HDPA (Greece) - 1/2026
From GDPRhub
| HDPA - 1/2026 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 9 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 08.06.2023 |
| Decided: | 08.01.2026 |
| Published: | 08.01.2026 |
| Fine: | 10.000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 1/2026 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | n/a |
The DPA imposed a €10,000 administrative fine on the Fire Department Headquarters for the unlawful processing of sensitive personal data, including health data and disciplinary sanctions. It emphasized that the lack of intent is irrelevant and does not remove responsibility.
English Summary
Facts
An officer of a local fire department (data subject) lodged a complaint with the Greek Data Protection Authority (HDPA) against the commander of the local fire department. However, in its decision, the HDPA identified the Fire Department Headquarters as the controller. The data subject alleged that sensitive health data relating to her medical condition, sick leave, including even the medications recommended by her doctors, and disciplinary sanctions imposed on the data subject were unlawfully disclosed and made accessible to an indeterminate number of personnel.
Specifically, multiple documents, were circulated as outgoing administrative documents and uploaded to an internal electronic document management system. This system was accessible to all employees, including operational staff. As a result, the data subject's health data remained accessible not only at the time of disclosure but also for an indefinite future period.
The data subject repeatedly contacted the controller seeking explanations regarding the processing of her personal data. Although certain entries were deleted , part of her unlawfully disclosed personal data remained present in other documents. The controller further claimed that the disclosure had occurred "by mistake".
Holding
The HDPA upheld the complaint and imposed an administrative fine of €10,000 on the controller for the unlawful processing of the data subject’s personal data, in particular special categories of personal data, in violation of Articles 5 and 9 GDPR.
First, the HDPA held that the controller breached the principle of data minimization under Article 5(1)(c) GDPR, as the documents contained health data that were not strictly necessary for the administrative purposes pursued. The inclusion of such detailed medical information exceeded what was required to achieve any legitimate objective.
Second, the HDPA found a violation of the principle of storage limitation under Article 5(1)(e) GDPR. The data subject’s personal data remained accessible in multiple documents for an indefinite period, even after certain entries were deleted following her requests. The Authority further noted that the indefinite retention of files containing personal data, as provided for under internal legislation, is incompatible with the GDPR and must be amended accordingly.
Finally, the HDPA determined that the controller failed to implement appropriate technical and organizational measures to ensure the security and confidentiality of the data, in breach of Articles 5(1)(f) and 32 GDPR. The unrestricted internal access to documents containing health data exposed the data subject to an increased risk of unauthorized access.
The Authority emphasized that the controller’s claim that the disclosure occurred “by mistake” did not absolve it of responsibility, as compliance with the principles of Article 5 GDPR is mandatory regardless of intent. It further noted that the infringement had a systemic character, affecting not only the complainant but potentially all employees under the supervision of the Fire Service Headquarters.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 08-01-2026
No. Prot.: 64
DECISION 1/2026
(Department)
The Personal Data Protection Authority convened, following an invitation from the President, in a session via teleconference on Wednesday, 16-
07-2025 at 10:00, in order to examine the case referred to in the
history of this case. The following were present: the Deputy President of the Authority, Georgios Batzalexis, the regular member of the Authority, Konstantinos Lambrinoudakis, and the alternate member of the Authority, Maria Psalla, as Rapporteur, in replacement of the regular member, Grigoriou Tsolias, who, although legally summoned, did not
attend due to an impediment. Present without the right to vote were Stefania
Plota, a specialist scientist-lawyer, as assistant rapporteur and Irini
Papageorgopoulou, an employee of the administrative affairs department of the Authority,
as secretary.
