HDPA (Greece) - 10/2025
From GDPRhub
| HDPA - 10/2025 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 2(1) GDPR Article 4(1) GDPR Article 4(2) GDPR Article 4(7) GDPR Article 5(1) GDPR Article 6(1) GDPR Article 21 GDPR Article 55 GDPR 2112/1920 4624/2019 4727/2020 |
| Type: | Complaint |
| Outcome: | Rejected |
| Started: | |
| Decided: | |
| Published: | |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 10/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Le |
The DPA held that a public body lawfully published information regarding the dismissal of a project manager after it requested and received their criminal record. The public body could base the processing on its legal obligation.
English Summary
Facts
The data subject was employed as Head of Projects in the public body 'Organisation of Port X' (the controller).
In November 2020, the controller terminated the data subject's employment contract without payment of compensation, in view of criminal proceedings against him for crimes he had committed before he was employed by the controller. The controller had in his possession copies of the two judgments of conviction for felonies from the Criminal Records Department of the Public Prosecutor's Office.
The data subject filed a complaint with the Hellenic DPA (Aρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα-HDPA), alleging that the controller processed his personal data unlawfully violated his right to object.
Specifically, he claimed that the controller obtained his criminal record without his consent, disclosed it to the board of directors, shared it with internal staff and a cooperating law firm, and made related information publicly available through a 'public administration decisions transparency platform' (ΔΙΑΥΓΕΙΑ). The data subject further claimed that the controller failed to respond adequately to his objection to the processing of his personal data.
The controller claimed that the processing of the data subject's personal data was lawful and necessary. It stated that the processing was carried out within the framework of competences of its internal management and legal obligations, plus, a confidential protocol was kept at all times. It had a legitimate interest in knowing his criminal record, since its relevant provisions of the rules of procedure provide that a Head of Projects is prohibited from having a felony conviction.
Holding
First, the DPA held that the controller lawfully received a copy of the data subject's criminal record, after submitting a relevant request before the Public Prosecutor's Office, the content of which was judged by the competent prosecuting authority.
Second, the DPA held that the controller lawfully disclosed the data subject's personal data to its cooperating law firm and board of directors since it was intended to fulfill its legal duties and defend its legal interests in the context of the need to establish and support its legal claims. The personal data processed where appropriate, relevant and limited to what was strictly necessary to achieve the objective pursued.
Third, the DPA found that the controller lawfully posted the termination of the contract to the said platform under a legal obligation of the Administration (Article 6(1)(c) GDPR). Furthermore, the data was absolutely necessary for the intended purpose of transparency and control of state action, in accordance with the principle of data minimisation (Article 5(1)(c) GDPR).
Consequently, the DPA found that the controller lawfully processed the data subject's personal data and rejected the complaint.
Comment
1. Lawfulness and Necessity of Processing
The DPA’s decision underscores the principle that employers, especially in the public sector or entities exercising public functions, may lawfully process personal data such as criminal records when this is necessary to fulfill statutory obligations or defend legal interests. In this case, Organisation of Port X was found to have acted within the legal framework by obtaining and using the complainant’s criminal records to assess his employment eligibility and to support the termination of his contract. The DPA emphasized that such processing is permissible when it is based on a clear legal basis, such as compliance with employment law (e.g., N. 2112/1920 regarding termination for criminal acts) and the need to protect the organization’s legitimate interests.
2. Data Minimization and Confidentiality
The decision highlights the importance of data minimization and confidentiality. Organisation of Port X was careful to limit access to the complainant’s data to those with a legitimate need (e.g., board members, legal counsel, and specific staff involved in the employment review process). The DPA found that Port Authority X did not disclose more information than necessary and took steps to safeguard the data, such as using confidential protocols and restricting access to secure storage.
3. Transparency and Employee Rights
The DPA noted that Port Authority X responded to the complainant’s objections and requests for information, providing explanations for the processing and outlining the legal basis for its actions. This reflects the GDPR’s requirements for transparency and the right of data subjects to be informed about the processing of their data. The DPA also clarified that the right to object is not absolute and may be overridden where processing is necessary for the establishment, exercise, or defense of legal claims.
4. Public Disclosure and Anonymization
Regarding the publication of employment termination decisions on the public “ΔΙΑΥΓΕΙΑ” system, the DPA found that Port Authority X complied with legal requirements for transparency in the public sector. Importantly, the published information was anonymized and did not include unnecessary details, thus balancing transparency with data protection.
5. Precedential Value
This decision provides useful guidance for public sector employers on handling employee data, particularly in disciplinary or termination contexts. It affirms that, provided there is a clear legal basis, appropriate safeguards, and respect for data minimization, the processing of even sensitive data like criminal records can be justified. It also illustrates the DPA’s approach to balancing the rights of data subjects with the operational and legal needs of organizations.
