HDPA (Greece) - 49/2023
| HDPA - 49/2023 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 6(1)(c) GDPR Article 12(3) GDPR Article 12(4) GDPR Article 18 GDPR Article 21 GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 49/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Iliana Papantoni |
The HDPA reprimanded NKUA for violation of Article 12 (3) and Article 12 (4) of the GDPR by delaying its response to the complainant's requests.
English Summary
Facts
The complainant, a candidate for a professor position at the National and Kapodistrian University of Athens (NKUA), alleged that the selection committee processed his personal data without his consent by collecting information from third-party sources. Specifically, the selection committee gathered personal data from public sources such as the National Printing House, Diavgeia, the website of University of Cyprus, etc. This data was used to verify the claims made in the complainant's application. The committee's report, which included the collected personal data, was subsequently published on the Apella system (a platform used for the election and promotion of Faculty members), making it accessible to a broader audience, including members of the electoral body and other authorized users. The complainant exercised his rights to restrict and object to the processing of his data under Articles 18 and 21 of the GDPR. However, these requests were rejected by the NKUA, which argued that the data processing was conducted in compliance with legal obligations under Article 6 (1c) of the GDPR and relevant national laws. The complainant further contested the lawfulness of the data processing, arguing that the relevant national law did not explicitly authorize the use of third-party sources beyond recommendation letters. Despite this, the NKUA maintained that the processing was lawful and necessary for the evaluation of the candidate's qualifications.
Holding
The HDPA determined that the processing of the complainant's data by the NKUA was lawful, as it was based on Article 6 (1c) of the GDPR, which allows processing for compliance with a legal obligation. However, the HDPA found that the NKUA violated Article 12 (3) and 12 (4) of the GDPR by failing to respond to the complainant's requests within the stipulated timeframe. Consequently, the HDPA issued a reprimand to the NKUA for this violation.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 29-01-2024 No. Prot. 427 A P O F A S H 49 /2023 The Personal Data Protection Authority met in Plenary composition at the invitation of its President, at its headquarters, on Tuesday, June 13, 2023, in order to examine the case, referred to below in the history of this decision. The President of the Authority, Konstantinos Menoudakos and the regular members of the Authority Spyridon Vlachopoulos, Konstantinos Lambrinoudakis, Christos Kalloniatis, Aikaterini Iliadou, Grigorios Tsolias, the alternate member of the Authority Nikolaos Livos were present, in place of the regular member Charalambos Anthopoulos, who did not attend, although the alternate member of the Authority, Maria Psalla, was also legally summoned, as a speaker without the right to vote. Also present without the right to vote were Anastasia Tritaki, legal auditor - lawyer, as assistant rapporteur and Irini Papageorgopoulou, employee of the administrative affairs department, as secretary. The Authority took into account the following: Wi