The Authority took into account the following:
With the no. prot. C/EIS/4313/08-06-2023 complaint to the Authority, A,
an officer of the Fire Department in the P.Y. area X, complains about B,
Commander of the P.Y. area X, for “violation of personal health data”,
as she states. Specifically, on 10-03-2022, the complainant accidentally discovered
that her Daily Order dated 10-80-2021, in addition to being placed on light duty, also stated her illness, as well as the treatment she underwent, with
full details, which even include the pharmaceuticals
recommended to her by the doctors. The Daily Order is a book where
Orders, penalties, salary updates of employees, etc. are listed and
1 to which the employees of the Service have access in order to
be informed about it. Following verbal harassment by the complainant to the accused Commander that the above entries affect her as a rank holder of the service and her report dated 17-06-2022, requesting that the reasons for which they are entered be communicated to her, she was granted, with document no. … of the District Office of X, an extract of a Confidential Daily Order, in which it is stated that the reason for sick leave and medication are deleted and from now on the Daily Order of Officers and Firefighters was renamed a Confidential Daily Order. From 01-06-
2022, one year after the complainant's health records and
after an unknown number of people had become aware of her illness, the above
book was designated as a "Confidential Daily Order". However, the complainant
found that there were other excerpts from the Daily Order of Officers
and Firefighters dated 23-07-2021 and 22-07-2021, where her
illness is mentioned, without having been deleted or any correction. Also, on
03-09-2021, the Service document No. … was submitted to the Fire Department Headquarters/Human Resources Department/Officers and Firefighters Department
signed by the complained Commander, and from which an unknown number of people have received
knowledge of the complainant's illness, as
claimed by the complainant, which concerns the submission of an employee's transfer request, and it mentions the dates on which the
complainant was on sick leave or light duty, as well as her illness
and the health status of her husband. Finally, in the supplementary documents
provided by the complainant, it appears that in the Service's system the penalty
imposed on the complainant is nominal, while in another case
only the rank of the employee is mentioned without further information and
she provides a copy of the Internal Services Regulation of Fire Brigade
1, where according to art. 20 par. 2 "...The Daily Order is distinguished into
confidential and common. With the confidential one, all confidential
cases of the officers are notified, and with the common one, all other cases.", par.
1
PD 210/1992
24“The items registered in the Daily Order by paragraphs
are the following: […] n) XIV: Illnesses - In hospital, o) XV: In indication of sick leave
- Sick leaves.” and par. 5 “The books of the Daily Order
are never destroyed and are kept by the issuing Services in
perpetuity”.
The Authority, in the context of examining the above complaint, sent to the Fire Brigade Headquarters
(hereinafter referred to as "Headquarters") and to the Fire Service
of area X, the document no. Γ/ΕΞ/2891/15-11-2023 for their views, and the Headquarters responded with the document no. Γ/ΕΙΣ/8852/13-12-2023 that "in accordance with article 20 of Presidential Decree 210/92 (Α΄99) the Daily Order
(hereinafter referred to as the Daily Order) is distinguished into Confidential and Common. With the Confidential Daily Order
all confidential matters of the Employees of the Corps are communicated, it is governed by the principle of confidentiality, it is classified and the employees are informed in writing only for what concerns them. All other matters are communicated by the Joint Daily Order. The confidential D.C. book is located in the office of the Commander of the Service and the entries in it are made by a classified person, without anyone else having access to it. The confidential D.C. of the Police Department area X, from 01-6-2022 was renamed from "D.C. of the Police Department & Fire Department" to "D.C. Confidential" in order to further ensure its secrecy. In paragraphs XIV & XV of art. 20 of the Presidential Decree, 210/1992 provides for the mandatory recording of health issues (diseases-
sick leaves) of the employees of the Service. On 22 and 23 July 2021, an employee of our Service accidentally wrote down the time of the sick leave and the condition after copying the 22-7-2021 medical opinion of the 251st General Hospital concerning the complainant. The same was done in the
H.D. on 10-8-2021, where, along with the above, the treatment was also written down in accordance with the 09-8-2021 medical opinion of the 251st General Hospital. to which
the condition is referred, as well as the treatment, as shown in the
attached copies. On June 17, 2022, the complainant submitted a D.Y.
