HDPA (Greece) - 31/2025
From GDPRhub
| HDPA - 31/2025 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 5 GDPR Article 12 GDPR Article 13 GDPR Article 15 GDPR Article 24 GDPR Article 31 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 24.06.2025 |
| Published: | 15.07.2025 |
| Fine: | 10,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 31/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Le |
The DPA fined an association for people with autism €10,000 for failing to comply with an access request by the legal guardians of a child and for unlawfully transmitting the child’s personal data to third parties.
English Summary
Facts
The data subjects made an access request to the controller, an association for persons with autism spectrum disorders ‘H Ασπίδα του Δαυίδ’, regarding personal data of their minor child who was being treated there. They specifically asked for CCTV footage from the controller’s premises on certain dates, in order to find out how certain marks on their child's head and hands were caused.
The controller did not reply to the data subjects’ access request.
The data subject’ lodged a complaint before the DPA against the controller's failure to satisfy their access request. They also claimed that the controller unlawfully transferred their child’s health data to a third company for external evaluation of the child's existing intervention program, without their prior notification and consent.
The controller claimed that it could not provide the CCTV footage because some of its employees appear on it, which refused the disclosure of the footage to the data subjects. Therefore, it must respect its employees privacy rights. The controller also insisted that in any case the recordings were automatically deleted from the system after 48 hours. Regarding the transfers of personal data, it responded that the data subjects should address the matter to the third company.
The DPA informed the controller that unless it demonstrated that in the specific case the rights or freedoms of its employees concerned were in fact affected, it had to satisfy the right of access by providing data subjects with the requested parts of the footage.
The controller still refused to comply with the DPA’s instructions.
Holding
The DPA found several violations and imposed a fine of total amount €10,000.
First, the DPA held that the controller violated Article 5, Article 12 and Article 15 GDPR for refusing to satisfy the data subject’s access request to the CCTV footage without demonstrating adverse negative effects on the rights or freedoms of the employees involved. It also found that it stored the footage for way longer than 48 hours. For this violation the DPA imposed a €3,000 fine.
Second, it found that the controller infringed Article 5, Article 13 and Article 24 GDPR by transmitting the personal data of the minor child to the third party without prior notification, and imposed a €3,000 fine.
Third, it found that the controller disclosed the interim measures order of the court which contained personal data of the child to a large number of third parties, in violation of Article 5 and Article 13 GDPR, and imposed a €3,000 fine.
Lastly, it imposed a €1,000 fine for failure to cooperate with the DPA, in breach of Article 31 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
1-3 Kifissias Ave., 11523 Athens, Tel: 210 6475600, Fax: 210 6475628, contact@dpa.gr / www.dpa.gr Athens, 24-06-2025 No. Prot.: 2238 DECISION 31/2025 The Personal Data Protection Authority convened, following an invitation by its President, in a meeting on Tuesday 03-06-2025 at 08:30 a.m., in order to examine the case referred to in the history of this case. The President of the Authority, Konstantinos Menudakos, the regular members Spyridon Vlachopoulos, Konstantinos Lambrinoudakis, Charalambos Anthopoulos, Christos Kalloniatis, Ekaterini Iliadou as rapporteur and Grigorios Tsolias were present. Present without the right to vote were Kalliopi Karveli, legal expert and Pantelis Kammas, IT expert, as assistants to the rapporteur and Irini Papageorgopoulou, employee of the administrative affairs department, as secretary. The Authority took into account the following: The no. protocol was submitted to the Authority. C/ΕΙΣ/7983/15-10-2024 complaint, by A and B (hereinafter "complainants"), against the Association for people with autism spectrum disorders "THE SHIELD OF DAVID" (hereinafter "complainant Association"). The above complaint was submitted, following authorization by the complainants, through the Civil Professional Law Firm under the name "ΟΙΚΟΝΟΜΑΚΙΣ CHRISTOS LAW FIRM". According to the complaint, the complained Association did not satisfy the right of access which the complainants exercised by extrajudicial letter, as exercising parental responsibility for their minor child (arts. 128 and 1510 of the Civil Code). The above right was exercised on … and had as its object the delivery of video footage for specific dates from the closed circuit cameras which are installed and operate in the premises of the Association and 2 specifically from the areas where their minor child was, in order to establish how, within the premises of the Association, marks of scratches and blows were caused to the head and hands of their child. Subsequently, the Authority, with the document no. prot. C/ΕΣΕ/2931/25-10-2024, requested the complained Association to present its views on the complaint and informed it that as the controller it must satisfy the rights of the data subject without delay and no later than one month from the submission of the request, as well as to ensure that the image recording section requested by the complainants is not deleted from the hard drive of their recording system. The complained