HDPA (Greece) - 15/2025
From GDPRhub
| HDPA - 15/2025 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 5(1)(c) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 20.02.2023 |
| Decided: | 15.01.2025 |
| Published: | 30.04.2025 |
| Fine: | 5,000 EUR |
| Parties: | Δήμος Πατρέων (Municipality of Patra) |
| National Case Number/Name: | 15/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Inder-kahlon |
The DPA imposed a €5,000 fine on a Municipality for violating the data minimisation principle by publishing a school committee’s decision containing personal data on its website that exceeded what was necessary for journalistic purposes.
English Summary
Facts
The controller is the Municipality of Patras, a town in Greece, which operated the Municipality's Solidarity Tutoring Center (Λαϊκό Φροντιστήριο Αλληλεγγύης του Δήμου). The data subject is a member of the School Committee of the Primary Education Schools of the Municipality of Patras.
The controller published on its official website a decision by the School Committee regarding the approval of an expenditure of €800 for cleaning and disinfection supplies. The decision was taken by majority vote, as objections were raised by the data subject, not only for the justification of this financial support, but for the general necessity and legality of the operation of the Municipality's Solidarity Tutoring Center.
The publication included the data subject's name, surname, place of work, place of employment, his political beliefs and as well as an extract of the email he had sent to the other 14 members of the Primary Education Committee of the Municipality.
On 20 February 2023, the data subject filed a complaint before the Hellenic DPA (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα-HDPA) claiming that the the controller processed his personal data unlawfully.
The controller held that the publication was aimed to inform citizens about the Municipality's Solidarity Tutoring Center's operations. It argued that the publication of the data subject's personal data served for journalistic purposes and transparency of public administration. The controller maintained that the public's right to information on the program outweighed the data subject’s right to privacy, and the publication was essential for informing citizens about the committee's decision making. Plus, the personal data was already made public by the data subject on his social media platforms.
After the complaint was filed, the controller removed the publication containing the data subject's data from its website, though it had already been published on other platforms.
Holding
The DPA made a balancing of the right to freedom of expression and information and the right to personal data protection by considering, amongst others, Article 85 GDPR, Recital 153 GDPR, and the principle of proportionality enshrined in the Greek constitution in Article 25(1).
The DPA held that the assessment of whether the processing of personal data for journalistic purposes is lawful must be based on; first, whether the processing of personal data served the interest of informing public opinion and whether that interest outweighs the right to privacy in the particular case and, second, whether the infringement in question was necessary, in the context of the principle of proportionality, for the exercise of the right to privacy.
The DPA decided that even though the data subject's political views were already made public, the publication of his information in a highly contentious political context was deemed inappropriate. The publication of the data subject’s personal data on the controller’s website exceeded what was necessary for informing the public and violated the data subject’s privacy rights, particularly by including irrelevant information such as the data subject’s professional identity and the contents of their email.
