HDPA (Greece) - 39/2021
| HDPA (Greece) - 39/2021 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 5(1) GDPR Article 12(3) GDPR Article 15 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 03.09.2021 |
| Published: | 15.09.2021 |
| Fine: | None |
| Parties: | Anonymous data subject Municipal Transport Company of Rhodes "RODA" |
| National Case Number/Name: | 39/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | Greek DPA (in EL) |
| Initial Contributor: | FD |
Following a complaint by a data subject, the Greek DPA imposed a fine of 8,000 EUR on a transportation company (RODA) for violation of the principle of data minimization (Article 5(1) GDPR) and of the right of access (Article 15 GDPR) in the context of a dispute between RODA and an ex-bus driver (X). In particular, it was found that RODA had issued a 'certificate of service' indicating that X had been fired because of a criminal act, while such information was unnecessary. Also, RODA had not replied to X's access request to obtain a copy of the video-tape of the bus on the day of the controversial incident.
English Summary
Facts
A bus driver ("X") working for the Municipal Transport Company of Rhodes ("RODA") was dismissed following a controversial incident. After having been dismissed, X asked RODA to provide him with a certificate of service. According to the applicable Greek law, such certificate should indicate the identity of the individual concerned, the type of occupation, as well as the period of employment. RODA however delivered a certificate which also included, in addition to the legally required information, the fact that X had been fired because of a criminal act. X considered that adding this information on the certificate was disproportionate and could cause him prejudice.
Exercising his right to access under Article 15 GDPR, X requested RODA to provide him with a copy of the video-tape from the bus camera in order to verify what had happened on the day of the controversial incident. In accordance with Article 12(3) GDPR, RODA had the obligation to answer that request within one month upon receipt. RODA however never replied to X's request.
X considered that by acting this way, RODA had infringed the GDPR. He therefore lodged a complaint with the Greek DPA. During the procedure, RODA explained that it had orally informed X of the fact that the video-tapes of the bus were systematically deleted after 7 days. X, however, denied having received that information.
Holding
After considering all the facts of the case, the Greek DPA found that RODA had breached Article 5(1) GDPR (principle of data minimisation), as well as Article 12(3) and 15 GDPR (right of access by the data subject - obligation to reply within a month). In particular, the Greek DPA considered that, by adding on the certificate of service an information that was unnecessary and which could cause prejudice to the data subject, RODA had infringed the principle of data minimisation. Furthermore, by not replying to X's request to be provided with a copy of the video-tape, RODA had infringed its obligation with respect to access requests. The Greek DPA therefore decided to impose on RODA a fine of 5,000 EUR for breach of Article 12(3) and 15 GDPR, and a fine of 3,000 EUR for breach of Article 5(1)(c) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 03-09-2021
No. Prot.2001
DECISION 39/2021
(Department)
The Personal Data Protection Authority
Department at its headquarters on 26.05.2021 at the invitation of its President,
in order to examine the case referred to in the background hereof.
Attended by the Vice President G. Batzalexis, disabled by the President
of the Authority K. Menoudakou, the regular members of the Authority S. Vlachopoulos and K.
Lambrinoudakis, as rapporteur and the alternate member of the Authority G. Tsolias,
to replace the regular member Ch. Anthopoulos, who, although summoned
legally in writing, did not attend due to disability. You were present without right
K. Karveli, Specialist Scientist-Lawyer, as Assistant Rapporteur,
who left after the discussion of the case and before the conference and the
decision making and E. Papageorgopoulou, employee of the administrative department
Affairs of the Authority, as Secretary.
The Authority took into account the following:
With the no. prot. Γ / ΕΙΣ / 1084/20 and Γ / ΕΙΣ / 2648/20 his complaints to the
Authority, A complains to the Municipal Transport Company of Rhodes "RODA" for not
legal processing of his personal data.
Specifically with the no. prot. Γ / ΕΙΣ / 1084/20 his complaint complains that
following his dismissal from the Municipal Transport Company of Rhodes
"RODA", asked for a certificate of previous service that he worked in the company, which
granted, but adding in breach of the principle of proportionality
that he was fired for a criminal act, thereby provoking, as
claims, damage to his interests.