Association, through its representative, responded with the document no. prot. C/ΕΙΣ/8439/04-11-2024 in which it is stated that the recordings are automatically deleted from the system after 48 hours. Furthermore, it is stated that the beneficiary in question has aggressive and self-injurious behavior and for the cutting out of parts of the recordings of his behavior they are faced with “the refusal of the employees involved to allow the cutting out of these parts, because they also appear”. Subsequently, the complainants submitted to the Authority the documents no. prot. C/ΕΙΣ/8682/12-11-2024 and C/ΕΙΣ/8683/12-11-2024 supplementary documents, which state, among other things, that the reported Association transmitted to the company "BALKANIKI EPE" sensitive personal data of their minor child, without the prior information and consent of the parents. Specifically, they transmitted information regarding the intervention program that their minor child was following, an opinion from the Center for Differential Diagnosis, Diagnosis & Support Y and the complete social history that was obtained upon their child's entry into the therapeutic program, with the aim of the external evaluation of the existing intervention program as well as to investigate points of improvement regarding the functionality of the student. The Authority, with the no. prot. G/ΕΣΕ/3220/19-11-2024 and G/ΕΣΕ/3395/03-12-2024 documents, informed the complained Association that since the right of access, which was lawfully exercised by the parents of the data subject, has not been satisfied, citing the refusal of the persons involved to provide the 3 recording sections, it must, as the controller, prove that in this specific case the rights or freedoms of the employees involved will actually be affected. Otherwise, it must satisfy the right of access by delivering to the applicants exact copies of the recording sections, or sections after processing through appropriate technical measures, e.g. blurring of the employees involved, after having previously weighed their rights and freedoms. It also called on the complained Association to inform the Authority why the minor's personal data was transferred to the company "BALKANIKI LTD", on what legal basis the transfer was made and finally whether the complainants were previously informed about it. In the no. prot. C/ΕΙΣ/9353/03-12-2024 response of the complained Association, it is stated that in the private agreement signed by the parents as well as by the therapists employed by the institution, it is stated that it is possible to cut out and deliver parts of image recordings to interested family members, when the requested cuts concern a) therapeutic interventions in the beneficiary, b) scientific reasons and c) legal reasons that prove the success of the applied science in the beneficiaries. Finally, it requested the Authority's proposals for the management of this specific issue. However, in the above response the complained association does not provide evidence, as it should have as a data controller, to prove that the provision of the video material adversely affects the rights or freedoms of the employees involved. For this reason, the Authority, with the document no. Γ/ΕΣΕ/3465/05-12-2024, informed the complained association that it must reconsider the immediate satisfaction of the complainants' right of access. Subsequently, the complained association, with the document no. Γ/ΕΣΕ/3465/05-12-2024, G/ΕΙΣ/9614/11-12- 2024 document, informed the Authority that the employees' refusal to hand over parts of the image recording is inviolable and, in their opinion, fully documented, attaching a copy of the beneficiary's departure photo on ..., in which it appears that his forehead is clean, and an email message, with which the Association informs the complainants that they must carefully examine the child before receiving him and inform immediately if there is the slightest sign. 4 Regarding the issue of the transmission of sensitive personal data, following the Authority's reminder document no. G/ΕΣΕ/236/17-01-2025, the complained Association with the no. prot. G/ΕΙΣ/443/17-01-2025 document replied that they do not know anything and that the Authority should contact Balkaniki EPE. On …, the complainants submitted to the Authority the no. prot. G/ΕΙΣ/819/29-01- 2025 supplementary report, in which it is stated that the complained-about entity presented, during the hearing of interim measures at the Single-Member Court of First Instance Y, stored video footage from dates prior to the dates for which the right of access was exercised. Part of the said material has been taken from the internal closed circuit cameras which are installed and operate on the premises of the entity, while some material has been taken from a mobile phone device without prior information and consent of the parents. On … the complained-about Association with the no. prot. G/ΕΙΣ/908/31-01-2025 document informed the Authority that the beneficiary's father stated orally that it was his child's last day in the Agency's Programs. Finally, with the no. prot. G/ΕΙΣ/1304/13-02-2025 and G/ΕΙΣ/1306/13-02-2025 documents, the complainants and the accused agency, respectively, informed the Authority about the decision of the Single-Member Court of First Instance Y (Precautionary Measures), according to which the accused agency, as a legal entity under private law, is not obliged to accept the minor child of the complainants. Subsequently, the complained body notified the above Decision to a multitude of recipients, to whom it states that the reason for notifying the Decision is that it clarifies the right of each Mental Health Body to judge the mandatory need for removal of a beneficiary. Following