HDPA (Greece) - 39/2021
|HDPA (Greece) - 39/2021|
|Relevant Law:||Article 5(1) GDPR|
Article 12(3) GDPR
Article 15 GDPR
|Parties:||Anonymous data subject|
Municipal Transport Company of Rhodes "RODA"
|National Case Number/Name:||39/2021|
|European Case Law Identifier:||n/a|
|Original Source:||Greek DPA (in EL)|
The Greek DPA fined RODA, a transportation company, €8000 for violating the principle of data minimization and the right of access in the context of a dispute between RODA and an ex-bus driver. The company unnecessarily issued a 'certificate of service' indicating the driver had been fired because of a criminal act, and did not reply to his request of a copy of the video of the bus on the day of the incident
English Summary[edit | edit source]
Facts[edit | edit source]
A bus driver ("X") working for the Municipal Transport Company of Rhodes ("RODA") was dismissed following a controversial incident. After having been dismissed, X asked RODA to provide him with a certificate of service. According to the applicable Greek law, such certificate should indicate the identity of the individual concerned, the type of occupation, as well as the period of employment. RODA however delivered a certificate which also included, in addition to the legally required information, the fact that X had been fired because of a criminal act. X considered that adding this information on the certificate was disproportionate and could cause him prejudice.
Exercising his right to access under Article 15 GDPR, X requested RODA to provide him with a copy of the video-tape from the bus camera in order to verify what had happened on the day of the controversial incident. In accordance with Article 12(3) GDPR, RODA had the obligation to answer that request within one month upon receipt. RODA however never replied to X's request.
X considered that by acting this way, RODA had infringed the GDPR. He therefore lodged a complaint with the Greek DPA. During the procedure, RODA explained that it had orally informed X of the fact that the video-tapes of the bus were systematically deleted after 7 days. X, however, denied having received that information.
Holding[edit | edit source]
After considering all the facts of the case, the Greek DPA found that RODA had breached Article 5(1) GDPR (principle of data minimisation), as well as Article 12(3) and 15 GDPR (right of access by the data subject - obligation to reply within a month). In particular, the Greek DPA considered that, by adding on the certificate of service an information that was unnecessary and which could cause prejudice to the data subject, RODA had infringed the principle of data minimisation. Furthermore, by not replying to X's request to be provided with a copy of the video-tape, RODA had infringed its obligation with respect to access requests. The Greek DPA therefore decided to impose on RODA a fine of 5,000 EUR for breach of Article 12(3) and 15 GDPR, and a fine of 3,000 EUR for breach of Article 5(1)(c) GDPR.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 03-09-2021 No. Prot.2001 DECISION 39/2021 (Department) The Personal Data Protection Authority Department at its headquarters on 26.05.2021 at the invitation of its President, in order to examine the case referred to in the background hereof. Attended by the Vice President G. Batzalexis, disabled by the President of the Authority K. Menoudakou, the regular members of the Authority S. Vlachopoulos and K. Lambrinoudakis, as rapporteur and the alternate member of the Authority G. Tsolias, to replace the regular member Ch. Anthopoulos, who, although summoned legally in writing, did not attend due to disability. You were present without right K. Karveli, Specialist Scientist-Lawyer, as Assistant Rapporteur, who left after the discussion of the case and before the conference and the decision making and E. Papageorgopoulou, employee of the administrative department Affairs of the Authority, as Secretary. The Authority took into account the following: With the no. prot. Γ / ΕΙΣ / 1084/20 and Γ / ΕΙΣ / 2648/20 his complaints to the Authority, A complains to the Municipal Transport Company of Rhodes "RODA" for not legal processing of his personal data. Specifically with the no. prot. Γ / ΕΙΣ / 1084/20 his complaint complains that following his dismissal from the Municipal Transport Company of Rhodes "RODA", asked for a certificate of previous service that he worked in the company, which granted, but adding in breach of the principle of proportionality that he was fired for a criminal act, thereby provoking, as claims, damage to his interests. 1 Also with the second with no. prot. G / EIS / 2648/20 denounces him denounces the company for not satisfying its right of access. Particularly, following a lawsuit filed against him for embezzlement from company, as a former employee in the position of collector, requested from company for judicial use of his defense, as a defendant in criminal trial, upon his request to be provided with a copy of the videotape material that recorded the closed circuit television of the bus at the location of the bus driver on the day of the incident in question on…. But, as he complains, the company never responded to his request, by tacitly rejecting it, in violation of the provisions of articles 12 par. 3 and 15 of the GCC. Following these, the Authority sent to the complainant no. prot. G / EX / 1084-1 / 6.4.20 and G / EX / 2648-1 / 22.6.20 documents for providing clarifications on of the complainants, which no. prot. Γ / ΕΙΣ / 4683 / 20Reply document told her the following: a) the videotaping and videotaping that carried out is not illegal, but is exceptionally permitted, as is use of the material in question, where there are reasons of public interest, which concern the prevention of crimes, the protection of the law interests and the protection of private and family life, b) all company employees, drivers and collectors, have been informed and know about the specific processing, and c) the certificate issued is legal, true and fully compliant with reality. Then the Authority with the no. prot. G / EX / 567 / 4.2.21 and G / EX / 568 / 4.2.21 respectively called G. Lampadakis, his attorney complainant A and the complained Municipal Transport Company Rhodes "RODA" to attend the meeting of the Authority on 10.02.2021, in order to discuss the above complaint. During the hearing, which took place on 24.02.21, after a postponement from the discussion of 10.02.21, his attorneys were present complainant George Lampadakis and Elias Zografidis and on her behalf D. Tsikkis, President of the Municipal Transport Company "Roda" company after the power of attorney of lawyer Spyridoula Pasari. The plaintiff's attorneys both at the hearing procedure as well as with no. prot. Γ / ΕΙΣ / 1546/21 their memorandum to the Authority stated the following: a) the defendant has not satisfied to date the complainant's right of access to the videotaped in question, nor has answered something relevant to