HDPA (Greece) - 2/2023
| HDPA - 2/2023 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 31 GDPR Article 58(1) GDPR Article 83(4) GDPR Article 13 of National Law 4624/2019 Article 15 of National Law 4624/2019 Article 66 of National Law 4624/2019 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 20.12.2022 |
| Decided: | 13.01.2023 |
| Published: | 13.01.2023 |
| Fine: | 50.000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 2/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Anastasia Tsermenidou |
The HDPA imposed a fine of EUR 50.000 to Intellexa S.A. for not providing specific data to the HDPA for investigation purposes and for installing a monitoring software without informing the data subjects.
English Summary
Facts
A, submitted to the HDPA the complaint, by which he notified the Commission of the complaint he had filed before the Prosecutor of the Supreme Court concerning the alleged attempted interception of his mobile phone terminal phone with the 'Predator' surveillance software and the relevant report of the European Parliament's Special Service, requesting that the HDPA to detect the illegal action. Following investigations by the HDPA and numerous press publications, which linked Intellexa S.A. with the above mentioned monitoring software, the HDPA carried out on 15-09-2022 an on-site administrative audit at the headquarters of Intellexa S.A., and find out that its purpose is, inter alia, to provide services related to the design and development of applications, networks and systems, software and technological solutions in general, as well as services. The HDPA sent Intellexa S.A. a document containing the questions of the inspection. Despite multiple telephone assurances from the company's lawyers to auditors of the audit team that the information would be sent, the company did not submit to the HDPA the information document. The HDPA noted that Intellexa S.A. has unduly delayed to respond to its requests and has failed to provide information which in its possession and requested by the HDPA. The HDPA also took into account that the nature and gravity of the infringement is particularly serious. The infringement found is included in those of the article 83(1)(a) par. 4 of the GDPR (infringements with a maximum amount of EUR 10 000 000); and concerned the investigated personal data processing activities of the company, from the year 2019 to 2022, which are related to the production, support and operation of software/software solutions for processing of all types of personal data, not excluding specific categories of personal data. In the light of the above and without prejudice to the exercise of its powers under the GDPR on the basis of the results of the audit carried out, the Authority considers that unanimously that, in view of the infringement found and taking into account the above elements, the conditions for imposing a fine on the HDPA are fulfilled.
Holding
The HDPA carried out an administrative audit at Intellexa S.A. investigating cases of installation of monitoring software on users' mobile telephony terminals for the purpose of unknowingly monitoring them, as well as the subsequent collection and processing of their personal data collected by such software. As the company was excessively late in responding to the Authority's enquiries and did not provide specific data requested and in its possession, the Authority imposed a fine of EUR 50. 000 and ordered that specific data be delivered to it immediately.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Summary The Authority carried out an administrative audit on Intellexa SA. investigating cases of the installation of tracking software on users' mobile terminal devices, with the aim of tracking them without their knowledge, as well as the subsequent collection and processing of their personal data collected by such software. As the company was excessively late in responding to the Authority's questions and did not provide specific information that was requested and is in its possession, the Authority imposed a fine of 50,000 euros and ordered that specific information be delivered to it immediately.
