HDPA (Greece) - 9/2025
From GDPRhub
| HDPA - 9/2025 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 2(2)(c) GDPR Article 6(1)(f) GDPR |
| Type: | Complaint |
| Outcome: | Partly Upheld |
| Started: | 18.07.2022 |
| Decided: | 06.02.2025 |
| Published: | 15.02.2025 |
| Fine: | 1000 EUR |
| Parties: | A, B, C, D, E, F (data subjects) Data Controller (natural person) |
| National Case Number/Name: | 9/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Vasiliki Kalantzi |
The DPA imposed a fine of €1,000 on an individual complainant before ecclesiastical authorities for unlawfully transmitting others' personal data to such authorities. The DPA decide, that such processing must be necessary for the ecclesiastical complaint procedure.
English Summary
Facts
In 2022 the DPA received six complaints from six different data subjects, regarding the illegal disclosure of their personal data to ecclesiastical authorities by a natural person (controller). Only three of the data subjects the individual complaint about were clergymen.
In the course of a legal dispute between the controller and the six data subjects the controller sent two complaint letters within a complaint procedure based on national law to several ecclesiastical officials and authorities (inter alia, two Archbishops, one Archimandrite and the General Hierarchical Commissioner of the Holy Metropolis). The conflict related to the controller's purchase of an apartment in a building in which the data subjects live together.
Both letters of complaint were accompanied by numerous supporting documents containing a multitude of personal data of the six data subjects (home addresses, contact information, marital status, tax identification number, professional capacity, property details).
According to the controller, the purpose of his letters of complaint was to provide the ecclesiastical authorities with full information to discipline the three clergymen/data subjects by any appropriate means at their discretion, ''so that peace and tranquility may prevail in my home and in my personal life''.
Holding
Regarding the controller's claim that the above letters of complaint sent to the ecclesiastical authorities were part of a household activity, the DPA held that a submission before a body or authority (such as an ecclesiastical authority) entails at least the use and disclosure through transmission of personal data within the scope of Article 4(1) and (2) GDPR.
The DPA found, that only two recipients of the complaint letters had any disciplinary authority relating to the controller's complaints over only three of the six data subjects. Thus, the DPA held, that
- the transmission of the data of the two clergymen to all recipients and
- the transmission of the data of the data subjects who do not have the status of clergy to any recipient
was not necessary or appropriate for the exercise of the right of the controller to report the clergymen. Thus the DPA held, that there was no legal basis for that processing under Article 6(1)(f) GDPR.
Considering the particular circumstances of the examined case, the Hellenic DPA partly upheld the filed complaints and imposed a total fine of €1,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 06-02-2025 No. Prot. 526 DECISION 9 /2025 (Single-person Body) The President of the Personal Data Protection Authority, as a single-person body pursuant to article 17 par. 1 of law 4624/2019 (Government Gazette A' 137), within the framework of the responsibilities provided for in articles 4 par. 3 and 10 par. 4 of the Regulation of Operation of the Authority (Government Gazette B'879/25.02.2022), met on Thursday, February 15, 2024, in order to examine the case, which is mentioned below in the history of this decision. Present without the right to vote were Anastasia Tritaki, legal auditor - lawyer and Irini Papageorgopoulou, employee of the administrative affairs department, as secretary. The Authority took into account the following: With the no. prot. Authority C/ΕΙΣ/8922/18-07-2022, C/ΕΙΣ/8926/18-07-2022, C/ΕΙΣ/8928/18-07-2022 C/ΕΙΣ/8930/18-07-2022, C/ΕΙΣ/8932/18-07-2022 C/ΕΙΣ/8937/18- 07-2022 complaints A, B, C, D, E and F (hereinafter complainants) complain against Z (hereinafter defendant), for: A) communication of their personal data through the letter dated 21-5-2021, accompanied by fifty-seven (57) accompanying documents, which the defendant sent to: a) H (through T, Director of …), b) I, in his capacity as …, c) Metropolitan K, in his capacity as …, d) Metropolitan L, e) Metropolitan M, f) Archimandrite N. 1 Kifissias Avenue 1-3, 11523 Athens T: 210 6475 600 E: contact@dpa.gr www.dpa.gr B) communication of their personal data through the document dated 10-6-2021, which the defendant addressed to the General Hierarchical Commissioner of the Holy Metropolis X, following the transmission of the above letter from Metropolis ‘K’, due to lack of competence, to Metropolis ‘L’. According to the above complaints, the defendant is engaged in a long-standing civil and criminal legal dispute