6. Limits of the DPA’s Jurisdiction
Although the complainant raised issues involving the use of evidence in judicial proceedings, the DPA limited its review to the employer’s data processing responsibilities under the GDPR, without evaluating the actions of the courts.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 09-04-2025 No. Prot.: 1246 DECISION 10/2025 (Department) The Personal Data Protection Authority, upon invitation of the President, met in an extraordinary session via teleconference on 19-07-2023, in order to examine the case referred to in the history of this case. The Deputy President of the Authority, Georgios Batzalexis, and Demosthenes Vougioukas and Maria Psalla, alternate members of the Authority in replacement of Konstantinos Lambrinoudakis and Grigoris Tsolias respectively, who, although legally summoned in writing, did not attend due to impediment, were also present at the meeting. Nikolaos Livos also attended the meeting as rapporteur. Present, without the right to vote, were Eleni Kapralou, legal expert, as assistant rapporteur, and Irini Papageorgopoulou, employee of the Department of Administrative Affairs, as secretary. The Authority took into account the following: By resolution no. G/ΕΙΣ/5213/09-08-2021 complaint to the Authority by A (hereinafter "complainant"), who worked as a civil engineer in the company with the name "Port Authority X" (hereinafter OLX SA or the complainant) under a private law employment contract of indefinite duration, full-time employment since 04-10-2004, while since 2007 he had been promoted to the position of Head of Projects Department, complains to OLX SA for violation of the data subject's rights (right to object) and unlawful processing of his personal data. In particular, he states that OLX SA, pursuant to Law no. … decision of the Board of Directors (BoD), notified him by bailiff on 05-11-2020 of the written termination of the above employment contract dated 04-11-2020, without payment of compensation. This decision referred, among other things, verbatim: “As you know, you have been serving the Organization in the capacity of an employee from 4-10-2004 to the present. Already, in execution of the decision no. … of the Board of Directors of the Organization, we are terminating our employment contract without payment of compensation and you are hereby ordered to cease offering your services as of today, due to criminal prosecution against you in application of the provisions of article 5 par. 1 of Law 2112/1920”. According to the complainant, the above decision of the Board of Directors of the complained Organization was based, among other things: a) on the no. prot. … copy of the general criminal record of the complainant, which, according to his allegations, was requested and received by OLX S.A. by the Criminal Records Department of the First Instance Prosecutor's Office Ψ (with reference to the decision no. … of the Five-member Court of Appeal Ξ against the complainant, by which he had been irrevocably convicted of repeatedly interfering with and processing a data file, obtaining for himself a financial benefit, by making it accessible to third parties for a fee, and indeed to the extent of a felony which had, however, been committed at a time before his employment at OLX S.A. - with a sentence of imprisonment of thirty years with a one-year suspension), b) in the no. … decision of the Misdemeanor Court Θ concerning the conviction of the complainant in first instance for fraud and forgery (regarding the aforementioned English degree) and the falsification of an ASEP document, which had taken place during his employment at OLX S.A. (the complainant was acquitted in second instance with the decision no. … of the Three-Member Court of Appeal Ξ ) and c) in the opinion no. prot. … of the law firm Chiotelis and Associates, with which OLX S.A. collaborates. 1The criminal prosecution concerned the filing by the complainant of a fake English language diploma before ASEP (and in his service file) for his recruitment at OLX S.A., as well as the falsification of a document that ASEP had sent by post to OLX S.A., with which ASEP confirmed that this fake diploma was indeed in the complainant's file (specifically, the ASEP document was replaced with another, which stated -falsely- that there was no such diploma in the complainant's file). 2The complainant was acquitted in second instance with the decision no. … decision of the Three-Member Court of Appeal X, in which, however, it is stated that the offence of forgery was committed by the complainant, but in 2003 and not in 2013 according to the charge. 2 The complainant requested and received copies of the two above-mentioned documents under a) and c), and complains that they make a full, clear and definite reference to the fact that he has been irrevocably convicted by a decision of the Five-Member Court of Appeal X and definitively by a decision of the Misdemeanor Court Th. In particular, as he states, the number and year of the two decisions are mentioned, the sentences imposed and a detailed reference is made to the offences for which he was convicted. Furthermore, the complainant complains that in the above document under c) there is a detailed account of the facts and judicial actions regarding his second final conviction, for which, however, he has today been acquitted by an irrevocable judicial decision of the Three-Member Court of Appeal Ξ, noting that when the opinion was granted, his appeal had not been heard and the first-instance sentence was in effect. He also complains that the defendant requested and received from the criminal records department of the Prosecutor's Office of First Instance Ψ a copy of his criminal record, the content of which was made known to the law firm Chiotelis and Associates, as well as to all members of the Board of Directors, to employees who attended the Board of Directors meeting without the right to vote, and to all of the defendant's staff. He also complains that in the context of the legal dispute between them, the defendant presented the affidavit No. ... of B, an employee of the Administration, Finance and Procurement Directorate, which shows, according to the allegations, that this employee had illegally obtained knowledge of who requested his criminal record and when, as well as when the defendant received a copy of a criminal court decision concerning him, from another case, and not related to the case with OLX SA. Finally, he claims that in the context of the litigation with the defendant and in a trial for interim measures, the defendant filed his note dated 20-05-2021, on pages 6-7 of which, it appears that the administration requested and received a copy of his general criminal record, which showed that he had been sentenced to a three-year prison sentence with a three-year suspension, as well as that in the context of the same trial and from the above-mentioned document it emerged that his file