1 Also with the second with no. prot. G / EIS / 2648/20 denounces him denounces
the company for not satisfying its right of access. Particularly,
following a lawsuit filed against him for embezzlement from
company, as a former employee in the position of collector, requested from
company for judicial use of his defense, as a defendant in criminal
trial, upon his request to be provided with a copy of the videotape
material that recorded the closed circuit television of the bus at the location
of the bus driver on the day of the incident in question on….
But, as he complains, the company never responded to his request,
by tacitly rejecting it, in violation of the provisions of articles 12 par. 3
and 15 of the GCC.
Following these, the Authority sent to the complainant no. prot.
G / EX / 1084-1 / 6.4.20 and G / EX / 2648-1 / 22.6.20 documents for providing clarifications on
of the complainants, which no. prot. Γ / ΕΙΣ / 4683 / 20Reply document
told her the following: a) the videotaping and videotaping that
carried out is not illegal, but is exceptionally permitted, as is
use of the material in question, where there are reasons of public interest, which
concern the prevention of crimes, the protection of the law
interests and the protection of private and family life, b) all
company employees, drivers and collectors, have been informed and
know about the specific processing, and c) the certificate issued
is legal, true and fully compliant with
reality.
Then the Authority with the no. prot. G / EX / 567 / 4.2.21 and G / EX / 568 / 4.2.21
respectively called G. Lampadakis, his attorney
complainant A and the complained Municipal Transport Company
Rhodes "RODA" to attend the meeting of the Authority on 10.02.2021,
in order to discuss the above complaint.
During the hearing, which took place on 24.02.21, after a postponement
from the discussion of 10.02.21, his attorneys were present
complainant George Lampadakis and Elias Zografidis and on her behalf
D. Tsikkis, President of the Municipal Transport Company "Roda"
company after the power of attorney of lawyer Spyridoula Pasari.
The plaintiff's attorneys both at the hearing
procedure as well as with no. prot. Γ / ΕΙΣ / 1546/21 their memorandum to the Authority
stated the following: a) the defendant has not satisfied to date
the complainant's right of access to the videotaped in question, nor
has answered something relevant to his request b) although his case
criminal hearing was put on file, the complainant needs the disputed
material in his defense in his civil action for damages by
complained, c) during the hearing the legal representative of
company reported that the videotaped material has been deleted and that it has
informed the complainants orally, while this did not happen
stated the complainant in her reply to the Authority in 2020, d) h
Certificate of previous service contained personal data not necessary, relevant,
and depending on the intended purpose, in violation of the provisions of
articles 678 of the Civil Code and 5 of the GCC, e) at a later date requested to
re-issued a certificate, which again although did not state that
dismissed for a criminal offense, indicated when dismissed due to a complaint
before the agreed time for an important reason, and f) finally, with a third news
his application and at the same time a complaint to the Labor Inspectorate, h
The complainant issued him a new certificate in which he referred to
recruitment and dismissal decisions, so even this third certificate does not meet
the criteria of 678 of the Civil Code, if one can with the numbers of the decisions
to refer to DIAVGEIA and to see the full text of his dismissal, where
appears as a mocker.
The President of the Municipal Transport Company of Rhodes "RODA" D. Tsikkis
and the attorney S. Pasari, both during the hearing and
and with no. prot. G / EIS / 1862/21 their memorandum to the Authority stated the following:
(a) personnel processing has been processed in relation to the certificate of previous service
data only in the light of the right of access, provided that the attestation
was not transmitted to third parties, in any case following the new one from 23.12.20
At the request of the complainant, the company issued a new certificate with correct
3 repetition in which only the time of its recruitment, the time period, is indicated
period of his employment and the type of his work, b) the recording of
personal data from the video camera that is
mounted inside the buses above the driver's seat
videotaped only the issuance transaction we observe between driver and passenger,
without depicting faces and without sound, and the data collected through
of the video surveillance system are not stored in an archiving system,
and the duration of their observance is limited to seven (7) days, after the end of
which are automatically deleted, c) υλικό its material was automatically deleted
camera, a fact of which he was aware and of which he had been orally informed o
complainants and d) from 3.3.21 the BoD has voted in favor. of the company written
CCTV policy attached to the Authority.