with the complainants related to the defendant's purchase of an apartment in a building in which the complainants live together, as well as to neighborhood issues and urban planning violations that have since arisen. For this dispute, and given that three of the complainants have the status of clergy, specifically A (Archimandrite, A), B (Archimandrite, B) and C (Hieromonak, C, active), the defendant sent the letter dated 21-5-2021 to the aforementioned recipients, attaching to it solemn declarations, contracts, lawsuits, court decisions (with full content), out-of-court documents, out-of-court reports, documents from the Urban Planning Department, copies of police documents (indicative excerpts from the Book of Offenses and Incidents or from the vehicle logbook), various requests from the complainants to public authorities, documents submitted by the complainants to Urban Planning services and other documents containing a large amount of personal data of the complainants (indicative personal details: address, contact details, family status, VAT number, professional status, property details). With the above letter dated 21-5-2021, the defendant requested from the above recipients to carry out a thorough check regarding the contents of his letter and to receive a written response to the questions he raised, noting that the aim of the letter is “to inform you broadly, and to reconcile the above by any means you deem appropriate, so that peace and tranquility may be achieved in my home and my personal life”. According to the complainants’ allegations, the defendant addressed the above recipients, without them having the authority to resolve in any way the private disputes between them. In support of this, the complainants invoked: - the letter no. prot.… of the Holy Metropolis ‘M’ (prot. no. Archis C/EIS/11910/19- 11-2022) to the Holy Synod of the Church of Greece, notified to the defendant, A and B, in which it is stated that “From all the documents brought before us, it appears that in fact between the complainant Z and the above-mentioned accused priests, there was and is a private dispute, concerning issues mainly of urban planning violations, issues related to shared and jointly owned spaces and many other issues concerning the regulations of the apartment building, on a building located on street … no. … in … . The competent courts of the state have ruled on their disputes and it is possible that the legal dispute will continue for a time that we are not in a position to know. On issues that fall within the competence of civil and criminal justice, we are not competent to express any opinion given that the constituted Greek State has already ruled. Whether the issued court decisions are implemented or not by the parties involved is a matter that falls within the competence of the Greek Judiciary" - the case with no. prot. … letter from the Holy Metropolis ‘L’ (no. prot. Authority C/EIS/ 11910/19- 11-2022) to the defendant in which it is stated that C’s conflict does not constitute a disciplinary ecclesiastical offense, which would mean calling him to apologize, “as the entire matter is a private matter between you and the co-owners of the apartment building in which you reside”. Furthermore, the complainants claim that the letter was not filed in a closed, “strictly personal” envelope, since the filed envelopes were filed at the headquarters or representations of the above recipients or were sent by mail, so that these envelopes could then be processed accordingly. The complainants claim that they received phone calls from many clerical and lay employees, …, of the Metropolises throughout Greece and from the Monastery 'N', with the aim of expressing their curiosity, in a way that, according to the 3 allegations of the complainants, reveals the knowledge of their personal data by a number of third parties, known and unknown to them. Furthermore, the complainants state that they had not been informed by the defendant before sending the letter and the documents accompanying it, nor had they provided relevant consent for the disclosure of the said information. The Authority, in the context of examining the above complaint, invited the defendant with its document no. Μ/ΕΣΕ/2527/11-10-2022 to present his views on it. With its document no. Μ/ΕΣΕ/2527/11-10-2022 Authority C/ΕΙΣ/11606/08-11-2022 in his memorandum, the defendant argued before the Authority, among other things, the following: a) that the documents attached to the letter constitute integral parts thereof and satisfy the “necessary condition of proving the truth of my allegations, in order to avoid characterizing me as a malicious slanderer”, b) that the disputed letter had a specific objective which is explicitly stated at the end of it as follows: “By sending this letter, I wish to make you partakers of the time-honored unacceptable ecclesiastical behavior and conduct of three priests of the Eastern Orthodox Church (…) by harming my legitimate interests with the actions for more than a decade and mainly by scandalizing