was studied by all 3 members of the Board of Directors of OLX S.A., who thus became aware of the relevant criminal decisions concerning him. In the meantime, the complainant, with the extrajudicial protest-statement-summons dated 15-07-2021 that he delivered to OLX S.A., exercised, as he states, the right to object, stating that he opposes any processing of his personal data and requesting to be informed whether the complainant processed his personal data voluntarily without his consent, as well as for what purpose the said processing took place, at the same time calling on him to sign a declaration of compliance, with which he will confirm that he will not proceed with future processing of his personal data (he also sent a relevant email on 15-07-2021). Also, according to what the complainant claims in his above-mentioned extrajudicial protest dated 15-07-2021, all of the following constitute illegal processing and illegal disclosure to third parties, and in particular, he states: 1) That OLX S.A. illegally received from the criminal records department of the First Instance Prosecutor's Office Ψ a copy of his criminal record, without his consent 2) That OLX S.A. illegally received copies of the two criminal convictions that concerned him 3) That OLX S.A. illegally made his criminal record known to the law firm Chiotelis and Partners, for the purpose of providing an opinion regarding the termination of his employment contract 4) That OLX S.A. made this unlawfully known to all members of its Board of Directors, to employees who attended the Board Meeting of OLX S.A. without the right to vote, as well as to the employee who acted as secretary at this meeting, as well as to the President of the Employees' Union of OLX S.A., who attended to express her opinion on the matter, at the Board Meeting during which the decision to terminate his contract was taken 5) That details of his criminal convictions have been unlawfully made widely known to all the staff of OLX S.A. Specifically, it refers to the employee Ms. B, who testified under oath (see the affidavit with no. …) 4among other things that she knew exactly who requested his criminal record and when, as well as when the bodies of the defendant received a copy of a court decision, which does not concern OLX S.A. in any way, but acts prior to his employment at OLX S.A. 6) That the decision of the Board of Directors of OLX S.A. regarding the termination of his employment contract was illegally published in the information system "DIAVGEIA" 7) That both in the copy of the criminal record and in the information-opinion of the law firm Chiotelis and Partners collaborating with OLX S.A., a full, clear and specific reference is made that the complainant has been irrevocably convicted by a decision of the Five-Member Court of Appeal X and definitively by a decision of the Misdemeanor Court I, with reference to the number and year of the above decisions, the sentences imposed on him for each, as well as the offenses for which he was convicted, in violation of the principle of proportionality. 8) That he opposes any processing of his personal data by OLX S.A., and requests to be informed whether OLX S.A. voluntarily proceeded to this processing without his consent, as well as for the purpose of such processing and that OLX S.A. sign a declaration of compliance, whereby it will confirm that it will not proceed with future processing of his personal data, further claiming that such processing is contrary to Directive 2016/80, according to which the processing of personal data relating to criminal convictions and offences or related security measures shall be carried out only under the control of an official authority or if the processing is authorised by Union law or the law of a Member State which provides adequate safeguards for the rights and freedoms of the data subjects and finally, 9) That with the response of OLXA.E., the right to object granted by law was satisfied. Subsequently, OLXA.E. responded within the time limit to the above-mentioned extrajudicial protest of the complainant with the no. prot. ... her document, claiming: 5 1) That the processing of the complainant's personal data was carried out within the framework of the responsibilities of the Management of OLX S.A. and its legal obligations, taking the necessary measures to ensure the confidentiality and security of the processing of his data (which she lists below, and specifically states that in the invitation of the Chairman to the members of the Board of Directors for the discussion of the termination of the complainant's employment contract, no document was sent, contrary to the practice followed, according to which all documents concerning the subject under discussion are attached, all documents concerning the complainant have been classified as "confidential", are kept in the Confidential Protocol, to which only a specially authorized employee of OLX S.A. has access and are located in a Special Safe-Deposit Box). 2) That the Chiotelis and Associates Law Firm represented OLX S.A. and filed a civil lawsuit both in the Three-Member Misdemeanor Court of Θ and in the Misdemeanor Court of Appeal of Ξ and thus received copies of these decisions 3) That in the invitation of the President to the members of the Board of Directors for the discussion of the termination of his employment contract, no document was sent, contrary to the practice followed in other matters to attach all documents related to the matter under discussion 4) That both documents bear the letter E (confidential protocol) in front of the OLX protocol number, to which a specially authorized employee of OLX S.A. has access and are located in a safe-deposit box 5) That the decision with no. ... of the company's Board of Directors (since publication is a condition for its validity) with the complainant's personal information anonymized 6) That finally, OLX S.A. does not proceed to further processing of his personal data, except if necessary for the fulfillment of its legal obligations and for the defense of its legitimate interests. 