report to her Administration on the subject of "Disclosure of sensitive personal
data". On the same day, the Commander of the Service, with the June 17, 2022
Excerpt of Confidential H.D., replied to the applicant that the said
3 entry would be deleted, removing the violation of the sensitive personal data of the
complainant, as soon as this became apparent. On 13-12-2022, the same employee
requested extracts of the daily Order for the dates 22 and 23 July 2021
and granted herself, as Deputy Commander, the specific
copies. Upon the Commander's return from leave on 16-12-2022, after
being informed of the above by the Secretariat of the Service, he proceeded to
delete the entries that had been made by mistake by the Secretariat
by virtue of her reference no. …. Photocopy of the H.D. for 22, 23, July 2021
as well as for 10-8-2021 with a deleted part of them we attach. All
the above were deleted at the request of the Employee, they are not accessible by
unauthorized third parties, and instructions were again given to the Service personnel
for the faithful application of the legislation and the Data Protection Policy of the Fire Service
(posted on fireservice.gr)." Also, the Headquarters stated that "[…] it is known that
the document with protocol number ... was deleted from the electronic protocol following
our written request on 21-11-2023 to the IT Directorate of the Fire Service (see
attachments). Access to the electronic protocol is only available to authorized
employees designated via H.D. by the Commander of the Service. In particular,
access is strictly limited to those who have been designated by the Commander of the Service as
"privileged" and the two "administrators" (the Commander of the Service and the
Deputy Commander). "Privileged" are certain employees of the Secretariat of the P.Y.
area X . The documents of the complainant's illness are sent only to the
supervising authority, namely the DI.PYN. area Ψ, in accordance with art. 122 par. 4 of PD
210/1992. With regard to the copies of entries in the Electronic System of the
Service which refer to penalties of another rank, it is known that there is no
other incident in the said Service with a Graded Employee who
has been punished. According to art. 20 par.5 of PD 210/1992 Article 20 par. 5 the
books of the Daily Orders are never destroyed and are kept by the
issuing Services in perpetuity. In all places where there were sensitive personal
data, they were deleted and are not contained in the D.D.”.
In view of the above, the Authority, with relevant summonses, summoned i. the complainant, A
ii. the Fire Department of area X, as legally represented, and iii. the
Fire Brigade Headquarters, as legally represented, as the highest
staff Service of the Fire Brigade, to be present at the meeting of
the 4th Department of the Authority on 16-10-2024, in order to hold a hearing of
the complainants on the possible violation of the existing legislation on the
protection of personal data, during which the
complainant requested its postponement and a new date for the
discussion of the case was set on 20 -11-2024. The meeting in question was attended by the complainant A, along with her attorney Petros Tsandilas (AMDS…), on behalf of the Fire Department of area X, the Deputy Fire Chief B, and on behalf of the Fire Department Headquarters, the Data Protection Officer, C, was the sole representative. The Chairman of the meeting and the members determined that the Fire Department Headquarters was not represented legally, and the meeting was adjourned and a new date was set for 11-12-2024, which was attended by the complainant A, along with her attorney Petros Tsandilas (AMDS…), on behalf of the Fire Department Headquarters, the Deputy Fire Chief D and the Data Protection Officer C, and on behalf of the Fire Department area X, Deputy Fire Chief B. During this meeting, the attendees developed their views and subsequently submitted to the Authority the memorandums under no. prot. C/EIS/46/03-01-2025 and C/EIS/10122/31-12-2024, the complainant and the Fire Department Headquarters respectively.
In the memorandum submitted by the complainant, she states, in addition to what she had already
reported, among other things, that she requested a copy of document no. … of her
Service, as mentioned above, which she received with a forwarding note,
signed by Commander B, who stated that “Following your 16-12-
2022 D.Y Report, we are attaching the document no. … of the P.Y.
area X in a clear photocopy and we inform you that your
disease and your health condition were recorded because these are shown in the medical
opinions that you submitted to the Service. We also inform you that
the recipients of the documents were aware of your illness and the entry
in the Confidential Agenda book is governed by the principle of
confidentiality and the Confidential Agenda book is
Classified and in which all confidential
cases are registered". The complainant also states that up to February
2024, there are files referring to her experience in the implementation of PSNET,
5 as outgoing files of the P.Y. area X, as the Governor had sent to four or five more recipients the documents relating to her sick leave, the decision of the health committee and certain documents relating to her illness, “Specifically, the document no. … which clearly states that in the District Office of Area Ψ (Administration of the entire N.Ψ) the circular … (Application with which all the usual documents of the Fire Department are circulated and to which all employees, even the shift, have access, without classification) have been posted, i.e. in the electronic application of the Fire Department without classification, with the result that my health data is accessible to employees of both the administration of the Prefecture and the Fire Department of Area Ω, now and in the future. While it is not just one document, but
four (4) documents that describe in detail my health status,
my illness and in detail the days of my illness, while my illness is
written in bold and underlined despite what is provided for
by the relevant orders of the A.F.S.". An unknown number of people have had access to them since 2021, both in the District Hospital X and in the Services that
sent the said files. Finally, the complainant states that the
disciplinary penalties imposed on her by the Commander are recorded in the
protocol with her full details and the penalty imposed on her.
