15(1) Right of access by the data subject. | b) €10,000 for the violation of [[Articles 15(1)]] Right of access by the data subject. | ||
== Comment == | == Comment == | ||
Revision as of 19:30, 8 December 2023
| HDPA - 34/2023 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 5(1)(c) GDPR Article 15(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 09.11.2020 |
| Decided: | 10.11.2023 |
| Published: | 29.11.2023 |
| Fine: | 20000 EUR |
| Parties: | ΠΕΙΡΑΙΩΣ ΧΡΗΜΑΤΟΔΟΤΙΚΕΣ ΜΙΣΘΩΣΕΙΣ ΜΟΝΟΠΡΟΣΩΠΗ ΑΝΩΝΥΜΗ ΕΤΑΙΡΕΙΑ (PEIRAIOS LEASING M.A.E) |
| National Case Number/Name: | 34/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Inder-kahlon |
The Hellenic DPA imposed an administrative fine amounting to €20,000 on a leasing company, €10,000 for violating Article 5, paragraph 1(c), and an additional €10,000 for mishandling the data subject access request under Article 15, paragraph 1.
English Summary
Facts
The company PEIRAIOS LEASING posted an advertisement for the property owned by CPB LEASING, in that advertisement there was a photo of the complainant's car parked next to it. The property was previously owned by the complainant's father before it was seized. The complainant claimed that the license plate of his car was visible in the photograph, causing his social circle to become aware of the loss of his family property.
The complainant submitted a request to object and for erasure of the personal data concerning him, i.e. the license plate, to the DPO of the PEIRAIOS LEASING. The DPO responded, stating the car's registration number is not visible, but in order to avoid any concern the photograph has already been removed from their website but it will remain in the company's archives as proof of the fact that the registration number of the car is not visible.
An acquaintance of the complainant shared emails with him, revealing that, as a potential buyer, Piraeus Real Estate S.A. had shared images of the property, including the photo previously posted in property advertisement on PEIRAIOS LEASING's website. The photo, presented was better resolution making the license plate number of the car clearly visible.
These images were also seen by individuals familiar with the complainant, sparking discussions such as 'Is this not his car?... Is this not his father's house? Huge!!! What's going on? Did they eventually lose it?' These conversations occurred among mutual acquaintances and were subsequently shared with the complainant by one of his acquaintance.
Holding
After reviewing the case, the Authority first concludes that since the complainant had originally submitted a complaint against Piraeus Leasing and another similar complaint against CBP Leasing (which was renamed to PIRAEUS FINANCIAL LEASING SINGLE MEMBER S.A.). However since both of these companies ceased to exist, the beneficiary by Formation for both companies for any pending lawsuits is now the PEIRAIOS LEASING M.A.E. Therefore, the defendant party in this case becomes the PEIRAIOS LEASING M.A.E. and the two complaints are considered together because of their relevance and because they have been filed by the same complainant against the same now defendant company.
Then the Hellenic Data Protection Authority found that the data controller PEIRAIOS LEASING M.A.E. has processed personal data of the complainant in violation of the GDPR. As such, the DPA issued a fine of:
a) €10,000 for the breach of the data minimisation principle outlined in Article 5(1)(c) of the GDPR.
b) €10,000 for the violation of Articles 15(1) Right of access by the data subject.
Comment
The disclosure of personal data, even as basic as a car license plate, can have profound consequences, causing embarrassment, and disrupting one's peace of mind. This incident underscore the importance of safeguarding individual's privacy and the potential far-reaching impact of seemingly innocuous information.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Summary The Authority investigated a complaint by a natural person against a company related to the processing of a photo in which the license plate number of the complainant's car was visible and imposed a fine of €10,000 for a breach of Article 5 of the GDPR and a fine of €10,000 for a breach of Article 15 of the GDPR.