a multitude of faithful and respectable citizens (…)”, therefore, the objective was the informing of the competent ecclesiastical bodies about the public behavior of three of the six complainants, who have the status of priest, c) that the disputed letter with its accompanying documents was strictly personal to its recipients and was deposited by the defendant himself in a sealed envelope at the Holy Synod and the Holy Metropolis 'L', while the defendant delivered the disputed letter in person to Metropolitan K and Metropolitan Th (the defendant provided the relevant certificates); with regard to the recipients outside Attica, the defendant stated that the disputed letter was sent by a private mail delivery company (the defendant provided the relevant dispatch notes). The aforementioned, according to the defendant, took place in order to fully ensure the confidentiality of the file's data, d) the disputed letter with its accompanying documents, 4 was circulated, according to the defendant's claim, to a strictly limited number of persons who were competent to receive knowledge and judge whether further actions should be taken against the accused, as it constitutes a "report" to the competent hierarchs, either current "Supervisors" of the accusing priests or in the past having a direct hierarchical or spiritual relationship with them, which "contains excuses for their behavior on real events proven beyond a shadow of a doubt by the documents presented with it, but also specific requests, directly or indirectly, for the redress or prevention of my moral and material damage from their actions". With the document under the no. of the Authority's protocol C/ΕΙΣ/11837/16-11-2022, the complainants requested and received a copy of the defendant's views and in response filed a memorandum under the no. of the Authority's protocol C/ΕΙΣ/11910/19-11-2022, in which, after repeating the allegations they raised in the initial complaints before the Authority, they also argued, among other things, the following: a) that the real purpose the sending of the disputed letter by the defendant was to exert pressure on the complainants, so that they, in their capacity as co-owners in the same building, would provide their consent required by law for uses of the common areas for which the defendant was controlled by the competent urban planning authority, b) that the submission of the disputed letter with all the documents was followed by numerous communications of the complainants' personal data with photocopies, archiving and obtaining knowledge from numerous employees of the relevant Secretariats, indicatively from the Holy Synod of the Church of Greece to the Holy Metropolis 'M' with the no. prot.: … document, by which it notifies “…the letter of Z, (..), with the attachments therein,…” and from the Holy Metropolis ‘K’, to Metropolitan L, with the number prot.: … document, by which the incompetence of Metropolitan K is declared and the disputed letter in its entirety is transmitted, c) that at no point in the memorandum does the defendant justify with what competence he notified the data of the remaining (3) three non-clerical and civilian co-owners, d) that H.M. ‘M’ and H.M. ‘L’ with their relevant decisions, 5 ruled that they did not have the competence to take action against the complainants (see above, the complainants provided the relevant decisions), while Metropolitan K, forwarded the relevant disputed letter with its accompanying documents to His Holiness ‘L’, since he himself had no competence, while the other recipients did not respond in this regard, due, in the complainants’ opinion, to the lack of relevant competence. Following the examination of the file, the Authority sent the no. Authority protocol G/EIS/907/10-04-2023 summons for hearing to the defendant Z and the no. protocol Authority G/EIS/906/10-04-2023, G/EIS/905/10-04-2023, G/EIS/904/10-04-2023, G/EIS/903/10-04-2023, G/EIS/902/10-04-2023 and G/EIS/901/10-04-2023 summons respectively to the complainants, in order to attend, via videoconference, a hearing before the President of the Authority, as a single-person body on Wednesday, April 26, 2023 at 10.00 a.m. regarding the discussion of the above complaints. During the above meeting, the complainants were present with the power of attorney of their lawyer Despina Patelis (AM DSA …), while the complainant attended in person and submitted a request to postpone the meeting due to the inability of his power of attorney Maria-Penelope Liakogona (AM DSA …), for which he also presented the supporting documents with the Authority's protocol no. G/EIS/3013/25-04-2023. The President of the Authority accepted the request for postponement and set the discussion for a new date on Wednesday, May 10, 2023 at 12.30 p.m. At the hearing before the President of the Authority on 10 May 2023, the complainants were represented by their attorney Despina Patelis (AM DSA …), while the respondent was represented by his attorney Maria-Penelope Liakogona (AM DSA …). Both parties, after orally presenting their views, were given a deadline at that hearing to submit written submissions by 29 May 2023 in further support of their claims. Following this, the complainants submitted the memorandum with no. prot. C/EIS/4035/29-05-2023 within the deadline, while the respondent submitted the memorandum with no. prot. C/EIS/4041/29-05-2023 within the deadline. 