the above, the Authority invited, with the no. prot. C/ΕΣΕ/1062/26-03-2025 and C/ΕΣΕ/1061/26-03-2025 summons, the complained Association and the complainants (notifying them of the additional documents that had been submitted and were not already known to them), to attend the meeting of the Authority's Plenary on ..., in order to present their views on the case. At the said meeting, A was presented, while the accused body, on the day of the meeting and just before its start, submitted, through the representative of C, the documents no. C/ΕΙΣ/2887/07-04-2025 and C/ΕΙΣ/2913/08-04-2025 supplementary documents in which he states that he cannot attend and requests a 5 postponement for a new meeting. It is also stated that the requested recorded material is not available because the recordings are automatically deleted after forty-eight (48) hours, as well as the complainants wish to create problems for the employees of the institution. In addition, a photograph of the beneficiary on ... is attached, in which it is evident that there is no injury on his forehead as his parents claim. Finally, regarding the issue of the transfer of personal data to the company Balkaniki, it is stated that they are not aware of any relationship between D, who has served as Scientific Director of the institution, and the said company, which is the only company in Greece that supplies public and private institutions with Electronic Assistive Technology for People with Disabilities. Following the above, the Authority called again with the no. prot. G/EXE/1233/08- 04-2025 and G/EXE/1232/08-04-2025 summons the reported Association and the complainants (notifying the additional documents under no. G/EIS/2887/07-04-2025 and G/EIS/2913/08-04-2025 that had been submitted and were not already known to them), to attend the meeting of the Plenary Session of the Authority on ..., in order to present their views on the case. At the above meeting, no representative from the complained entity was present, who with the documents no. prot. C/ΕΙΣ/3513/28-04-2025 and C/ΕΙΣ/3526/28-04-2025 informed the Authority that the Data Protection Officer of entity C cannot attend, as well as that with the memorandum no. prot. C/ΕΙΣ/2913/08-04-2025 they consider that they have answered all the questions posed by the Authority in a complete and clear manner. On the contrary, A and her attorney Emilia Kalivianaki (A.M.D.S.Th ….) attended the meeting and reiterated the positions they have put forward with the above complaint and the supplementary documents. After the meeting, the complainants submitted, within the prescribed deadline, the memorandum under no. prot. C/ΕΙΣ/3910/08-05-2025, in which they state the following: a) the complainants sent the initial request to the body for the provision of video material on … via an extrajudicial statement – invitation and never received a response, b) the last event for which the above requested video material took place on …, i.e. in a period of less than 48 hours, which, according to the 6 allegations of the complained body, is the period of time during which the data is retained and then automatically deleted, c) with regard to the transmission of the child's sensitive personal data to "Balkaniki Ltd.", they did not sign an information and consent form and they never received information about the said transmission. Furthermore, after an internet search, they found that the above company is associated with a former member of the organization who, while he had signed opinions for the parents and the minor child, never had any communication or cooperation with them, d) during the hearing of interim measures before the Single-Member Court of First Instance Y on …, a digital storage medium (USB stick) was presented by the accused organization which contained material from the cameras for the time periods that the above had requested, and the organization claims that they have been deleted. Also, a multitude of photographs were presented as well as video footage recorded by a portable camera, possibly from a mobile phone, of an unknown owner. Therefore, it is established that there was available and archived video material from the institution, close to the dates they had requested, e) on … the complainants were informed by telephone from the Special Primary School F that a company had requested information about the Individualized Education Program of their child, as a student at the said school. The complainants subsequently established that the institution complained of had communicated to the company the opinion of the Center for Differential Diagnosis, Diagnosis and Support Y, as well as having provided the complete history that the institution received upon the child’s entry into the therapeutic program. The Authority, after examining all the elements of the file and those discussed at the meeting of ..., after hearing the rapporteur and the clarifications from the assistant rapporteurs, who attended without the right to vote, after a thorough discussion, HAS DECIDED IN ACCORDANCE WITH THE LAW 1. The installation and operation of video surveillance systems, permanently installed in a space, which have the ability to receive and/or transmit image and/or sound to 7 projection screens or recording devices1 through the collection, retention, storage, access and transmission of personal data, constitute, as individual processing operations, an interference with the individual rights to respect for private life under Art. 9 S., 7 CTHDEE and 8 ECHR as well as the protection of personal data under Art. 9A S., 8 ECHR and 8 CTHDEE, as the Authority ruled with No. 3/2020 Opinion2. 