The DPA held that the intended purpose of informing the public could have been achieved through less intrusive means and that the controller violated the principle of data minimization. For these reasons, the DPA imposed a fine of €5,000 on the controller, for the violation of Article 5(1)(c) GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 30-04-2025 No. Prot.: 1465 DECISION 15/2025 (Department) The Personal Data Protection Authority, upon invitation of its President, convened a regular meeting in Department composition, at its headquarters on 15-01-2025, in order to examine the case referred to in the history of this. The meeting was attended via videoconference by Georgios Batzalexis, Deputy President, in the absence of the President of the Authority, Konstantinos Menudoukou, and Demosthenes Vougioukas and Maria Psalla, alternate members of the Authority, in replacement of Konstantinos Lambrinoudakis and Grigoriou Tsolias respectively, who, although legally summoned in writing, did not attend due to their absence. Nikolaos Livos also attended the meeting as rapporteur. Eleni Kapralou, legal expert, as assistant rapporteur, and Irini Papageorgopoulou, employee of the Department of Administrative Affairs, as secretary, were also present, without the right to vote. The Authority took into account the following: By resolution no. C/ΕΙΣ/1304/20-02-2023 complaint of violation of the provisions of the Authority's competence A (hereinafter "complainant") complains to the Municipality of Patras (hereinafter "complainant") regarding the fact that... on the official website of the Municipality of Patras there are illegally published personal data concerning him (name, surname, place of work, job position and his political beliefs), as well as an excerpt from the email he had sent to the remaining 14 members of the School Committee of Primary 1The relevant link is: ..., however the publication is no longer posted on the Municipality's website, as the latter removed it after the complaint was submitted. 1Education of the Municipality of Patras, in view of its meeting on 05-10-2022. It is alleged that the e-mail in question was printed by the President of the Committee and a photo of it was taken by its Vice-President, thus ending up published on the website of the Municipality of Patras. The Authority, in the context of examining the above complaint, sent the complainant the document no. prot. C/EXE/1342/26-05-2023 to provide opinions. Subsequently, the complainant responded to the above document, with the document no. G/EIS/4336/09-06-2023 document, and specifically claimed that: 1. The Municipality has an official website (www.e-patras.gr), through which services are provided to citizens and businesses, information on the work, activities and initiatives of the Municipality, as well as information on issues that are relevant to current events and are considered to be of major interest to the Municipality and its citizens. 2. The publication in question was posted on the official website of the Municipality, for the purpose of validly and fully informing citizens about a current issue of major and universal interest with social implications, namely that of the operation of the Municipality's Solidarity Day Care Center. 3. The publication concerned the decision of the School Committee of Primary Schools of the Municipality of Patras to financially support the Municipal Public Kindergarten by approving the allocation of an expenditure of €800.00, plus VAT, for the supply of cleaning and disinfection supplies, to cover its needs. It referred to the fact that the said decision of the School Committee was taken by majority, as objections were raised by a specific member of the school committee administration, not only for the justification or non-existence of the specific financial support, but for the general necessity and legality of the operation of the Public Kindergarten in the Municipality. 4. The operation of the Public Kindergarten is part of the general framework of the Municipality's initiatives for social action and solidarity. The fact that the Public Daycare Center has been operating continuously all these years, with an increased participation of 2 children per year, demonstrates, among other things, the importance that the citizens attach to it, which makes it necessary to inform them of any issue concerning its smooth and uninterrupted operation. For all the above reasons, it was deemed absolutely necessary by the municipal authority to inform the citizens of the disputed meeting of the primary school committee and the objections submitted to it by a specific regular member of it, who represents a specific political party within the school committee. 5. With regard to the personal data of the complainant, which were made public for the above journalistic purposes, it is noted that the specific personal data constitute data directly related to the complainant's capacity as a member of the Board of Directors. of the specific legal entity and therefore are public for the purposes of transparency of public administration. The complainant's statement in question, which was the subject of the publication, was made in the context of the public meeting of the school board of directors, in which the complainant participated, and his statement was made in his capacity as a member thereof. The above named statement of the complainant was included in the minutes kept for the meeting and which are also public, but also in the decision that was issued and which was posted on the DIAVGEIA Program, (ADA:…) for the purposes of transparency. Even the data on the complainant's political beliefs are also intertwined with his specific capacity as a member of the Board of Directors of the legal entity, since in this position, he is nominated by a municipal party, which he represents within the School Committee, in accordance with the legislation governing school committees. Finally and beyond all of the above, it was data (and specifically the data on his political beliefs), which had clearly been made public by the data subject himself. 