6 During the above hearing and with their memorandum under no. prot. C/ΕΙΣ/4035/29-05-2023 following the hearing, the complainants further developed the allegations they previously raised before the Authority and added, among other things, that a) the recipients of their data are completely incompetent for the private dispute brought to their attention, a fact which is also proven by the absence of responses (except for the responses of I.M. ‘M’ and I.M. ‘Λ’ mentioned above). The only ones responsible for disciplinary control would be Metropolitan L and Metropolitan M, as it is expressly provided, according to the sacred canons of the Church and by law, that each cleric (presbyter) is canonically dependent on his bishop, namely the "local" bishop, to whom the cleric is subject and not on any other bishop or on any presbyter (as is the Abbot of [Monastery] 'N') or much more on a group of ecclesiastical officials and a group of clerics or on NPDD and NPID, inside and outside Greece. (Article 1.a of Regulation No. 305/2018 (Government Gazette A’ 153) according to which: “1.a. A priest is a cleric of the Orthodox Church of Greece, holding the second degree of the Priesthood (Presbyter), canonically ordained and canonically dependent on the local Metropolitan, who covers the worship, pastoral and welfare needs of the Parish” and Article 100 of Law 5383/1932 according to which: “The competent Metropolitan (or his legal substitute) upon receiving notice, either following a complaint or in any other way, that a cleric or monk has committed an offense entailing an ecclesiastical penalty, shall, provided that it is not a minor offense, misconduct, for which disciplinary authority may be exercised by the Metropolitan, on one of the members of the Episcopal Court or another cleric to proceed with the necessary investigations", b) the characterization "strictly personal" does not ensure the confidentiality of the content of the file in the NPDD and NPID, c) article 6 par. 1 item f) GDPR cannot be applied, as they override the interest or fundamental rights of the complainants, since 3 out of 6 7 do not have the priestly capacity, while the form and extent of the letter and its accompanying documents do not constitute a necessary, appropriate and proportionate means. During the above hearing and with the no. prot. G/ΕΙΣ/4041/29-05-2023 following the hearing of his memorandum, the defendant further developed the claims he previously raised before the Authority and added, among other things, that a) the said report does not fall within the scope of Regulation 2016/679 (EU) (GDPR), since it is a private dispute (Article 2, paragraph 2, point c of the GDPR), while he himself is not a “data controller” b) that if Regulation 2016/679 (EU) were to be considered applicable, the said processing falls under Article 6, paragraph 1, point f of the GDPR, for the protection of the legitimate interests pursued by the data controller or a third party, as ensuring his legitimate rights was the exclusive purpose of sending the letter, c) that addressed the disputed letter to the ecclesiastical superiors of the three priestly complainants, responsible for their mediation, while he also addressed it to the Abbot of the Holy Monastery of St. ‘N’ and H, due to the spiritual ties that he knew they had with the priests, d) that he took every appropriate means, according to common experience and logic, to ensure receipt of the files, delivering them sealed and characterizing them as strictly personal, e) that he proceeded to send the letter in question, with its attachments, exercising the right under article 10 of the Constitution and the implementing law L.D. 796/71 to report to the authorities, and addressing the absolutely competent persons in charge of the three priests, while the mention of other persons was necessarily continued with the described behavior of the priests and the facts mentioned in the letter, f) that the submission of the report is based on the provisions of L.590/1977 “On the Statute of the Church of Greece”, and specifically in articles 44 par. 8 1 and 55 par. 3, as well as the provisions of Law 5383/1932 “on the Ecclesiastical Courts”, and specifically in articles 2, 7 and 100 of this law. g) that the sending of the documents accompanying the letter was necessary, as otherwise there would be a risk that the incidents described in the letter would not be taken into account by the competent hierarchs, that the reports would not be examined competently and that the complainant would be considered a “malicious slanderer”, h) that he chose the mildest, minimum necessary method of notification, communicating only false data about