2. The installation and operation of the relevant video surveillance system is lawful, provided that, first of all, the conditions of Articles 5 (general principles) and 6 (lawful basis) of the GDPR are cumulatively met. The European Data Protection Board (hereinafter, the EDPB) issued Guidelines 3/20193 on the processing of personal data through video recording devices. This text provides detailed guidance on the application of the GDPR in relation to the use of cameras for various purposes. Furthermore, the provisions of the Authority’s Directive 1/2011 on the use of video surveillance systems for the purpose of protecting persons and property must be taken into account in conjunction with the above provisions of the GDPR. Moreover, compliance with the above conditions must take place in time before the installation and operation of the system, and the related obligation to demonstrate lawfulness lies with the controller in application of the principle of accountability (see also Decision 43/2019 of the Authority). 3. According to point 1a of Article 5 of the GDPR, “personal data shall be processed lawfully and fairly in a transparent manner in relation to the data subject (“lawfulness, objectivity and transparency”)”. 4. According to point c of paragraph 1 of Article 5 of the GDPR, “personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”). 5. According to paragraph 2 of Article 5 of the GDPR, “The controller shall be responsible for and shall be able to demonstrate compliance with paragraph 1 (“accountability”).” 1 https://www.dpa.gr/el/enimerwtiko/thematikes_enotites/eisagwgi_videoepitirisi 2 Available at https://www.dpa.gr/sites/default/files/2023-01/60_2022%20anonym.pdf 3 See Guidelines no. 3/2019 EDPB on processing of personal data through video devices p. 7. 8 6. According to article 15 par. 1 and 3 GDPR: “1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, the right of access to the personal data and to the following information: a) the purposes of the processing, b) the categories of personal data concerned, c) the recipients or categories of recipients to whom the personal data have been or are to be disclosed, in particular recipients in third countries or international organisations, d) if possible, the period for which the personal data will be stored or, where that is not possible, the criteria determining that period, e) the existence of the right to request the controller to rectify or erase personal data or to restrict the processing of personal data concerning the data subject or to object to such processing, f) the right to lodge a complaint with a supervisory authority, g) where the personal data are not collected from the data subject, any available information on the source their, h) the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject.” and “3. The controller shall provide a copy of the personal data being processed. For additional copies that may be requested by the data subject, the controller may charge a reasonable fee for administrative costs. If the data subject makes the request by electronic means and unless the data subject otherwise requests, the information shall be provided in a commonly used electronic format.” 7. According to Article 15(4) of the GDPR, the right to obtain a copy of personal data shall not adversely affect the rights and freedoms of others. 8. According to Article 12(3) and (4) of the GDPR: “3. The controller shall provide the data subject with information on the action taken on a request pursuant to Articles 15 to 22 without delay and in any event within one month of receipt of the request. That period may be extended by two further months, where necessary, taking into account the complexity of the request and the number of requests. The controller shall inform the data subject of such an extension within one month of receipt of the request, as well as of the reasons for the delay. If the data subject submits the request by electronic means, the information shall, where possible, be provided by electronic means, unless the data subject requests otherwise. 4. If the controller does not act on the data subject's request, the controller shall inform the data subject, without undue delay and at the latest within one month of receipt of the request, of the reasons for not acting and of the possibility of lodging a complaint with a supervisory authority and of seeking a judicial remedy.’ 9. Point 173 of the European Data Protection Board Guidelines 01/2022 on the rights of data subjects – Right of access4 states that the interests of all parties involved must be balanced taking into account the specific circumstances of the case and in particular the likelihood and severity of the risks posed by the disclosure of the data. The controller should endeavour to reconcile the conflicting rights in order to mitigate the risk to the rights and freedoms of others. As stated in recital 63 of the GDPR, “... This right should not adversely affect the rights or freedoms of others, such as professional secrecy... However, these factors should not result in the data subject being denied information...” Also according to Article 15(4) of the GDPR, the right to obtain a copy of personal data does not adversely affect the rights and freedoms of others. This means, for example, that when the restriction is applied, information concerning others should be rendered illegible to the extent possible rather than refusing to provide a copy of the personal data. However, if it is impossible to find a solution to reconcile the rights concerned, the controller must decide which of the conflicting rights and freedoms prevail. 10. According to point 172 of the Guidelines 01/2022 of the European Data Protection Board, a general concern that the rights and freedoms of others may be affected by responding to the access request is not sufficient to invoke Article 15(4) of the GDPR. The controller must be able to demonstrate that, in the specific case, the rights or freedoms of others will actually be affected. 