HDPA (Greece) - 13/2024

HDPA - 13/2024
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 5(1)(a) GDPR Article 12 GDPR Article 13 GDPR Article 14 GDPR Article 22 GDPR Article 24 GDPR Article 25(1) GDPR Article 28 GDPR Article 30 GDPR Article 31 GDPR Article 35 GDPR Article 37 GDPR Article 38 GDPR Article 39 GDPR Article 55 GDPR Article 83 GDPR
Type:	Investigation
Outcome:	Violation Found
Started:	02.03.2022
Decided:	17.10.2023
Published:	02.04.2024
Fine:	175,000 EUR
Parties:	Ministry of Migration and Asylum
National Case Number/Name:	13/2024
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	Greek DPA (in EL)
Initial Contributor:	Evangelia Tsimpida

The DPA found that the Ministry of Migration and Asylum had failed to comply with a number of provisions of the GDPR and imposed an administrative fine of 175,000 euros and ordered the Ministry to comply with its obligations under the GDPR within three months.

English Summary

Facts

At the end of 2021, the Hellenic DPA (HDPA) became aware of the Ministry of Migration and Asylum's (the controller) development and deployment of the "Centaurus" and "Hyperion" Programmes Closed Control Facility Centres for third country nationals on the Aegean islands (Lesvos, Chios, Samos, Leros and Kos). The HDPA also received requests for an investigation and opinion from the LIBE Committee of the European Parliament, as well as from civil society organisations, on the use of the systems in the asylum facilities.

The Centaurus project is reportedly an integrated digital system for the management of electronic and physical security around and within the facilities. The controller uses CCTV systems, artificial intelligence behavioral analytics (AI) algorithms and unmanned aerial vehicles to process images and personal data. The Hyperion programme is described as an integrated entry/exit control system, with the purpose of monitoring the entry and exit of the guests and certified members NGOs through the processing of personal data, in particular biometric data.

On 3 February 2022, the DPA requested that the controller provide explanations on the programmes and in particular regarding a) the legal basis (statutory provision and/or law) of the intended processing, b) the other elements of such processing (such as time of data retention, information of data subjects, etc.), and c) the question whether an impact assessment study of the effects of the processing on the protection of personal data has been carried out and on 13/9/2022 requested additional information due to ambiguity, while further clarifications were requested on 7/3/2023.

The Ministry argued that - the legal basis is based on the performance of a task carried out in the public interest or in the exercise of official authority (article 6 para. 1 (e) GDPR) - for the processing of special categories of (biometric) data (fingerprints), the legal basis is based on the substantial public interest (Article 9 para. 2(g) GDPR) - prior to the development of the Centaurus programme, alternative protection measures, such as fencing of the property and patrols, were not effective in dealing with illegal activities, such as incidents of theft, assault and vandalism - no record of activities has been kept and that access to the subjects' data is restricted to authorised police users, - no other biometric data file is kept by the Ministry, other than that processed through the Hyperion system, and no personal data is processed by the Hyperion and Centaurus programmes in order to extract special categories of personal data - regarding the consent, the data subjects, upon entering the accommodation facility, fill in a personal data recording form of the Ministry where they give consent to the processing of their data - A Data Protection Impact Assessment has been carried out, which has been partially updated.

Holding

The Greek DPA has assessed the above information and the memos and documents submitted and has taken into account the following: - With regard to the legal basis for processing, there is ambiguity as it is not clear whether and in which cases other legal bases may apply in parallel to the processing of data carried out by the 'Hyperion' and 'Centaurus' systems, while it was noted that in the Ministry's documents, before clarifications were requested, it had invoked legitimate interest and consent as a legal basis. The DPA found a violation of the principle of lawfulness under Article 5(1a) of the GDPR. - The information provided to the data subjects was considered inadequate, as it was clear from the file that the data subjects did not understand Greek or English, thus the information did not comply with the requirement to provide information in "a concise, transparent, intelligible and easily accessible form, using clear and simple wording". The DPA found a violation of Articles 12-13-14 of the GDPR. - In the absence of the required information, it does not appear that data protection contracts have been concluded between the Ministry and the Data processors. The DPA found a violation of Article 28 of the GDPR. - Failure to complete the record of activities prior to the start of the programmes. The DPA found a violation of Article 30 of the GDPR. - The Data Protection Impact Assessments are limited and fragmented, and a comprehensive and systematic assessment of the impact of the planned processing operations on the protection of personal data was not carried out prior to the start of each processing operation. The DPA found a violation of Article 35(1) to (3) of the GDPR. - The interconnections of the systems with other systems were not explained and the potential risks were not assessed. - Failure to comply with the principle of accountability by failing to provide complete, accurate and clear information to adequately document the lawfulness of the operations carried out within the above systems involving the processing of personal data. The DPA found a violation of Article 31 of the GDPR.

The Greek DPA: A) found that the failure to carry out a comprehensive, holistic and coherent Data Protection Impact Assessment from the beginning and by default before the procurement and implementation of the Centaurus and Hyperion systems constituted a violation of Articles 25 and 35 of the GDPR. It imposed a fine of EUR 100,000 for this violation. B) found that the submission to it of pleadings and accompanying documents containing vague, incomplete, confusing and contradictory information constitutes a violation of Article 31 GDPR. For that violation, it imposed a fine of EUR 75,000. C) instructed the Ministry of Migration and Asylum, as data controller, to take all necessary steps to comply with the data controller's obligations as described in the decision within a period of three (3) months.

Comment

This particular decision of the DPA is of great importance, both for the reasoning developed and for the amount of the fine, which is the highest ever imposed by the Greek DPA on a public body. Furthermore, it is important to underline that it aims to protect data subjects who, by definition, are in a vulnerable position, mainly asylum seekers who face difficulties in defending their rights.

Following the decision, the Ministry issued a clarifying press release in which it stressed that "the authority did not take into account that these were systems that had been partially received and piloted in some accommodation facilities and not in the whole, which made it necessary to carry out individual data protection impact assessments and not an overall one, since the processing of personal data could not be assessed before the systems were operational".

There is therefore a very interesting disagreement between the DPA's and the Ministry's views on data protection impact assessments. The DPA clearly states that the data protection impact assessments should in any case be comprehensive, holistic and coherent, whereas the Ministry insists that this was not possible given the conditions in which the systems were developed.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

Summary
The Authority, after receiving knowledge about the development and implementation of the "Centaur" and "Uperion" Programs by the Ministry of Immigration and Asylum in facilities of the Closed Controlled Structures Centers and Reception and Identification Centers for citizens of third countries, proceeded to a thorough check of the integrated digital electronic and physical security management system - "Kentauros" and the integrated entry-exit control system with a reader combined with a fingerprint (i.e. processing biometric data) - "Upperion" in the facilities of the above-mentioned guest structures as well as employees and certified members of non-governmental organizations organizations. The Authority found deficient cooperation on the part of the Ministry of Immigration and Asylum as the Controller and further considered that the required Data Protection Impact Assessments carried out by the Ministry were materially incomplete and limited in scope, and that serious omissions remain regarding with the Ministry's compliance with specific provisions of the GDPR regarding the implementation of the disputed systems. For these reasons, it imposed an administrative monetary fine on the Ministry of Immigration and Asylum for the violations found in relation to the cooperation with the Authority and the Impact Assessments and at the same time sent the Ministry a compliance order within three months regarding its GDPR obligations.