his request b) although his case criminal hearing was put on file, the complainant needs the disputed material in his defense in his civil action for damages by complained, c) during the hearing the legal representative of company reported that the videotaped material has been deleted and that it has informed the complainants orally, while this did not happen stated the complainant in her reply to the Authority in 2020, d) h Certificate of previous service contained personal data not necessary, relevant, and depending on the intended purpose, in violation of the provisions of articles 678 of the Civil Code and 5 of the GCC, e) at a later date requested to re-issued a certificate, which again although did not state that dismissed for a criminal offense, indicated when dismissed due to a complaint before the agreed time for an important reason, and f) finally, with a third news his application and at the same time a complaint to the Labor Inspectorate, h The complainant issued him a new certificate in which he referred to recruitment and dismissal decisions, so even this third certificate does not meet the criteria of 678 of the Civil Code, if one can with the numbers of the decisions to refer to DIAVGEIA and to see the full text of his dismissal, where appears as a mocker. The President of the Municipal Transport Company of Rhodes "RODA" D. Tsikkis and the attorney S. Pasari, both during the hearing and and with no. prot. G / EIS / 1862/21 their memorandum to the Authority stated the following: (a) personnel processing has been processed in relation to the certificate of previous service data only in the light of the right of access, provided that the attestation was not transmitted to third parties, in any case following the new one from 23.12.20 At the request of the complainant, the company issued a new certificate with correct 3 repetition in which only the time of its recruitment, the time period, is indicated period of his employment and the type of his work, b) the recording of personal data from the video camera that is mounted inside the buses above the driver's seat videotaped only the issuance transaction we observe between driver and passenger, without depicting faces and without sound, and the data collected through of the video surveillance system are not stored in an archiving system, and the duration of their observance is limited to seven (7) days, after the end of which are automatically deleted, c) υλικό its material was automatically deleted camera, a fact of which he was aware and of which he had been orally informed o complainants and d) from 3.3.21 the BoD has voted in favor. of the company written CCTV policy attached to the Authority. The Authority, after the hearing and examination of the evidence of the dossier and after hearing the rapporteur and the assistant rapporteur, who left after the case was discussed and before the conference and reception decision, after a thorough discussion THOUGHT ACCORDING TO THE LAW 1. According to the provisions of article 5 par. 1 lit. a ', b' and c 'of the GPD personal data should a) be submitted to lawful and fair processing in a transparent manner in relation to the data subject (principles of legality, objectivity and transparency), b) collected for specified, explicit and lawful purposes and not to be subject to further processing incompatible with these purposes (principle of (c) are appropriate, relevant and limited to necessary for the purposes for which they are processed (principle data minimization). Furthermore, according to article 12 par. 3 of the GKPD, “the controller provides the data subject with information about the action that 4π ικ α δ τ ά 1έ 2χ delay and in any case within one month of receipt of the request. This period may be extended by a further two months, provided that required, taking into account the complexity of the request and its number of requests. The controller informs the subject of data for the said extension within one month of receipt of the request, as well as for the reasons of the delay ". Finally, according to Article 15 of the GIP, the data subject has the right to receive confirmation from the controller of the whether or not the personal data concerning it exist processing. 2. Also, according to article 678AK "At the end of the contract o employee may require from the employer a certificate of the type and the duration of his work. Only if the employee specifically requests it is confirmed and the quality of his work and his conduct ". 3. In the present case, on the basis of what emerged from the hearing procedure and from the examination of the data in the file, the complainant Rhodes Municipal Transport Company "RODA", as responsible for processing, a) in violation of the provisions of article 5 par. 1 lit. c of the GKPD, granted to the complainant after his dismissal from the company, a certificate in which it was listed, apart from its type and duration and the information that he was dismissed due to a criminal act and b) against Violation of the provisions of Articles 12par.3 and 15 of the GCPD, never answered in writing to the complainant's request of 22.7.19 for a copy of the videotaped material recorded by his closed circuit television bus in the driver's seat on the day of the incident controversial incident on 23.2.20, tacitly dismissing it. Consequently, there is a violation of the above-mentioned provisions principle of proportionality (article 5 par right of access, as well as not being informed of his request complainant for access to data concerning him (articles 12 par. 3 and 15 ΓΚΠΔ). 5 4. In view of the above, the Authority, taking into account its weight infringement proved and the insult inflicted by it on complainant, considers that it should be imposed on the complainant in application of the provision of article 58 par. 2 ed. i) of the GCC effective, proportionate and a deterrent administrative fine, in accordance with Article 83 of the GIP 1. Because the violation found by the Authority of the provisions of Articles 5 par. 1 item c), 12 par. 3 and 15 GPA are subject to the cases of enforcement administrative fines of article 83 par. 5 ed. a 'and b' GKPD. FOR THOSE REASONS The beginning Imposes on the Municipal Transport Company of Rhodes "RODA", as responsible for reasons set out in detail in its rationale present, the proportionate and dissuasive administrative fine imposed appropriate to the case, according to the specific circumstances a) of five thousand (5,000.00) Euros, for the violation of the provisions of articles 12 par. 3 and 15 GPA and b) amounting to three thousand (3,000.00) Euros, for the violation of the provisions of article 5 par. 1 lit. c of the GCC, ie a total of the administrative fine of eight thousand (8,000.00) Euros. The Deputy Chairman The Secretary George Batzalexis Irini Papageorgopoulou 1 See OE29, Guidelines and the implementation and determination of administrative fines for the purposes of regulation 2016/679 WP253, p. 6 6