6. Furthermore, the Municipality of the complainant attaches to its above response the complainant's postings on the internet and specifically on his personal Facebook page, which is freely accessible to the public as public and on which he has posted his political beliefs, as a 3-supporter of [party] X, his candidacy with the Teachers' Union Party supported by [party] X, his public articles supporting the political positions of [party] X, his candidacy as Community Councilor of the Eastern Sector of the Municipality of Patras with the Municipal Party "Ψ" supported by [party] X. Given that the above postings of the complainant on his Facebook profile are public and freely accessible to everyone (while their privacy could have been selected), it is presumed that the user wishes to make his data public and therefore all information posted by the same data subject in public access on the internet does not constitute personal data and does not fall within the protective provisions of the law on personal data. 7. In addition, and with regard to the composition and operation of the School Committee of Primary Schools of the Municipality of Patras, it constitutes a legal entity under public law, in accordance with the provisions of article 240 of the Law. 3463/2006, and for the appointment of its management members, the provisions of YA 63967/2019 (Government Gazette B 3537/20.9.2019) are taken into account, which amends article 1 of YA 8440/2011 (Government Gazette B’ 318), in combination with the provisions of par. 1 of art. 6 of law 4623/2019. Specifically, in accordance with the provisions of YA 63967/2019 (Government Gazette B 3537/20.9.2019): “….a. Paragraph 1 of article 1 is replaced as follows: “1. a. School committees are legal entities under public law that are managed by a board of directors, in which up to fifteen (15) members participate, in accordance with the provisions of article 103 par. 2 of Law 3852/2010 and article 240 of the Code of Municipalities and Communities. Among the members, regular and alternate, the following are mandatory: two (2) directors, from the five oldest, of the school units, primary and secondary education, respectively, one (1) of the oldest kindergarten teachers for the school committee of primary education, one (1) representative of the respective parents' association, and in the case where there is no parents' association, one (1) representative of the existing parents' associations, in order of priority of size in terms of student population of the school unit, one (1) representative of the student communities for secondary education schools, in order of priority of size in terms of student population of the school unit. The remaining members are appointed in the proportion provided for in the provisions of paragraph 1 of article 6 of law 4623/2019 (A' 134). During the meetings of the school committees, when issues concerning a specific school unit are discussed, the relevant school unit director is invited, who participates with the right to vote. "Furthermore, according to the provisions of par. 1 of article 6 of law 4623/2019, it is stated: "Where the provisions of laws, presidential decrees and other regulatory acts provide for the appointment of members to the administration of legal entities of municipalities and regions, as well as their associations, in a specific proportion, three-fifths (3/5) of the members, including the chairman of the board of directors, with their deputies, are designated by the mayor or regional governor, respectively, and two-fifths (2/5) by the other parties." In view of the above, the complainant states that the issues of the composition of the Board of Directors of a school committee, in terms of the qualities of the members, are regulated by Ministerial Decision 63967/2019 (Government Gazette B 3537/20.9.2019) amending Ministerial Decree 8440/2011 (Government Gazette B' 318), as well as by the provisions of Article 6 of Law 4623/2019, and therefore that it becomes clear that both the qualities of the members of the Board of Directors of the School Committee (as school principals, kindergarten teachers, etc.), as well as the fact that within the committee, they represent political parties of the Municipality, as members designated by them, constitute elements of their definition, as regular and alternate members of the Legal Entity of the Municipality. Furthermore, the details of the members of the Board of Directors of a public legal entity are public and can be posted, for the purpose of transparency of public administration. For the same reason, the meetings of the School Committee are public, which are held in a municipal building freely accessible to the public, while the decisions it takes are mandatorily posted in the DIAVGEIA, in compliance with the legal obligation of the legal entity. 