6 The Authority, in the context of examining the above complaint, sent to OLX S.A. the document no. prot. C/ΕΣΕ/1162/18-05-2022 for its opinions. Subsequently, OLX S.A. responded to the above document, with its document no. prot. C/ΕΙΣ/7725/06-06-2022, and repeated the allegations developed above. He added that the Port Authority X S.A. results from the transformation of the Public Law Legal Entity "Port Fund X" and is its universal successor (article 21 of Law 2932/2001), with the sole shareholder being the Hellenic Republic Investment and Development Fund, and is under the supervision of the Minister of Shipping and the Aegean. He also stated that with the Circular of 24-05-2013 issued by the Ministry of Administrative Reform and E-Government on the subject of "Updating personal registers of employees", as well as with the Circular of the same Ministry on 16-12-2013 on the subject of "Checking the legality of degrees, certificates and other data of the personal register of employees", the Organization was called upon to check all the data of the personal register of employees, appointing a Three-Member Committee headed by the Director of Personnel. This committee found that there was a fake English degree in the register of the complainant, while a falsified document of ASEP was also identified, and after the Administration was informed, OLX S.A. filed a complaint against unknown persons, subsequently criminal prosecution was initiated against the complainant and he was sentenced in the first instance to a prison sentence, but was acquitted in the appeal trial. In the meantime, OLX S.A. submitted an application to the Criminal Registry Department of the Prosecutor's Office Ψ, which responded in July 2020, when it was established that there was an earlier criminal sentence against the complainant. For this reason, a request was submitted by OLX S.A. to the Prosecutor of Appeals Ξ for a copy of the relevant decision. Following the above, the Authority summoned OLX S.A. with its summons No. Γ/ΕΞ/3275/13- 12-2022 and Γ/ΕΞ/3276/13-12-2022. and A respectively in a hearing, via videoconference on 21-12-2022, and after a postponement on 18-01-2023 in order to present their views on the case. During the meeting of 18-01-2023 of the Department of the Authority, the complainant A was present via videoconference and on behalf of the Port Authority X S.A., G, CEO of the Port Authority X S.A., D, Data Protection Officer of the 7Organization and Dimitrios Kremalis, attorney-at-law of the complainant. During the hearing, the parties developed their views and subsequently, they were given a deadline and submitted within the deadline, the complainant the no. prot. G/ΕΙΣ/972/08-02-2023 memorandum, and the complainant with the no. prot. G/ΕΙΣ/875/03-02-2023 memorandum. In particular, the complainant in his no. prot. G/ΕΙΣ/972/08-02-2023 memorandum reiterated that the complained Organization never requested a copy of his criminal record from him and never sought his consent to obtain it, arguing at the same time that information regarding the existence or non-existence of a criminal conviction should be collected directly and only from the employee concerned. Furthermore, he stated, among other things, that the defendant did not comply with the prescribed procedure for the protection of his personal data, as a result of which he made them accessible to unauthorized persons, and specifically, all seven Members of the Board of Directors of OLX S.A., the Finance Director, the employee acting as Secretary of the Board, the employee of the financial department B, the cooperating law firms Chiotelli and Kremali, the defendant's lawyer and the employee acting as Data Protection Officer (her opinion was requested and she was provided with document no.…), as the defendant did not take measures to protect his data and did not anonymize them, as a result of which he is currently unable to find a new job. The defendant Organization, with file no. G/ΕΙΣ/875/03-02-2023, in his memorandum, he referred to the history of the dispute with the complainant and argued that the said complaint was submitted to the Authority abusively and under pretext. He also points out that due to what he learned from official documents, his trust in the complainant, who also held a position of responsibility (Head of the Works Department), was irreparably shaken. In addition, OLX S.A. claimed that it acquired clear knowledge of the criminal convictions of the complainant on 24-07-2020, upon the recommendation of the Director of Administration, Finance and Procurement, after the publication of the no. … decision of the Three-Member Misdemeanor Court of the City of Thessaloniki, the reasoning of which is referred to when calculating the sentences in 8 irrevocable custodial sentences, at which time it requested a copy of the criminal record from the competent prosecutor's office. Furthermore, OLX S.A. claims that the processing of the complainant's personal data was lawful, in accordance with article 5 par. 1 of the GDPR, in compliance with the principle of proportionality, necessity and data minimization, as well as that: 1) a confidential protocol is maintained regarding all requests by OLX S.A. to the authorities, in order to protect the security and confidentiality of the data, 2) the criminal record and the irrevocable conviction were received by the employee of OLX S.A. assigned for this purpose. B, who was a member of the Committee for the updating of employee files and were kept in a confidential protocol (see decision of the Board of Directors of OLX S.A. with no. protocol ... on the establishment and appointment of members of a working group with the purpose of checking the legality of degrees, certificates and other data of the personal register of employees of OLX S.A.), in order to ensure that there will be no leakage of these. Furthermore, it is invoked that the specific The employee was bound by the confidentiality and non-disclosure agreement signed on 05-11-2020, which OLX S.A. actually provides, while before September 2020, her relevant obligation was based on the general principles of labor law and the Civil Service Code, as well as the General Regulation of OLX. Finally, she states that the employee in question in her affidavit simply stated that the complainant's criminal record was obtained, without reference to its content and that her actions were within the framework of her competence. 3) the criminal record and the 2016 conviction were placed in a special box to which only the competent employee has access for the confidential protocol 4) OLX S.A. had a legitimate interest in obtaining knowledge of the criminal record and the final conviction, given that the final conviction for a felony constitutes an obstacle to appointment, while the relevant provisions of the Regulation provide that the Head of Department is prohibited from having a conviction for a felony 95) the search for the criminal record was necessary for the exercise of the statutory rights of OLX S.A., and specifically for the decision on whether or not to continue the complainant's employment contract and the updating of the details of his file, in accordance with the order of the Managing Director of the company, as provided for by the no. DIDAD/F.34/35/oik. 14888/24-05-2013 and DIDAD/Φ.34/42/οικ.33906/16-12-2013 circulars of the Ministry of Administrative Reform & E-Government 6) the invocation of the criminal record before the Court was necessary to defend the right of OLX S.A. and refute the allegations of the complainant and obtaining a copy of the final conviction decision was deemed necessary in order to establish whether the offense of interference with a data file by the complainant concerned a felony (with the aim of making a profit) or not. Both of these documents (copy of criminal record and irrevocable conviction decision of the Five-Member Court of Appeal X) were obtained in a legal manner by the competent Prosecution Authority, and specifically following the submission of requests on behalf of OLX S.A. to the Prosecutor's Office Ψ and the Prosecutor's Office of the Court of Appeal X respectively, which were competently decided and these requests were satisfied. 