HDPA (Greece) - 33/2023
| HDPA - 33/2023 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 6(1)(c) GDPR Article 17(1) GDPR Article 57(1)(c) GDPR Article 58(2) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 25.10.2021 |
| Decided: | 11.04.2023 |
| Published: | 07.11.2023 |
| Fine: | 5000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 33/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Iliana Papantoni |
The Hellenic DPA fined a municipality for uploading personal data to a public portal and then failing to comply with the subsequent erasure request.
English Summary
Facts
A municipality uploaded on a public portal (“diavgeia”) a decision where the personal data of the complainant including her full name, position, place of employment and involvement in a criminal complaint were mentioned. A separate decision regarding her participation in the municipality's financial council was also discovered on the portal. The complainant requested the erasure of her personal data from the public portal by exercising her right to erasure under Article 17 GDPR.
The DPO of the municipality rejected her request on the grounds that the municipality had the legal obligation to upload onto this portal every act, decision or document relating to the performance of its duties, under national law.
In 25 October 2021, the complainant lodged a complaint before the Hellenic DPA ("HDPA") against the municipality.
Holding
After considering all the facts of the case, the Hellenic DPA fined the municipality a total of €5000. €2,000 for violating Articles 5(1)(a) and 6 (1)(c), €1000 for violating Article 5(1)(c) and €2000 for violating Article 17 (1) GDPR.
The Hellenic DPA ordered the Municipality X to remove the two decisions concerning the data subject from its website and within a 20-day period. The HDPA also advised the legislator, according to Article 57(1)(c) GDPR, to determine a criteria for the selection of decisions which will be published through the portal.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