8. Specifically, as regards the complainant, he was appointed as a regular member of the Board of Directors of the primary School Committee, following a relevant suggestion by the municipal party “Ψ”, which is politically affiliated with [party] X. 5Therefore, the complainant’s details, as well as the fact that he represents a specific political party within the School Committee, constituted elements of his definition as a regular member of the legal entity under public law and, furthermore, the complainant himself, in numerous publications in the press and in his public statements, has aligned himself politically with the specific area, clearly making his political identity public in the public discourse. Therefore, no right to the protection of the complainant's private life and personal data was violated, because the data that was made public concerned his capacity as a member of the School Committee (name, surname, profession) and was published as such. Furthermore, his political beliefs, on the one hand, had been clearly made public by him and, on the other hand, his participation in the School Committee took place, as a representative of a specific faction and at its suggestion, in accordance with the legislative framework governing the composition of the Board of Directors of these committees. In addition, informing citizens about the specific issue, which falls within the framework of the public sphere and transparency in the exercise of administrative action, made the processing of the specific data of the complainant for journalistic purposes and for the purposes of informing citizens necessary and proportionate to the intended purpose, purposes that could not be achieved otherwise, except by disclosing the details of the complainant and his disputed position, in the context of the public meeting of the Legal Entity. Following all of the above, in accordance with the allegations of the complainant, it becomes clear that the Municipality, as controller, had the right to proceed with the disputed processing ("dissemination") of the complainant's personal data for the purposes of informing citizens and the disputed processing was absolutely necessary and proportionate to the intended purpose. 9. Finally, the Municipality complained of points out that the right of citizens to information on such a major issue prevailed in this case over the right to protection of the complainant's personal data, especially since the data that was made public was already public, in the capacity of the complainant as a member of the Board of Directors, was linked to his public statement in the context of a meeting of the legal entity and, furthermore, was data that was clearly made public by him. Following the above, the Authority called with the no. prot. G/EX/2667/03-10-2024 and G/EX/2668/03-10-2024 summoned A and the Municipality of Patras respectively, to a hearing, in order to present their views on the case, at the Department of the Authority, on 09 October 2024, a date on which the case was postponed to 30-10-2024, when the summons under the number G/EX/2734/09-10-2024 was sent to the complainant. At the meeting of 30-10-2024 of the Department of the Authority, the lawyer of the Municipality of Patras, Konstantina Papadopoulou, with the legal representative …, attended via videoconference, while A did not attend. During the hearing, the Municipality of Patras developed its views and subsequently received a deadline and submitted the memorandum under no. Γ/ΕΙΣ/9059/22-11-2024 within the deadline, while the respondent did not submit a memorandum. In particular, the respondent Municipality, with its aforementioned memorandum, repeats what it had claimed in the document providing opinions under no. Γ/ΕΙΣ/4336/09-06-2023, adding that the legitimate interest of the people of Patras who are informed through the Municipality's website constitutes the basis of the disputed posting, which, following the suggestion of the Municipality's data controller, has been removed from the website on which it was initially published. The Authority, after examining all the elements of the file and those discussed at the meeting of 30-10-2024, after hearing the rapporteur and the clarifications from the assistant rapporteur, who attended without the right to vote after a thorough discussion, HAS DECIDED IN ACCORDANCE WITH THE LAW 1. Because in accordance with the provisions of articles 51 and 55 of the General Data Protection Regulation (EU) 2016/679 (hereinafter, GDPR) and article 9 of law 4624/2019 (Government Gazette A 137), the Authority has the competence to supervise the implementation of the provisions of the GDPR, this law and other regulations concerning the protection of individuals from the processing of personal data. In particular, 7 of the provisions of articles 57 par. 1 item. f' of the GDPR and 13 par. 1 letter g' of Law 4624/2019, it follows that the Authority has jurisdiction to handle the complaint in question, insofar as it concerns the disclosure of the complainant's personal data, i.e. a processing operation that takes place by automated means and establishes the Authority's jurisdiction (articles 2 par. 1 GDPR and 2 Law 4624/2019). 2. Because, in particular, according to article 4 letter 1 of the GDPR “personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person”. 3. Whereas further, in accordance with Article 4 para. 2 of the GDPR, processing of personal data is “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”. 4. Since according to Article 4 para. 7 GDPR controller is “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for his or her appointment may be provided for by Union or Member State law”. 