The Fire Department Headquarters with the no. prot. C/ΕΙΣ/10122/31-12-
2024 document states the following: “…we inform you that with the no. prot.
…document of the Human Resources Directorate, issues regarding
the manner of informing and handling correspondence by the Services of the
Body are clarified. In particular, in par. 4 of the aforementioned document it is stated, among other things, that,
“(…) documents whose content refers to
the health status of employees (health changes) will not be communicated, which will
continue to be sent to the Fire Brigade Health Service,
in accordance with the applicable provisions for its own actions. (…)
decisions of the health committees on sick leave for:▪Sick leave and
long sick leave ▪ Patients free from duty ▪ Light duty ▪
Referral of employees to the Supreme Health Committee of the Fire Brigade. (…)”. Furthermore, in par. 5 it is provided, among other things, that, “The method
6 and the cases of information and movement of correspondence from the Services
of the Corps to the Human Resources Directorate are determined as follows: (…) (c).-
By regular mail (postal mail): (1) File of a formed E.D.E. or
P.D.E. (2) Imposition, approval, increase, reduction or lifting of a penalty. (3) Cases
of examination of complaints. (4) File of a formed case concerning the arrest,
pre-trial detention, injury, etc. of an employee. (5) Any other matter concerning
disciplinary - criminal cases employees. (6) Medical opinions related to a file E.D.E. or P.D.E. (future implications). (7) Any other
case in which submission of original documents is required. (…).” Furthermore,
in accordance with par. 12 “In all cases of handling of correspondence of the
Services, we draw the attention of the competent bodies to compliance with the
legislation on the protection of personal data.””. Also, the Headquarters
submitted to the Authority a document on the Data Protection Policy of the Fire Brigade
Body, as well as its posting on the internal website of the Fire Brigade. The
transmission note accompanying the document in question is dated 17-11-2022, and
the text of the Data Protection Policy contains the following chapters:
definitions, general principles of personal data processing, purposes
and lawful bases of processing, categories of personal data collected, namely personnel, citizens, special categories
of personal data, rights of subjects, Data Protection Officer and Right of Appeal to the DPA.
The Authority, after examining the information in the file, after hearing the rapporteur
and the clarifications from the co-rapporteur, who attended without the right
to vote, following a thorough discussion,
HAS DECIDED IN ACCORDANCE WITH THE LAW
1. Whereas, from the provisions of Articles 51 and 55 of the General Data Protection Regulation
(EU) 2016/679 (hereinafter referred to as "GDPR") and Article 9 of
Law 4624/2019 (Government Gazette A' 137) it follows that the Authority has the competence to
7 supervise the implementation of the provisions of the GDPR, this law and other
regulations relating to the protection of individuals from the processing of personal data. In particular, from the provisions of Articles 57 par. 1
item. f' of the GDPR and 13 par. 1 letter g' of Law 4624/2019 it follows that the
Authority has the competence to handle the complaint of A against the Commander of
the Fire Service of Region X and to exercise, respectively, the powers
granted to it by the provisions of articles 58 of the GDPR and 15 of Law
4624/2019, since the complained non-automated processing
(use and disclosure) concerns personal data, which
are included in an archiving system of the complained body, and,
therefore, falls within the regulatory scope of articles 2 par. 1 of the GDPR and 2
of Law 4624/2019.