the complainants, much of which was already known to the recipients, due to hierarchical and interpersonal relationships. The Authority, after examining the elements of the file and what emerged from the hearing before it and the pleadings of the parties, HAS DECIDED IN ACCORDANCE WITH THE LAW 1) Because it follows from the provisions of articles 51 and 55 of the General Data Protection Regulation (Regulation 2016/679) and article 9 of law 4624/2019 (Government Gazette 137) that the Authority has the competence to supervise the implementation of the provisions of the GDPR, law 4624/2019 and other regulations concerning the protection of the individual from the processing of personal data. Moreover, an activity cannot be considered as exclusively personal or domestic, within the meaning of the provision of article 2 par. 2 item. c) of the GDPR and as therefore excluded from the scope of application of this Regulation when it extends, even partially, to the public sphere and, therefore, exits the private sphere of the person processing the data, while the presentation before an institution or authority implies, at least, the “use” and “disclosure by transmission” of “personal data” within the meaning of Article 4, paragraphs 1) and 2) of the 1 See also ΑΠΔΠΧ 81/2011 and 11/2012, available on the Authority’s website. See also P. Armamento / V. Sotiropoulos, Personal data - Interpretation of Law 2472/1997, Sakkoulas Publishing House S.A. 2005, par. 258, where it is noted that participation in social, economic and political life removes from an activity its exclusively personal character by definition. 2ΙΕΕ, C-25/17 (Grand Chamber), 10 July 2018, para. 42. 9 3 GDPR. In this case, the complaint under examination concerns non-automated processing (organization and communication by transmission) of personal data, which have been included in an archiving system within the meaning of Article 4, paragraphs 2) and 6) GDPR, and have not remained for the exclusive personal or domestic use of the person complained of, but have been sent to ecclesiastical authorities. With these data, in the case under examination there is a case of processing falling within the regulatory scope of Articles 2 par. 1 of the GDPR and 2 of Law 4624/2019 and, therefore, the Authority has the competence to handle the complaint under consideration in accordance with the provisions of Articles 57 par. 1 letter f) of the GDPR and 13 par. 1 letter g) of Law 4624/2019. 2) Because according to the provisions of Article 6 par. 1 letter f) of the GDPR regarding the lawfulness of processing: “1. Processing is lawful only if and as long as at least one of the following conditions applies: (….) f) the processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. (…)”. A case of overriding legitimate interest exists, in particular, if the processing concerns data necessary for the recognition, exercise or defence of a right before a court or a disciplinary body. A further condition for the lawful application of the above provision is that the data, the provision of which is requested or which are used in any way, are absolutely necessary and appropriate for the recognition, exercise of the right (principle of necessity), and in particular in view of the specific dispute that is pending. Necessity exists when the intended purpose cannot be achieved by other, less severe means. The data, 3DEE, C-180/21 (5 Sections), 8 December 2022, paragraph 72.4 ECJ, C-212/13 (4th Chamber), 11 December 2014, para. 31 (when interpreting provisions of Directive 95/46 with similar content to the corresponding provisions of the GDPR). 5 See also . ΑΠΟΠΧ 155/2012, ΑΠΟΠΧ 27/2001, 75/2001, 92/2011, 111/2011, 131/2011, 155/2012 available on its website. . 10 also, it must not be more than what is strictly necessary for the 6 defense of the right. 3) Because according to article 10 par. 1 of the Constitution, “Each person or several persons together have the right, in compliance with the laws of the state, to report in writing to the authorities, who are obliged to act promptly in accordance with the provisions in force and to respond with justification to the person who submitted the report, in accordance with the law”. 4) Because the Church of Greece is autocephalous and is governed by the Statute of the Charter ratified by Law 590/1977 (Government Gazette A’ 146). By the provisions of article 1 par. 4 of Law 590/1977 (Government Gazette A’ 146), the Church of Greece, as well as, among others, the holy metropoles, holy monasteries and parishes are characterized as legal entities of public law with regard to their legal relations. When these public legal entities, in their internal relations or in their relations with third parties, exercise public power, they are considered administrative authorities and the acts of their bodies have the character of administrative acts, which are subject to an application for annulment. The holy monasteries of Mount Athos, moreover, are governed by the provisions of article 105 of the Constitution, the Statute of Mount Athos and the enactment of 10/16-9-1926 (Government Gazette A’ 309). 