5. Because according to Recital 4 of the GDPR “The processing of personal data should be intended to serve human beings. The 8 right to the protection of personal data is not an absolute right; it must be assessed in relation to its function in society and weighed against other fundamental rights, in accordance with the principle of proportionality. This Regulation respects all fundamental rights and the fundamental freedoms and principles recognised in the Charter as enshrined in the Treaties, in particular respect for private and family life, home and communications, the protection of personal data, freedom of thought, conscience and religion, freedom of expression and information, freedom to conduct a business, the right to an effective remedy and to a fair trial, and cultural, religious and linguistic diversity. 6. Whereas in Recital 153 GDPR “Member State law should reconcile the rules governing freedom of expression and information, including journalistic, academic, artistic or literary expression, with the right to the protection of personal data under this Regulation. The processing of personal data solely for journalistic purposes or for the purposes of academic, artistic or literary expression should be subject to derogations or exceptions from certain provisions of this Regulation, insofar as this is necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, as enshrined in Article 11 of the Charter. This should be the case in particular with regard to the processing of personal data in the audiovisual sector and in news archives and press libraries. Member States should therefore adopt legislative measures providing for the necessary exceptions and derogations to balance those fundamental rights. Member States should adopt such exceptions and derogations in relation to the general principles, the rights of the data subject, the controller and the processor, the transfer of personal data to third countries or international organisations, independent supervisory authorities, cooperation and consistency and specific cases of data processing. 9 Where such exemptions or derogations differ from one Member State to another, the law of the Member State to which the controller is subject should apply. In order to take into account the importance of the right to freedom of expression in any democratic society, it is necessary to interpret broadly the concepts related to that freedom, such as journalism. 7. Whereas according to Article 11(1) of the Charter of Fundamental Rights of the EU “1. Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers”. 8. Whereas according to Article 85 GDPR “1. Member States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and for the purposes of academic, artistic or literary expression. 2. For processing carried out for journalistic purposes or for the purposes of academic, artistic or literary expression, Member States shall provide for exceptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international organisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and Chapter IX (specific cases of data processing), in so far as they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information. 3. Each Member State shall notify the Commission of the provisions which it adopts in its law pursuant to paragraph 2 and, without delay, of any subsequent amending law or amendment thereto. 9. Whereas Regulation (EU) 2016/679 (General Data Protection Regulation, which repealed Directive 95/56 EC), provides for the special case of data processing in the exercise of the right to freedom of expression and information (Article 85 GDPR, paragraph 153 of the 10th recital thereof with reference to Article 11 of the Charter), and by means of an “opening clause” gives the Member States the option to introduce appropriate regulations in order to reconcile the right to the protection of personal data and the right to freedom of expression and information, including processing for journalistic purposes and for purposes of academic, artistic or literary expression. In order to implement the above provision, the national legislator introduced a relevant regulation in Article 28 of Law 4624/2019. 10. Whereas, in accordance with Article 28 par. 1. Law 4624/2019 “to the extent necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, including processing for journalistic purposes and for purposes of academic, artistic or literary expression, the processing of personal data is permitted when: a) the data subject has provided his or her explicit consent, b) it concerns personal data that have been manifestly made public by the data subject, c) the right to freedom of expression and the right to information prevail over the right to protection of the data subject's personal data, in particular on matters of general interest or when it concerns personal data of public figures and d) when it is limited to the measure necessary to ensure freedom of expression and the right to information, in particular when it concerns special categories of personal data, as well as criminal prosecutions, convictions and related measures security, taking into account the subject's right to private and family life. 2. To the extent necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information, including processing for journalistic purposes, and for purposes of academic, artistic or literary expression, the following shall not apply: a) Chapter II of the GDPR “Principles”, with the exception of Article 5, b) Chapter III of the GDPR “Rights of the Subject”, c) Chapter IV of the GDPR “Controller and Processor”, with the exception of Articles 28, 29 and 32, d) Chapter V of the GDPR “Transfers of personal data to third countries or international organisations”, e) Chapter VII of the GDPR “Cooperation and consistency” and f) Chapter IX of the GDPR “Provisions relating to specific cases of processing”. 