2. Because, according to the provisions of Article 4, paragraph 7 of the GDPR, the controller
determines the purposes and means of the
processing of data. The functional criterion is fundamental for determining the controller. When it comes to assessing the determination of the purposes
and the means in order to attribute the role of the controller
of the data, the crucial thing is to examine to what degree of detail
one must determine the purposes and the means in order to be
considered the controller. A structural element of the concept of
controller is the influence exercised by virtue of the exercise of decision-making power, a competence that may be defined by law or may
derive from the analysis of the facts or circumstances
relating to the case. According to Guidelines 07/2020 3,
in most cases, the “decision-making body” can
be easily and clearly identified by reference to
specific legal and/or factual circumstances from which, according
2
See for the concept of controller and processor the EDPB Guidelines
07/2020 on the concepts of controller and processor
in the GDPR, available at: https://edpb.europa.eu/system/files/2021-
07/eppb_guidelines_202007_controllerprocessor_final_en.pdf
and Opinion 1/2010 of the Article 29 Working Party.
3Ibid.
8 rule, “influence” may arise, unless other elements indicate
4
the contrary. Furthermore, as pointed out by the above Guidelines
it is common for legislation to establish an obligation or
impose on an entity the task of collecting and processing
specific data, while directly defining the controller or
setting out the criteria for his appointment. In such cases, the purpose
of the processing is often determined by the legislation. The controller
is usually designated by law for the achievement of this
purpose, this public task. In this case, the legislation
indirectly identifies the controller. More generally, legislation
may also impose on public or private entities the obligation
5
to retain or provide specific data. These entities
are generally considered controllers in relation to
the processing deemed necessary for the fulfilment of the specific
6
obligation.
3.Because in public administration the hierarchy is a way of internal organization
7
which aims to ensure the uninterrupted continuity of its work
and the coherence of the rules applied between the units and
services under the superior body of the body. Therefore, the
functional criterion is in principle linked to the responsibilities conferred by
the law on a specific authority, service or legal person governed by public law.
According to the provisions of Law 3511/2006 (Government Gazette 258/A/27-11-2006), as
amended, the Fire Brigade Headquarters is the highest
command service of the Fire Brigade, whose competence as
a central service extends to the entire Territory and to which
the decentralized services with local competence fall (Article 4).
According to article 19 of P.D. 210/1992 (Government Gazette 99/16-06-1992) “the operation
of the offices and the general conduct of the service in them is carried out with responsibility
4
5Guidelines 07/2020 ESPD, paragraphs 20-21.
See Decision of the Plenary of the APD 59/2022, section 2.
6Guidelines 07/2020 ESPD, paragraphs 20-21, paragraph 24.
7X. Akrivopoulou, Ch. Anthopoulos, Introduction to Administrative Law, Greek Academic Electronic Textbooks, 2015, Chapter 3, p. 77.
9 of the Governor, in accordance with the legislation in force and the relevant orders of the
Fire Department Headquarters”.
4. Because it follows from the above that the Fire Department Headquarters
acts in this case as a data controller, which, within the
framework of its responsibilities and duties, determines the purpose and/or the essential,
at least, elements of the method of data processing that
should be implemented by the same, as the services and units subordinate
to it8.
5. Because, according to Article 9 of the GDPR, special categories of health data may be processed when “processing is necessary for the performance of obligations and the exercise of specific rights of the controller or of the data subject in the field of employment law and social security and social protection law, where permitted by Union or Member State law or by a collective agreement in accordance with national law, providing for appropriate safeguards for the fundamental rights and interests of the data subject” and “need specific protection because the processing is likely to result in significant risks to the fundamental rights and freedoms”.
6. Whereas, Article 5 of the GDPR sets out the processing principles governing the
processing of personal data and specifically stipulates, in
par. 1, that personal data should, among other things, a) be
processed lawfully and fairly with the involvement of
the data subject ("lawfulness, objectivity and transparency")
b) be collected for specified, explicit and legitimate purposes and not
further processed in a manner incompatible with
those purposes ("purpose limitation"), c) be adequate, relevant and
limited to what is necessary in relation to the purposes for which they are
processed ("data minimisation"). In accordance with the principle
8See Decisions of the Plenary DPA 59/2022, p.2 and Section 24/2022 p. 15-17, available on the Authority's website.