7) the data requested by OLX S.A. was accurate since it came from a public authority (Prosecutor's Office) 8) these data were not further processed in a manner incompatible with the purpose for which they were obtained (purpose limitation) 9) the complainant was aware of the storage period of the data and had been informed based on the General Staff Regulation and the Internal Operation Regulation of the Organization about the purpose for which the criminal record is collected, as well as being aware of the need to update the information in the personnel file, but also of the obligation of secrecy and confidentiality that all employees of OLX S.A. were subject to. 10) the members of the Board of Directors never received a copy of the complainant's criminal record or the conviction concerning him, except for the suggestion of the Director of Administration, Finance and Procurement of the Organization, who was bound by the relevant confidentiality and non-disclosure agreement 10 that he had signed. Only the CEO of OLX S.A. received a copy of the criminal record (see the letter with no. prot. …) 11) the processing took place on the basis of article 6 of the GDPR. e) otherwise f) of the GDPR 12) the law firm Chiotelis and Associates was not provided with copies of either the criminal record or the conviction, although it was requested to draw up an opinion on the possibility of terminating the complainant's employment contract with a citation from OLX S.A. of the minimum history of the case, while the same firm had appeared representing OLX S.A. in the criminal trials of 2018 and 2020, thus having excellent knowledge of the litigation with the complainant and the processing is based on the need to establish, exercise or support legal claims. The lawyers of the law firm are bound by legal privilege, but also by a more specific contract that was signed with the condition of maintaining the confidentiality and secrecy of those who received knowledge. 13) the search for a specialized legal opinion regarding the appropriate actions by the Organization, following the revealing elements of the first-instance conviction for the complainant and his criminal record, was a necessary condition for ensuring the legality of these actions. 14) finally, with regard to the complainant's right to object, OLX S.A. responded to the complainant that the processing of his personal data was carried out based on the principles governing personal data and for reasons of overriding legitimate interest (Article 21, paragraph 1, subparagraph 2 of the GDPR), in order to refute the claims and allegations contained in the filed application for interim measures and the complainant's lawsuit against OLX S.A. The Authority, after examining all the elements of the file and those discussed at the meeting of 18-01-2023, after hearing the rapporteur and the clarifications from the assistant rapporteur, who attended without the right to vote after a thorough discussion 11 DECIDED IN ACCORDANCE WITH THE LAW 1. Because, in accordance with the provisions of articles 51 and 55 of the General Data Protection Regulation (EU) 2016/679 (hereinafter, GDPR) and article 9 of Law 4624/2019 (Government Gazette A 137), the Authority has the competence to supervise the implementation of the provisions of the GDPR, this Law and other regulations concerning the protection of individuals from the processing of personal data. In particular, from the provisions of articles 57 par. 1 item. f' of the GDPR and 13 par. 1 lit. g' of Law 4624/2019, it follows that the Authority has jurisdiction to handle the complaint in question against OLX S.A., insofar as it concerns the processing of the complainant's personal data, which are included in a filing system within the meaning of article 4 lit. 2 and 6 of the GDPR, therefore for processing falling within the regulatory scope of articles 2 par. 1 of the GDPR and 2 of Law 4624/2019. 2. Because according to a. 2 par. 1 of the GDPR "This Regulation applies to the, in whole or in part, automated processing of personal data, as well as to the non-automated processing of such data which are included or are to be included in a filing system". 3. Whereas, in particular, according to Article 4(1) of the GDPR, “personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person”. 4. Whereas, further according to Article 4(1) 2 GDPR processing of personal data is “any operation or set of operations which is performed upon personal data or upon sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”. 5. Whereas, in Article 4 para. 7 GDPR, the controller is defined as “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or Member State law, the controller or the specific criteria for his appointment may be provided for by Union law or Member State law”. 6. Whereas, in accordance with Article 5 par. 1 of the GDPR “Personal data: a) are processed lawfully and fairly in a transparent manner in relation to the data subject (“lawfulness, objectivity and transparency”), b) are collected for specified, explicit and legitimate purposes and are not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest or scientific or historical research purposes or statistical purposes shall not be considered incompatible with the initial purposes in accordance with Article 89(1) (“purpose limitation”), c) are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”), d) are accurate and, where necessary, kept up to date; all reasonable steps must be taken to ensure that personal data which are inaccurate, in relation to the purposes of the processing ('accuracy'); (e) kept in a form which permits identification of data subjects only for the period necessary for the purposes of the processing of the personal data; personal data may be stored for longer periods where the personal data will be processed only for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) and where appropriate technical and organisational measures required by this Regulation to safeguard the rights and freedoms of the data subject are implemented ('storage limitation'); (f) processed in a manner which ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality"). 7. Furthermore, according to Article 6 par. 1 of the GDPR "Processing is lawful only if and to the extent that at least one of the following conditions applies: (…)c)processing is necessary for compliance with a legal obligation to which the controller is subject (…)e)processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, f)processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the exercise of their duties. Consequently, processing carried out by public authorities cannot be justified on the basis of the legitimate interests pursued by them as controllers. 