11. Whereas further, according to article 5A of the Constitution “1. Everyone has the right to information, as defined by law. Restrictions on this right may be imposed by law only if they are absolutely necessary and justified for reasons of national security, the fight against crime or the protection of the rights and interests of third parties. 2. Everyone has the right to participate in the Information Society. Facilitating access to information circulated electronically, as well as its production, exchange and dissemination is an obligation of the State, always respecting the guarantees of articles 9, 9A and 19 of the Constitution”. 12. Whereas from articles 5 par. 1, 9 par. 1, in conjunction with article 2 par. 1 of the Constitution, which makes respect for and protection of human dignity a primary obligation of the State, results, as a particular manifestation of the right to personality, the right to informational self-determination, a right that is now explicitly constitutionally enshrined in article 9A. The Constitution also results in the right of the press to inform the public and the corresponding claim of citizens to information, according to article 14 par. 1 of the Constitution (freedom of expression, right to inform) and according to the, now constitutionally enshrined in article 5A, right to information (right to be informed), necessary for the activation of the right of everyone to participate in the social, economic and political life of the country, which is enshrined in article 5 par. 1 of the Constitution. The Constitution does not result in abstracto in the prevalence of one right over the other. That is, there must be an in concreto delimitation of the fields of application of the conflicting rights, in accordance with the principles of weighing opposing interests and practical harmony and proportional balancing, with the application of the principle of proportionality which is also constitutionally enshrined in art. 25 par. 1, in such a way that the protected goods (freedom of information and citizens' right to information - articles 14 par. 1 and 5A of the Constitution - and the right to personality and to the protection of private life and the right to informational self-determination) maintain their regulatory scope. The judgment whether a specific processing was carried out lawfully or, on the contrary, whether the right to informational self-determination of the affected persons and to private life was thereby violated must be based on an assessment of the issue of, on the one hand, whether this processing served the interest of informing the public and whether this interest outweighs in the specific case the right to private life, and on the other hand, whether the infringement in question was, within the framework of the principle of proportionality, necessary for the exercise of the right to information. 2 13. Since, according to article 1 of the Ministerial Decision of 2011 (Ministerial Decree of 2011/2011, Government Gazette B 2147 2011: Development, consolidation & Certification of municipal websites) in relation to the official websites of the Municipalities, it is valid that “1. Each Municipality has an official website, through which information and services are provided to citizens and businesses. For this purpose: a) informative content is prepared, which promotes the transparency of administrative action and informs citizens about the work, activities and initiatives of the Municipality, social benefits, services provided, etc. and b) appropriate software applications are designed and developed, which allow in particular communication with the Municipality's services, the submission of reports, declarations and applications by natural or legal persons dealing with the Municipality, participation in consultations and tenders as well as the provision of integrated electronic services that reduce the administrative burden of transactions and promote economic development and competitiveness. 2. The Municipality is responsible for the accuracy, correctness, suitability, completeness, authenticity and updating of the information data published through its website. At the same time, it takes all necessary technical and administrative measures to prevent unauthorized access and alteration of both the content and the electronic forms of communication and access to the services provided by its website, as well as for the protection of any personal data that it may collect, store and process through its website (…).” Furthermore, in article 2 of the above Ministerial Decision regarding the structure and content of a website, it is stipulated that “1. The information content of the website is selected based on the transparency of the administrative action of the body and the information of the citizen on the programs, activities, initiatives, projects, collaborations and other actions of a developmental, social, cultural or educational nature. At the same time, it provides valid information on the responsibilities of the Municipality, the services provided by it to the citizen and businesses, the beneficiaries of administrative benefits, the terms and conditions of the provision of services, as well as the institutional framework, based on