9Regulation (EU) 2016/679, recital 51.
10 of proportionality (Constitution, Article 25, paragraph 1, subparagraph c’), processing is permitted, which is capable of achieving the intended purpose (principle of
suitability/appropriateness), but only if it is strictly necessary
for it, i.e. the least burdensome for the subject is carried out, and any
further processing is unnecessary, even if it is relevant (principle of
necessity)10. Any processing of personal data that is not
appropriate and necessary for achieving the intended purpose or goes beyond it is not lawful.
7. Because, in order for personal data to be lawfully
processed, i.e. processed in accordance with the requirements of the GDPR, the conditions for the application and observance of the principles of
Article 5, paragraph 1 GDPR must be met. 1. The existence of a lawful basis (Article 6 GDPR) does not
exempt the controller from the obligation to comply with the principles
(Article 5, paragraph 1 GDPR) regarding legitimacy, necessity and
transparency. In the event that any of the
principles provided for in Article 5, paragraph 1 GDPR is violated, the processing in question
shall be deemed to be unlawful (subject to the provisions of the GDPR) and the
examination of the conditions for the application of the other provisions and the legal bases of
Article 6 GDPR is unnecessary. Thus, the violation of the principles of Article 5 GDPR
unlawful processing of personal data is not cured
by the existence of any legitimate purpose and legal basis.
8. Because, in the examination of the case from all the elements of the file and
of what emerged from the hearing process, the Authority finds that
the complainant's sick leave, with reference to her illness, as well as
the treatment and the pharmaceutical substances contained in it,
were recorded in the Common Daily Order of the complained Service
in the year 2021, "by mistake", as the complained party stated.
The data in question are special category health data of
10APDPX 51/2014, APDPX 1/2007, See in Konstantinos N. Christodoulou, Personal Data Law,
2nd edition, Law Library, paras. 339,341, pp. 111-112.
11CJEU, C- 496/17, Deutsche Post AG v. Hauptzollamt Köln1, 16 January 2019, para. 57, Decisions
of the Plenary Session of the Authority 59/2022, para. 7 and of the Chamber 24/2022 para. 2, available on the Authority's website.
11complainant (Article 9 of the GDPR), which require special protection
by the controller, and should be processed under
specific conditions, in accordance with specific procedures, which will provide for the manner of their processing and the time of their retention
and only the data that are deemed absolutely necessary for
serving certain purposes and needs of the complainant's Service. On the contrary, in this case it appears that the complainant's sick leave in 2021 was recorded in every detail, namely her illness, the treatment she received and the pharmaceutical substances contained in it, in the Common Daily Order, although according to Article 20, paragraph 2 of Presidential Decree 210/1992, all confidential matters of officers are recorded in the Confidential Daily Order. Accordingly,
from the information in the file, it appears that the complainant's special category
data, which were also recorded in a document
relating to her transfer application, have also been uploaded to the Fire Brigade's electronic
application, making them accessible to all
users of the application. Therefore, the Authority finds that the complainant's special
category data, namely her illness, the treatment she is taking and the pharmaceutical substances contained in it, both when
recording them in the Common Agenda, and in the documents
relating to the transfer of an employee, which are transmitted or uploaded to the
electronic document handling application of the Fire Brigade, have
been processed in violation of the principles of legality (Article 5 par. 1
item a’ of the GDPR), as the recording of the said data in the mentioned fields is not in accordance with the legal framework, and the principle of
minimization (article 5 par. 1 item c’ of the GDPR), as data beyond what is necessary for the purposes of the processing are processed, and the Fire Brigade Headquarters should
give appropriate instructions to all the Services supervised by it so that
they comply with the provisions of the GDPR and Law 4624/2019 and the
internal circulars and procedures. It is also noted that, with regard to
article 20, paragraph 5 of Presidential Decree 210/1992, which provides that "The books of the Daily
12 Orders shall never be destroyed and shall be kept by the issuing
Services in perpetuity", it is established that the principle of
limitation of the data storage period (article 5, paragraph 1, letter e
of the GDPR) does not apply and the said provision should be amended to be
in accordance with the current legal framework.