8. Because according to Article 21 GDPR “1. The data subject shall have the right to object, at any time and on grounds relating to his or her particular situation, to processing of personal data concerning him or her which is based on Article 6(1)(e) or (f), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims”. 9. Whereas we agree with Recital (47) of the GDPR: “The legitimate interests of the controller, including those of a controller to whom the personal data or of third parties may be disclosed, may provide the legal basis for processing, provided that they are not overridden by the interests or fundamental rights and freedoms of the data subject, taking into account the legitimate expectations of data subjects by virtue of their relationship with the controller. Such a legitimate interest could for example exist where there is a relevant and appropriate relationship between the data subject and the controller, such as where the data subject is a customer of the controller or is in its employ. In any case, the existence of a legitimate interest would need to be carefully assessed, inter alia, as to whether the data subject, at the time and in the context of the collection of the personal data, can reasonably expect that processing may take place for that purpose. In particular, the interests and fundamental rights of the data subject could override the interests of the controller where personal data are processed in cases where the data subject does not reasonably expect further processing of his or her data. Since it is for the legislator to provide by law the legal basis for the processing of personal data by public authorities, that legal basis should not apply to processing by public authorities in the performance of their tasks. The processing of personal data, to the extent strictly necessary for the purposes of fraud prevention, also constitutes a legitimate interest of the controller concerned. The processing of personal data for the purposes of direct marketing can be considered to be carried out on the basis of a legitimate interest” .3 10. Because according to Recital (69) of the GDPR “Where personal data may be lawfully processed because the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or for reasons of legitimate interest of the controller or of a third party, each data subject should nevertheless have the right to object to the processing of personal data concerning him or her concerning his or her particular situation. It should be up to the controller to demonstrate that his/her compelling legitimate interests override the interests or fundamental rights and freedoms of the data subject.” 4 11. Furthermore, according to Article 5 of Law 4624/2019 “Public bodies are permitted to process personal data when the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.” However, the Authority, in its Opinion 1/2020, observed, inter alia, regarding the said provision, that: “[…] Article 5 of the law repeats the legal basis of Article 6(1)(e) GDPR, does not introduce a new or subsidiary legal basis in national law, nor does it exclude the application of the legal bases of Article 6(1)(e) GDPR. Interpreted in this sense, the provision of Article 5 of Law 4624/2019 does not contradict the GDPR, but it violates the rule of EU law, according to which the repetition of GDPR provisions in national legislation is not permitted. " Consequently, processing, when carried out by public bodies, is lawful and when it is necessary for the fulfillment of a legal obligation, in accordance with the above-mentioned Article 6, paragraph 3 of the GDPR. 3 See also OE Opinion 6/2014 on the concept of the legitimate interests of the controller, in accordance with Article 7 of Directive 95/46/EC and EDPB Guidelines 1/2024 on processing of personal data based on Article 6 (1) (f) GDPR (p. 28 et seq.). 4 See also K. L. Christodoulou "Personal Data Law", 2nd edition, Law Library, 2020, pp. 129 ff. 1612. Moreover, because, according to article 76 par. 3 of Law 4727/2020 “The following are posted on the internet: …(n) summaries of acts of appointment, transfer, availability, acceptance of resignation, termination of the civil service relationship or demotion of employees, permanent and transferable, and managers of the State, of public legal entities, bodies of the broader public sector, bodies of local government organizations of the first and second degree, as well as corresponding acts concerning public officials, the publication of which is required by applicable legislation, and summaries of acts of appointment and contracts with a private law employment relationship or work contracts in the State, of public legal entities, bodies of the broader public sector and bodies of local government organizations of the first and second degree”. Furthermore, according to article 79 of the aforementioned Law “1. The posting of the acts referred to in Article 76 on the Internet and the organization of the search for information shall be carried out without prejudice to national and Union rules for the protection of individuals with regard to the processing of personal data. Acts which include special categories of personal data and personal data relating to criminal convictions and offences, as defined in the applicable legislation, shall not be posted. 2. The posting of the acts referred to in Article 76 on the Internet and the organization of the search for information shall be carried out without prejudice to state secrets as provided for by the applicable legislation, the rules on intellectual and industrial property, as well as corporate or other secrets provided for by more specific provisions. Furthermore, posting on the internet and specifically on the DIAVGEIA 5 website serves transparency in the public and wider sector and is not prohibited, in principle, by the legislation on personal data, as long as the acts in question do not include special categories of data. The purpose of posting is to enhance the transparency of state action and its control by the 5 See also Opinion no. 1/2010 of the Authority available here: https://www.dpa.gr/el/enimerwtiko/prakseisArxis/anartisi-nomon-kanonistikon-kai-atomikon- praxeon-sto-diadiktyo 17citizen, through the widest publicity of administrative acts (see also article 75 of Law 4727/2020). 13. Furthermore, in Law 2112/1920 and in article 5 par. 1 of this Act stipulates that: “An employer may terminate the contract for failure to comply with a deadline, if a complaint has been filed against the employee for a criminal act committed in the performance of his duties or if he has been charged with an offence in general, at least of a misdemeanour nature”. 