which the aforementioned responsibilities are exercised", while according to article 5 par. 2 approx. b) it applies that “(…) The Content Manager, who receives the content to be published from the Owner, checks it for its compatibility with the General principles of content publication of article 1 of this hereof, the general editorial standards of the website, which he himself has determined, as well as the more specific objectives and policies of publicity, information, information and provision of electronic services of the body and delivers it for publication to the Technical Manager, together with the relevant instructions for its location, appearance and functionality on the website. He is also responsible for acquiring all necessary intellectual (copyright) and industrial property rights as well as for ensuring compliance with the definitions of the law on the protection of personal data on the content and data stored and made available by the Municipality’s website”. Annex B of the said Ministerial Decision mentions, among other things, social protection and solidarity as responsibilities of the Municipality, and in particular "5.6 The promotion and development of volunteerism and social solidarity by creating local social solidarity networks, voluntary organizations and volunteer groups that will be active in achieving the objectives and assisting the work of social protection 14 and solidarity of the Municipality and the Community", about which the citizens must be informed, in accordance with the aforementioned. 14. Because, in this case, from the study of all the elements of the case and based on the above considerations, the Authority finds that the Municipality processed the complainant's personal data (name, surname, professional status, place of work, political beliefs and content of the post), by posting them on the official website of the Municipality of Patras www.e-patras.gr, in a relevant article entitled "..." and posted on ... . 15. Because with regard to the political beliefs of the complainant and the argument of the accused that he had in any case clearly made them public with public posts on his personal Facebook page, it is established that the complainant was indeed a member of the school committee representing a specific party faction that appointed him to this position, and with his knowledge he had chosen to make his profile on the specific social network, on which he publicly posted his political positions (article 28 par. 1 of Law 4624/2019), public. 16. Because in addition, it is established that the disputed posting of information by … on the official website of the accused Municipality regarding the School Committee's approval decision for the social tutoring center, which also contained the above information of the complainant, was made with the aim of informing the citizens and enhancing the transparency of municipal action. However, it referred to, among other things, "...", in the context of intense partisan controversy and criticism, and therefore the data subject could not reasonably expect the specific posting on the website in question with this content, and indeed with reference to his professional capacity, his place of work and the isolation of the essence of the e-mail message that he had sent with the aim of facilitating the committee meeting, while the purpose of informing citizens could be achieved without providing the said information. At the same time, it is not established that in the relevant posting of the same approval decision on the DIAVGEIA website (with ADA:…) only the name and surname of the 15th complainant, his status as a regular member of the committee, as well as his position in the context of the interactive discussion that took place during the committee meeting, which he had already sent by e-mail with the aim of facilitating the committee meeting, and not his professional status and place of work. In view of the above, according to the combined interpretation of cases c' and d' of the first paragraph of article 28 of the law. 4624/2019, the publication of even the simple, in this case, personal data of the complainant's professional status, the place of work and the actual content of the email message that he had sent to the School Committee to facilitate its meeting were not necessary elements to achieve the objectives of maintaining the specific website in accordance with the law, which are to inform citizens and enhance the transparency of administrative action, and go beyond what is necessary, as these objectives could be achieved by milder means. This is because the publication's mention in the context of informing citizens about the Municipality's social protection and solidarity work, but also for reasons of transparency of the municipal work, must be done in such a way that the intrusion into the private and family life of the data subject is as small as possible within the framework of a harmonized implementation of the protection of private and family life on the one hand and the right to information on the other. In this case, the principle of minimization (article 5 par. 1 point c GDPR, which according to article 28 par. 2 law 4624/2019 applies in this case) or of frugality in the processing of personal data, which also applies to the processing of personal data for journalistic purposes to satisfy the legitimate interest of citizens in information, imposes the least burdensome processing for the subject, even if it is not the same as effective in comparison to overly comprehensive processing. In this specific case, the publication in question constitutes a form of interference with the rights that constitute the constitutionally protected private sphere of the person (articles 9 par. 1 sub-paragraph b and 9 A of the Constitution), which is considered unlawful because it is not necessary for the purpose of informing the public, and exceeds the limits set by the 16 principle of proportionality (see article 28 par. 1 and 2 of law 4624/2019 and article 5 par. 1 sub-paragraph c of the GDPR). 