5) Because according to the provisions of article 44 par. 1 of Law 590/1977 (Government Gazette A’ 146): “1. The offenses of clergy and monks related to their duties and the promises of their confession, which entail canonical sanctions, are tried by the ecclesiastical courts. A specific law regulates the establishment, composition, competence and operation of these courts, until the issuance of which Law 5383/1932 "on ecclesiastical courts and the procedure before them" remains in force.», while according to the provisions of article 55 par. 3 of the aforementioned same law: «Every layperson having a reasonable complaint against the 8 ecclesiastical authority is entitled to refer to the D.I.S., which is the 6 Based on the principle of proportionality, int. AP 1923/2006, STE 2252/2005. 7 StE 3619/1982, 3470/1985,1571/1986, See also in E. P. Spiliotopoulos, Handbook of Administrative Law, Ed. Ant. N. Sakkoulas 2002, par. 373. 8 Permanent Holy Synod. 11 of any action requests from the relevant Archbishop to inform it within a month. If the report is directed against a clergyman, it is forwarded by the D.I.S. to the relevant Archbishop, who is obliged to take the appropriate action. 6) Since the operation of ecclesiastical courts is governed by the provisions of Law. 5383/1932 “on the Ecclesiastical Courts” (Government Gazette A' 110), according to the provisions of article 2 of which: “In the Archdiocese and in each Metropolis, an Episcopal Court is established, with jurisdiction to hear the cases of priests, deacons and monks.”, while according to the provisions of article 7 of the same law: “The Episcopal Court judges the ecclesiastical offenses committed anywhere by clergy and monks under the pastorate of the Metropolitan, and also the ecclesiastical offenses committed in the region of the Metropolis by any clergy or monk under the pastorate of the Metropolitan.” Furthermore, according to article 100 of this law: “The competent Metropolitan or, in the event of the Metropolis being widowed, the custodian of the same, upon receiving knowledge, either as a result of a complaint submitted to him, that a cleric or monk has committed an offense entailing a canonical penalty, provided that in his judgment it is not a minor offense for which he may exercise his administrative rights, shall personally conduct regular jury investigations or assign the conduct or completion of these to one of the members of the Episcopal Court. (…)” 7) Because according to the provisions of article 105, paragraph 5 of the Constitution: “(..) The judicial power exercised by the monastic authorities and the Holy See shall also be determined by law. Community, as well as the customs and tax advantages of the Holy Mountain." According to the provisions of article 7 of the law 10/16-9-1926 (Government Gazette A' 309) "Justice in the Holy Mountain is granted with regard to ecclesiastical violations and the marginal or out of the bonds of any dispute by the Monastic Synods and elders, the Holy Community and Exarchate of the Ecumenical 9 As amended by par. 3 of article 5 of the Law 1714/1942, and replaced again by article 8 of the Law 898/1943. 12 Patriarchate after a two-day synod. (..)", while according to the provisions of article 9 par. 1 of the above same law d/tos: “The Athonite judicial jurisdiction is regulated as follows: 1. The monastic assemblies and presbyteries, canonically convened and presided over, try in first instance: a) All ecclesiastical and disciplinary offenses of the brothers of the monastery and its appendages. b) (..)” 8) Because, as has been ruled by the Council of State (2480/2015 Section C), the possession and maintenance of the status of a clergyman is inextricably linked to the exercise of his religious ministry and the obligation arising therefrom to comply with the duties and professions of his confession (cf. Council of State 4078/1979 Holom.). Any violation of this obligation entails the imposition of canonical sanctions (see articles 1 and 44 of Law 590/1977, in conjunction with the provisions of Law 5383/1932 on ecclesiastical courts, as in force), which may go as far as the dismissal of the clergyman by the competent ecclesiastical bodies, under specific substantive and procedural conditions, which are derived from the application of Article 3 of the Constitution (self-government of the Church of Greece by the acting Metropolitans, its obligation "to unswervingly observe [....] the sacred apostolic and synodal canons and the sacred traditions"). 