The Authority, after the hearing and examination of the evidence
of the dossier and after hearing the rapporteur and the assistant rapporteur, who
left after the case was discussed and before the conference and reception
decision, after a thorough discussion
THOUGHT ACCORDING TO THE LAW
1. According to the provisions of article 5 par. 1 lit. a ', b' and c 'of the GPD
personal data should a) be submitted to lawful and
fair processing in a transparent manner in relation to the data subject
(principles of legality, objectivity and transparency), b) collected for
specified, explicit and lawful purposes and not to be subject to
further processing incompatible with these purposes (principle of
(c) are appropriate, relevant and limited to
necessary for the purposes for which they are processed (principle
data minimization).
Furthermore, according to article 12 par. 3 of the GKPD, “the controller
provides the data subject with information about the action that
4π ικ α δ τ ά 1έ 2χ
delay and in any case within one month of receipt of the request.
This period may be extended by a further two months, provided that
required, taking into account the complexity of the request and its
number of requests. The controller informs the subject of
data for the said extension within one month of receipt of the request,
as well as for the reasons of the delay ".
Finally, according to Article 15 of the GIP, the data subject has the
right to receive confirmation from the controller of the
whether or not the personal data concerning it exist
processing.
2. Also, according to article 678AK "At the end of the contract o
employee may require from the employer a certificate of the type and
the duration of his work. Only if the employee specifically requests it is confirmed
and the quality of his work and his conduct ".
3. In the present case, on the basis of what emerged from the hearing
procedure and from the examination of the data in the file, the complainant
Rhodes Municipal Transport Company "RODA", as responsible for processing, a)
in violation of the provisions of article 5 par. 1 lit. c of the GKPD, granted
to the complainant after his dismissal from the company, a certificate
in which it was listed, apart from its type and duration
and the information that he was dismissed due to a criminal act and b) against
Violation of the provisions of Articles 12par.3 and 15 of the GCPD, never answered
in writing to the complainant's request of 22.7.19 for a copy
of the videotaped material recorded by his closed circuit television
bus in the driver's seat on the day of the incident
controversial incident on 23.2.20, tacitly dismissing it.
Consequently, there is a violation of the above-mentioned provisions
principle of proportionality (article 5 par
right of access, as well as not being informed of his request
complainant for access to data concerning him (articles 12 par. 3 and
15 ΓΚΠΔ).
5 4. In view of the above, the Authority, taking into account its weight
infringement proved and the insult inflicted by it on
complainant, considers that it should be imposed on the complainant in application
of the provision of article 58 par. 2 ed. i) of the GCC effective, proportionate and
a deterrent administrative fine, in accordance with Article 83 of the GIP 1.
Because the violation found by the Authority of the provisions of Articles 5
par. 1 item c), 12 par. 3 and 15 GPA are subject to the cases of enforcement
administrative fines of article 83 par. 5 ed. a 'and b' GKPD.
FOR THOSE REASONS
The beginning
Imposes on the Municipal Transport Company of Rhodes "RODA", as responsible
for reasons set out in detail in its rationale
present, the proportionate and dissuasive administrative fine imposed
appropriate to the case, according to the specific circumstances
a) of five thousand (5,000.00) Euros, for the violation of the provisions
of articles 12 par. 3 and 15 GPA and b) amounting to three thousand (3,000.00) Euros,
for the violation of the provisions of article 5 par. 1 lit. c of the GCC, ie
a total of the administrative fine of eight thousand (8,000.00) Euros.
The Deputy Chairman The Secretary
George Batzalexis Irini Papageorgopoulou
1
See OE29, Guidelines and the implementation and determination of administrative fines for the purposes of regulation 2016/679 WP253,
p. 6
6