17. Because in view of the above, it appears that the purposes of valid and complete information of citizens could be achieved by milder means, such as, for example, by informing about the adoption of an approval decision by the Board of Directors for the public tutoring center and posting this decision on the Municipality's website (as was also posted on the DIAVGEIA website), indicating the minority and majority views. 18. Furthermore, since the document providing clarifications sent by the Authority to the complained Municipality is taken into account, as the latter acknowledges in its memorandum to the Authority with the number Γ/ΕΙΣ/9059/22-11-2024, the above link was removed from the official website of the Municipality, but had in the meantime been published on several other websites, including that of the municipal party of Mayor "Φ". 19. Because, as a result of the above, it is established that the principle of data minimization has been violated (article 28 of Law 4624/2019, article 5 par. 1 letter c GDPR), since the data under processing are not appropriate, relevant and not limited to what is necessary, in relation to the intended purpose, while the data subject could not reasonably expect that for the specific purpose of informing citizens, processing would be carried out by publicly posting the email message itself on the official website of the Municipality, with the details of his position and place of work, and even in the context of intense party confrontation and criticism. 20. Because the violation of the basic principles for processing as analytically explained above, entails the imposition of the administrative sanctions of article 83 par. 5 letter a GDPR. According to the GDPR (Recital 148), in order to strengthen the enforcement of the rules of this Regulation, sanctions, including administrative fines, should be imposed for any infringement of this Regulation, in addition to or instead of the appropriate measures imposed by the supervisory authority in accordance with this Regulation. 1721. Whereas the Authority, based on the above, considers that the imposition of a corrective measure is not sufficient to restore compliance with the provisions of the GDPR that have been violated and that, based on the circumstances established, an additional and effective, proportionate and dissuasive administrative fine should be imposed pursuant to Article 58(2)(i) of the GDPR, both to restore compliance and to sanction the unlawful conduct. 3 22. Furthermore, the Authority took into account the criteria for measuring the fine set out in article 83 par. 2 of the GDPR, paragraph 5 of the same article which is applicable to the present case and the Guidelines 4/2022 of the European Data Protection Board on the calculation of administrative fines for the purposes of Regulation 2016/679, which were adopted on 24/5/2023, as well as the actual facts of the case under examination and in particular: i) The fact that the respondent in his capacity as controller violated the principle of minimization provided for in article 5 par. 1 sub-paragraph c, i.e. he violated a fundamental principle of the GDPR for the protection of personal data. ii) The fact that the controller was aware of the legal framework of the postings on the Municipality's website and the processing act in question cannot be attributed to negligence. iii) The fact that the Municipality complained about, following the clarification document sent to it by the Authority, removed the link from its official website: … iv) The fact that there are no previous relevant violations by the complainant. v) The fact that the complainant did not delay in responding to the Authority's documents and cooperated in providing clarifications. vi) The fact that the data in question, which were made public in breach of the principle of minimisation, do not belong to special categories of data. 3 See OE 29, Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679 WP253, p. 6 18 vii) The fact that from the evidence brought to the attention of the Authority and on the basis of which it found the above infringement of the GDPR, it does not appear that the controller caused material damage to the affected person through the processing in question. 23. Based on the above, the Authority unanimously decides that the administrative sanction referred to in the operative part should be imposed on the respondent as controller, which is considered proportionate to the gravity of the violation. FOR THESE REASONS, the Authority imposes on the respondent Municipality of Patras as controller the effective, proportionate and dissuasive administrative fine appropriate in this specific case, in accordance with its specific circumstances, of a total amount of five thousand (5,000) euros, for the above-identified violation of Article 5, paragraph 1, letter c, GDPR, as specified above, in accordance with Articles 58, paragraph 2, letter i, and 83, paragraph 5, letter a, GDPR. The Deputy President The Secretary George Batzalexis Irene Papageorgopoulou19