9) Because from all the elements of the file, and those that emerged from the hearing and the parties' submissions, it appears that the defendant submitted the letter-report dated 20-5-2021 with relevant information to the authorities that, in his belief, were competent to deal with the behavior of the three complainants who hold the status of clergy, with the aim of informing these authorities about their behavior and submitting a request to investigate the described facts. However, from all the elements of the case, in view of the provisions mentioned above in paragraphs 4-8, it emerges that only two out of six recipients of the disputed letter, namely Metropolitan L and Metropolitan M, had in principle the possibility of exercising disciplinary control over the complainants who have the status of clergy and 13 fall under their jurisdiction, namely C the first and A and B the second, respectively. Accordingly, the disputed processing act, which consists of the communication of the data of the aforementioned complainants to the relevant competent authorities, is considered in principle necessary, appropriate and indispensable for the purposes of the legitimate interests of the defendant, and therefore subject to the provisions of Article 10 6 par. 1 letter f) GDPR. 10) However, as it appears from all the evidence in the case, apart from the above Metropolitans L and M, who had the authority to control the aforementioned three clergymen by reason of their respective authority, as explained in the previous paragraph, the other recipients of the letter-report in question do not have the authority to exercise control over the conduct of these three clergymen. Consequently, the disputed communication of their data does not appear appropriate or necessary for the exercise of the defendant's right to report. A fortiori, the communication of the data of the complainants who do not have the status of clergy, to all the recipients of the letter-report in question, after the relevant information, was not necessary or appropriate for the exercise of the right of the respondent to report and it cannot be considered that there is a lawful basis for the said processing based on the provisions of article 6 par. 1 letter f) GDPR. 11) Following all the above, a violation is established, on the part of the respondent controller, of the provisions of article 6 par. 1 letter f) GDPR, as set out in point 10 above and, therefore, in the Authority's judgment, there is a case of exercising its corrective powers under article 58 par. 2 GDPR. In particular, the Authority considers that there is a case for imposing, pursuant to the provision of article 58 par. 2 letter i) GDPR, an effective, proportionate and dissuasive administrative fine, in accordance with the provisions of article 83 par. 3 and 5 GDPR, taking into account the grounds for paragraph 148 GDPR, as well as10 See also ΑΠΟΠΧ 155/2012, ΑΠΟΠΧ 27/2001, 75/2001, 92/2011, 111/2011, 131/2011, 155/2012 available on its website. 14 the Guidelines of the Article 29 Working Party on the application and 11 setting of administrative fines for the purposes of Regulation 2016/679 and the Guidelines 04/2022 on the calculation of administrative fines 12 under the GDPR of the European Data Protection Board. When assessing the data, in order to select the appropriate and corrective measure, the Authority shall take into account the following criteria in accordance with Article 83(2) GDPR: • “the nature, gravity and duration of the infringement, taking into account the nature, scope or purpose of the processing concerned, as well as the number of data subjects affected by the infringement and the degree of damage suffered by them”. It is taken into account that this specific breach concerns six subjects, however, it did not take on a broader nature, while the complainants did not invoke or document before the Authority any material damage related to the said breach (Article 83 para. 2 letter a) GDPR). • “the intent or negligence that caused the breach”. It is taken into account that this breach is due to the negligence of the complainant (Article 83 para. 2 letter b) GDPR). • “any actions taken by the controller or processor to mitigate the damage suffered by the data subjects”. It is taken into account that the letter - report in question with the relevant data was submitted in a strictly personal file to its recipients, while the security of these data, following their inclusion in the recipients' file, is not the responsibility of the defendant, but exclusively of the recipients, as independent controllers (Article 83, paragraph 2, item c) GDPR). 11 12ttps://www.dpa.gr/sites/default/files/2019-12/wp253_el.pdf https://edpb.europa.eu/system/files/2023- 06/edpb_guidelines_042022_calculationofadministrativefines_en.pdf 1In accordance with Article 5, paragraph 2 GDPR. 15• “any relevant previous violations by the controller or the processor”. It is taken into account that the Authority has not received a previous complaint against the complainant in the present case (Article 83 paragraph 2 letter e). FOR THESE REASONS The Authority, partially accepts the complaint under examination, finds a violation of Article 6, paragraph 1, letter f) GDPR on behalf of the defendant and imposes, for the above violation, a fine of one thousand (1,000) euros on the defendant, for the reasons extensively analyzed in the reasoning hereof. The President The Secretary Konstantinos Menuudakos Irini Papageorgopoulou 16
