HDPA (Greece) - 3/2022
| HDPA - 3/2022 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 4(7) GDPR Article 15 GDPR Article 18 GDPR Article 58(2)(f) GDPR National Law 3917/2011 Article 6 National Law 4624/2019 Article 15 National Law 4624/2019 Article 18 |
| Type: | Other |
| Outcome: | n/a |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 3/2022 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Anastasia Tsermenidou |
The Greek DPA ordered three mobile telephone service providers to suspend the processing of the destruction of data related to telephone numbers until a final decision of the DPA is adopted.
English Summary
Facts
The data subject received two short text messages (SMS) on his mobile telephone number intended to mislead him to follow hyperlinks through which a spy software would be installed. The data subject made a request to exercise the right of access under Article 15 GDPR and the right to restriction of processing under Article 18 GDPR against three mobile telephone service providers (the controllers). The DPA initiated its own investigation against the controllers concerning the installation of software on a user' device without consent and the related processing of personal data.
In response to the request, only one of the controllers provided a copy of the data and stated that the critical personal data had already been extracted and handed over to the DPA and therefore could not be destroyed. The data subject directed a complaint to the Greek DPA with a request for urgent action on the matter.
Holding
The DPA explained that during the sending and use of SMS, traffic and location data are generated and processed. If they refer to a natural person, they constitute personal data within the meaning of Article 4(7) GDPR. Furthermore, the erasure or destruction of personal data is a form of processing based on Article 4(2) GDPR.
The DPA has the power to issue an ex officio interim order for immediate total or partial temporary restriction of processing under Article 15(4)(c) and 15(8) of Law No. 4624/19, the national data protection law, in conjunction with Article 58(2) GDPR.
According to Article 6 of National Law 3917/2011, records, such as the ones in question, are to be kept for a period of 12 months from the date of the communication and should be destroyed at the end of the period of retention by an automated procedure, except those to which access has been lawfully obtained. Considering these facts, the SMS would be destroyed after the end of the above mentioned period. Due to the ongoing investigation, the DPA had to prevent the personal data from being deleted or destroyed.
Therefore, in order to exercise its supervisory powers and to ensure that the rights of the data subject are protected, the Greek DPA ordered the controllers to retain and not delete the above data personal data (traffic and location data), until the DPA releases its final decision.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
We use cookies that are necessary to maintain your connection to the online services of the Authority's Internet Portal (PO) and to store your choices in relation to optional cookies ("Necessary").
Only with your consent will we use any of the following optional cookies you choose ("Analysis", "LinkedIn", "Twitter"). You can see information about each category of cookies by hovering over each option.