14. Since in this case, the data and information concerning the complainant and processed by the complained Organisation, as data controller, constitute personal data of the same, as they concern an identified or identifiable natural person (the complainant), whose identity can be verified directly or indirectly by reference to an identifying element of the identity, and specifically, this concerns the copy of his criminal record and the criminal decisions with no. … Three-member Misdemeanor Court of Θ, … Three-member Court of Appeal Ξ and … Five-member Court of Appeal Ξ, both in the form of a copy and as information. 15. Because with regard to the above personal data of the complainant, the following forms of processing took place: checking the complainant's supporting documents relating to his employment at OLX S.A., searching for information through applications to the competent prosecutor's authority for a copy of his criminal record and the criminal decisions concerning him, access to these documents, reading and drawing conclusions, disclosure by transmitting part of this information and recipients the CEO of the company, the Board of Directors of the company, the its employees who were present without the right to vote, the employee who acted as secretary, the Chiotelis law firm and associates, disclosure through the presentation of precautionary measures at trial and the invocation of the no. … affidavit of employee B, which referred to the complainant’s personal data, as well as through the public posting of the termination of the employment contract in the DIAVGEIA information system. 6 https://diavgeia.gov.gr/termsOfUse 18OLX S.A. has the status of data controller pursuant to Article 4, paragraph 7 of the GDPR in relation to the personal data of its employees, to which the complainant also belonged. 16. Since the complainant’s claim that with the response of OLX S.A. the right to object that he exercised on 15-07-2020 with his above-mentioned extrajudicial declaration, in which he declared that he opposed any processing of his personal data, and requested to be informed whether the complainant proceeded to process his personal data voluntarily without his consent, as well as for what purpose the said processing took place, calling on him at the same time to sign a declaration of compliance, with which he would confirm that he would not proceed to future processing of his personal data, is to be rejected, as first of all, OLX S.A. responded within the deadline on 04-08-2021 to the complainant's right to object exercised on 15-07-2021. In this response, it also mentioned all the security measures it took when processing the complainant's personal data, as well as that it does not proceed with further processing of his personal data unless this is necessary for the fulfillment of its legal obligations and for the defense of its legal interests in the context of the dispute between them. In addition, the above processing operations are carried out within the framework of the Organization's duties as a public body (Public Legal Entity), pursuant to Circulars No. DIDAD/Φ.34/35/οικ.14888/24-05-2013 and DIDAD/Φ.34/42/οικ.33906/16-12-2013, and are also required by the principle of legality, according to which the Administration must revoke any of its illegal acts, thus restoring the legal order. Furthermore, from all the submitted evidence and the claims of both parties, the following emerged: 1. OLX S.A. did not illegally obtain a copy of the complainant's criminal record, but after submitting a relevant request to the Prosecutor's Office Ψ (Criminal Records Department), the content of which was judged by the competent prosecutor's authority (see also the decision no. ... of the Single-Member Court of Appeal Ξ-special labor dispute procedure, 19 submitted by the complainant, which states that OLX S.A. "(…) requested on 17-07-2020 from the competent Authority a copy of the plaintiff's criminal record, which was communicated to it ...document number", with the result that the Authority is incompetent in this matter. Furthermore, in a similar manner, the Management of OLX S.A. lawfully received a copy of the decision no. 48/2016 of the Five-Member Court of Appeal X (see also the submitted decisions with no. ... of the Single-Member Court of First Instance X, in which it is expressly stated that "a copy of the criminal record was requested and received, (...) as well as a copy of the decision no. ... of the Five-Member Court of Appeal for Felonies X", and ... of the Single-Member Court of Appeal X, in which it is stated that "The defendant had a legitimate interest in the plaintiff's criminal record, given that the criminal conviction, and indeed to the extent of a felony, constituted an impediment to appointment, according to article 6 of the General Staff Regulations") (Official Gazette of the Hellenic Republic, Issue No. 117/27-07-2020). 2. OLX S.A. presented in the interim measures trial the affidavit with No. … of employee B, which she had testified under oath, regarding facts of which she had become aware during the performance of her duties. In particular, with regard to the first issue of whether the said employee lawfully obtained knowledge of this information, it is alleged that she, by order of the Management of OLX S.A., lawfully obtained knowledge of the complainant's personal data for the purpose of fulfilling the duties of OLX S.A. regarding the obligation to check the supporting documents of its employees, pursuant to the above Circulars. Furthermore, as regards the second issue, whether the said employee lawfully testified under oath in the context of civil proceedings, regarding what she learned during the exercise of her duties as a witness in her sworn statement, this has already been decided by a Competent Court, in whose judgment she was presented as evidence, which, moreover, freely judged and assessed it as to its legality, but also as to the validity of its content, without the Authority being competent in this case to judge its legality or not, in accordance with Article 55, paragraph 3 of the GDPR according to which “Supervisory authorities are not competent to control processing operations carried out by courts within the framework of their jurisdiction”. 