9. Because the Authority, after ascertaining the violation of the provisions of
article 5 par. 1 items a’ and c’, considers that there is a case for exercising its corrective powers under
article 58 par. 2 GDPR and imposing, in application
of the provision of article 58 par. 2 item. i’ GDPR, an effective, proportionate
and dissuasive administrative fine, in accordance with Articles
83 GDPR and 39 of Law 4624/2019, and taking into account recital
148 of the GDPR and, in addition to the above, in particular the Guidelines
of the European Data Protection Board on the calculation of administrative fines under the GDPR 12 and the Guidelines
of the Working Party of Article 29, and in particular those of the
provided criteria that relate to the specific case examined by
the Authority, as well as the actual facts of the case under examination and
in particular the following:
i. The fact that the Fire Brigade Headquarters violated the
requirements of
Article 5, paragraph 1, item a’ and c’ of the GDPR principles of lawfulness
and data minimization, i.e. fundamental principles of
the GDPR for the protection of personal data.
ii. The fact that, although Article 39, paragraph 1, applies to the administrative
sanctions of the public body, the violation of the above principles
is subject to the provisions of Article 83, paragraph 5, sub-paragraph a’ GDPR
in the highest category of the grading system
12
Guidelines04/2022onthecalculationofadministrativefinesundertheGDPRof the European Data Protection Board, 24-05-2023, available at the link
https://www.edpb.europa.eu/system/files/2024-
01/edpb_guidelines_042022_calculationofadministrativefines_el_0.pdf
13 GuidelinesoftheArticle29WorkingPartyontheapplicationandsettingofadministrativefines, 03-10-2017, available at:
https://ec.europa.eu/newsroom/article29/items/611237
13 GDPR administrative fines (“significant” infringements with a maximum
amount 20,000,000 euros), if their imposition is deemed necessary.
iii. The complained processing concerns personal health data which
constitute a special category of personal data of
Article 9 of the GDPR, the violation of the processing of which may
result in serious risks 14.
iv. The fact that the violation of the principles of Article 5, paragraph 1, subparagraphs a’ and c’
of the GDPR, in addition to the complainant, also concerned every employee of
the complained Service or of the other Services supervised by
the Fire Brigade Headquarters, so that it is not an
isolated or occasional violation against a specific
employee but a violation that is of a systemic (structural)
nature, as regards compliance with the protection framework for
the processing of personal data of the controller.
v. The controller has in the past committed
violations of the legislation on personal data16, which were established by the Authority15
vi. The controller stated that the reported processing of the complainant’s personal data was carried out by mistake
vii. The respondent responded to the complainant’s requests to
delete the special category personal data
concerning her from the Common Agenda
14See also in this regard Paragraph 57 of the EDPB Guidelines 4/2022
15
16See Decisions of the DPA 24/2022 and 59/2022 available on its website
See Guidelines of the Article 29 Working Party on the application and setting of administrative fines, available at https://www.dpa.gr/sites/default/files/2019-
12/wp253_el.pdf p. 15, as well as Guidelines 04/2022 EDPB, which point out that
any type of infringement of the Regulation, although different from the infringement examined in the specific case by the supervisory authority, may be “relevant” for the
assessment, since it may be indicative of a general lack of knowledge or
contempt of data protection rules.
14 FOR THESE REASONS
The Authority, having established, based on the above, that the processing of the special
category of personal data of the complainant, as
referred to in the above paragraph 8, constitutes a violation of the principles of
lawfulness of Article 5, paragraph 1, item a’ of the GDPR and of
data minimization of
Article 5, paragraph 1, item c’ of the GDPR, unanimously decides that
the Fire Department Headquarters, in its capacity as
controller, should be imposed the administrative sanction mentioned below, which
is deemed proportionate to the gravity of the violations and consequently imposes
on the Fire Department Headquarters, pursuant to Article 58, paragraph 2, item i’ of the GDPR, the effective, proportionate and dissuasive administrative fine of ten thousand (10,000) euros, for the reasons that are extensively analyzed in the reasoning hereof.
The Deputy President The Secretary
George Batzalexis Irini Papageorgopoulou
15