11. Furthermore, in accordance with the provisions of Articles 13(1)(a) and (b) of the GDPR, e’ and 24 of the GDPR, the controller must inform the data subject of any recipients or categories of recipients to whom the personal data have been or are to be disclosed, as well as implement appropriate technical and organizational measures in order to ensure and be able to demonstrate that the processing is carried out in accordance with the GDPR. 12. Furthermore, in accordance with Article 31 of the GDPR, the controller and the processor and, where applicable, their representatives shall cooperate, upon request, with the supervisory authority for the exercise of its duties. 13. In the event of processing of personal data in breach of the provisions of the GDPR, the Authority shall have the power, in accordance with Article 58 par. 2 letter i), to impose an administrative fine pursuant to Article 83 of the GDPR. 14. In the present case, in accordance with what is set out above, from the information in the file and following what emerged during the hearing, it is established: a) the non-fulfilment of the complainants' right of access to the video material, in accordance with their relevant request, without the complained body documenting that by providing the requested material, the rights or freedoms of the employees involved are adversely affected. Consequently, a violation of articles 5, 12 and 15 of the GDPR is established. b) the transmission of the personal data of the complainants' minor child to the company "BALKANIKI LTD", without prior relevant information to them. Consequently, a violation of articles 5, 13 and 24 of the GDPR is established. c) the notification by the complained body to a multitude of recipients of the decision of the Single-Member Court of First Instance Y (Precautionary Measures), according to which the 11 complained body, as a legal entity under private law, is not obliged to accept the minor child of the complainants, without prior notification to them and without compliance with the principles of proportionality and lawfulness of the processing for this transfer. Consequently, a violation of Articles 5 and 13 GDPR is established. d) the lack of cooperation with the Authority, in violation of Article 31 GDPR. 15. Based on the above, the Authority considers that it is appropriate to exercise the powers under Article 58 par. 2 of the GDPR its corrective powers in relation to the established infringements and that, based on the circumstances established, an effective, proportionate and dissuasive administrative fine should be imposed, in application of the provision of Article 58 para. 2 sub. i’ of the GDPR, in accordance with Article 83 of the GDPR. 16. Furthermore, the Authority took into account the criteria for measuring the fine set out in Article 83 para. 2 of the GDPR, paragraphs 4 sub. a) and 5 sub. a) and b) of the same article which are applicable to the present case, the Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679 issued on 03-10-2017 by the Article 29 Working Party (WP 253) and the Guidelines 04/2022 of the European Data Protection Board on the calculation of administrative fines under the General Regulation, as well as the factual data of the case under examination, in particular the criteria and specific circumstances set out below and, specifically, the fact: • that the nature of the infringement concerns basic principles of the GDPR, • that the right of access that was not satisfied concerns the personal data of a minor • that the categories of personal data concerned by the processing pose a high risk, since they are sensitive personal data health data of a minor • that personal data of a minor were transferred to a third party without the prior relevant information of the complainants, as those exercising parental responsibility of their minor child • that the decision of the Single-Member Court of First Instance Y (Precautionary Measures) regarding personal data of a minor was communicated by the complained body to a multitude of recipients, without prior information of the complainants as those exercising parental responsibility of their minor child and without compliance with the principles of proportionality and 12 lawfulness of the processing for this transfer • that the complained body did not cooperate directly and effectively with the Authority, as it was late in providing explanations and the information of the Authority was incomplete and finally, • that the complained body is a non-profit association supervised and fully funded by the Ministry of Health. FOR THESE REASONS THE AUTHORITY Imposes on the Association "THE SHIELD OF DAVID" as controller, based on Article 58, paragraph 2, subparagraph i’ of the GDPR A. an administrative fine of three thousand euros (3,000€), for the established violation of Articles 5, 12 and 15 of the GDPR, in accordance with what is mentioned in paragraph 14, item a’ above. B. an administrative fine of three thousand euros (3,000€), for the established violation of Articles 5, 13 and 24 of the GDPR, in accordance with what is mentioned in paragraph 14, item b’ above. C. an administrative fine of three thousand euros (€3,000), for the established violation of Articles 5 and 13 of the GDPR, in accordance with what is stated in paragraph 14, item c’ above. D. an administrative fine of one thousand euros (€1,000), for the established violation of Article 31 of the GDPR, in accordance with what is stated in paragraph 14, item d’ above. The President The Secretary Konstantinos Menudakos Irini Papageorgopoulou