203. Furthermore, OLX S.A. did not unlawfully disclose the complainant’s criminal record to the law firm Chiotelis and Associates, as this firm collaborated with OLX S.A. (see submitted private agreements for the provision of legal services), and the lawyers of this office had represented the complained Organization in trials, defending its legitimate interests against the complainant, and are even bound under the Lawyers' Code by the duty of confidentiality, both towards their client and regarding any personal data of third parties that came to their knowledge, with the possibility of imposing disciplinary sanctions in the event of a violation of this duty. Regarding the provision of the opinion dated 23-10-2020 on the question raised by OLX S.A. regarding the possibility of termination by the company of the complainant's employment contract, from all the documents submitted and the allegations of both parties, it appears that the undersigned lawyer Panagiotis Chiotelis took note of the OLXA.E.'s indictment dated 25-07-2014, the indictment drawn up against him and the criminal record of the complainant, and states in his opinion the acts for which the criminal prosecution was brought, the sentence imposed on the complainant, the offense for which he was irrevocably convicted, as well as the sentence imposed on him, rejecting as unfounded the claim of the accused Organization that the law firm Chiotelis and Associates was not given copies of either the criminal record or the conviction, although it was requested to draw up an opinion on the possibility of terminating the complainant's employment contract with a citation from OLXA.E. of the minimum history of the case, as well as if something was applicable such, the undersigned lawyer would have mentioned in the disputed opinion. However, the undersigned lawyer invokes (indicatively) on page 1 of the opinion the indictment “with…”, and recounts and invokes the relevant indictment (“it was burdened by the indictment”). Nevertheless, the said form of processing was lawful, since it had as its purpose the fulfillment of the lawful duties and the defense of the lawful interests of OLX S.A., in the context of the need to establish and support its legal claims, a purpose that could not be achieved by other milder means. 21 In particular, this opinion was requested and drafted in the context of the exercise of a lawful right of OLX S.A. (Law 2112/1920, art. 5 par. 1: “The employer may terminated the contract without respecting a deadline, if a lawsuit was filed against the employee for a criminal act committed in the performance of his service or a charge was brought against him for an offense in general, at least of a misdemeanor nature"). Besides, as is evident from the employment contract annex - confidentiality-secrecy clause, the complainant had already been informed since 19-10-2020 that OLX S.A. will not transfer or disclose personal data to third parties, unless it concerns: a) natural or legal persons to whom it has assigned, in part or in whole, the processing of personal data, in accordance with applicable legislation, b) transfer required for the execution of the contract and c) transfer required for compliance with a legal obligation of the Company. 4. Furthermore, with regard to the notification to all members of the Board of Directors, to employees who attended the Board of Directors Meeting of OLX S.A. without the right to vote, as well as to the employee who acted as secretary at this meeting, it is established that this took place legally, in support of the legal claims of OLX S.A. against the complainant, in the context of exercising the legal right of an employer (Law 2112/1920, art. 5 par. 1). Regarding the President of the Employees' Union of OLX S.A., who attended to express her opinion on the matter at the Board Meeting during which the decision to terminate the complainant's contract was taken, she was informed about the issues in question by the complainant himself (see the minutes of the 40th Board Meeting of OLX S.A., in which she herself states that she was informed by her colleague) and essentially attended to support the view regarding the possible responsibilities of the Board in the event that an employee is dismissed and subsequently acquitted. 5. In addition, the complainant's claim that the opinion of the law firm Chiotelis and Associates, which collaborates with OLX, contains more personal data than was required in excess of the principle of proportionality, must also be rejected. This is because the personal data processed and referred to in the said opinion were 22 appropriate, relevant and limited to what was absolutely necessary to achieve the intended purpose, which was to provide a detailed legal opinion on whether there is reason to terminate the employment contract due to a serious breach of trust in the employee (support of legal claims of OLXA.E.), in compliance with the principle of data minimization, while this purpose could not have been achieved - as mentioned above - by other, milder means. 6. Finally, the complainant's claim regarding the public posting of the decision of the Board of Directors of OLX S.A. concerning the termination of his employment contract, that it was unlawfully published in the "DIAVGEIA" information system is likewise deemed to be rejectable. In particular, in addition to being a relevant obligation of the Administration (art. 76 par. 3 of Law 4727/2020 and art. 6 par. 1, paragraph 3 of the GDPR), the relevant document that was posted only mentions data that is absolutely necessary for the intended purpose of transparency and control of state action, but also the determination of the content of the act, in compliance with the principles of processing of article 5 par. 1 of the GDPR, in particular the principle of minimization, without the reason for the dismissal of the complainant arising from the posted act or the disclosure of data of special categories concerning him. 17. Because following all of the above, OLX S.A. as an employer company proceeded to lawful processing of the complainant's personal data, and had, pursuant to article 5 par. 3 of the law 3198/1955 a legitimate claim for the dismissal of the complainant without compensation, given that criminal prosecution had been brought against him for offenses in general - even outside of duty with at least a misdemeanor nature, for the defense of her legal claims and fulfillment of her legal obligations and interests, in the context of the litigation between them, against which the complainant's right to object to the processing of his personal data and to his protection against such processing does not apply, in accordance with what is mentioned in Paragraph 16 of this present, taking into account his reasonable expectations as a data subject based on his employment relationship with the controller, but also in view of the fact that at the given time, the complainant's 23-year stay in his job as Head of the Projects Department of OLX S.A. did not meet the conditions of Law 2112/1920 (article 5 par. 1 thereof, which stipulates that: “The employer may terminate the contract without notice, if a complaint has been filed against the employee for a punishable act committed in the performance of his service or a charge has been brought against him for an offense in general, at least of a misdemeanor nature”), he could reasonably expect that the complained processing of his personal data could be carried out. FOR THESE REASONS, the Authority rejects as unfounded the complaint no. C/ΕΙΣ/5213/09-08-2021 of A against the Port Authority of X S.A. (PLX S.A.). The President The Secretary George Batzalexis Irene Papageorgopoulou24
