HDPA (Greece) - 39/2025
| HDPA - 39/2025 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 12(3) GDPR Article 12(4) GDPR Article 15(1) GDPR Article 31 GDPR Article 58(2)(c) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 01.03.2025 |
| Decided: | 17.12.2025 |
| Published: | 31.12.2025 |
| Fine: | 4,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 39/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Apostolos Karasakalidis |
The DPA fined a private tutoring centre €4,000 for non-compliance with a parent’s request to access personal data concerning his two minor children and for the lack of cooperation with the DPA during the investigation.
English Summary
Facts
A father exercising parental responsibility (the data subjects' father) contacted a private tutoring centre, the controller, requesting copies of tax receipts relating to tuition fees paid for his two minor children, who were students at the centre (the data subjects). In addition, the applicant asked for a certificate demonstrating the amounts paid within the period from September 2024 to February 2025.
The controller answered that the requested receipts, pursuant to its internal policy, had already been sent to the email address of the data subjects' mother and advised the data subjects' father to receive them from her. Following this answer, the data subjects' father repeated his request, but the controller did not provide the documents in question. Subsequently, the applicant lodged a complaint with the Greek Data Protection Authority (DPA).
During the investigation, the DPA attempted several times to inform the controller about the complaint via email and registered letters. As the communications remained unanswered and the letters were returned unclaimed, the complaint was ultimately served through the police authority. However, the controller did not submit any response. In its defense, the controller mentioned that it had asked the data subjects' father to appear in person to verify his identity and that the documents were finally sent to him after the involvement of the DPA.
Holding
The DPA held that the data subjects' father, as a parent exercising parental responsibility, was entitled to exercise the right of access on behalf of his minor children.
First, the DPA ruled that the controller did not satisfy the data subjects' father’s access request fully and promptly, thereby violating Article 15(1) GDPR in conjunction with Article 12(3) and (4) GDPR.
Second, the DPA found that the controller failed to collaborate effectively and in good faith with the Authority during the investigation process, in violation of Article 31 GDPR.
Consequently, the DPA imposed a fine of €2,000 on the controller for each of the two above mentioned violations and ordered the latter to satisfy the data subjects' father's access request fully, in accordance with Article 58(2)(c) GDPR.
Comment
The decision confirms the HDPA’s established case law according to which a parent exercising parental responsibility may exercise the right to access on behalf of their minor children, unless a court decision provides otherwise.
The Authority has established this interpretation through various decisions (e.g., HDPA Decisions 24/2009, 21/2010, 22/2010, 53/2010, 130/2013, 18/2018, 4/2020, 26/2021).
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Summary The Authority examined a complaint against a daycare center (data controller) regarding the non-fulfilment of the right of access exercised by a father on behalf of his minor children, while it examined ex officio the non-cooperation of the aforementioned data controller with the Authority. The Authority considered that the complainant's right of access was not fully satisfied by the daycare center in question, while as regards its general conduct towards the Authority, the data controller showed absolutely no willingness to cooperate with the Authority by providing clarifications regarding the said complaint. In view of the above, the Authority found a violation of the right of access of Article 15, paragraph 1 of the GDPR, in conjunction with the provisions of paragraphs 3 and 4 of Article 12 of the GDPR, as well as a violation of the independent obligation of the respondent as controller to cooperate with the supervisory authority as defined in Article 31 of the GDPR and imposed on the respondent (tuition center) the effective, proportionate and dissuasive administrative fine appropriate to the specific case, in accordance with its specific circumstances, of two thousand (2,000) euros for the above-identified violation of Articles 15, paragraph 1 of the GDPR and 12, paragraphs 3 and 4 of the GDPR, in accordance with Articles 58, paragraph 2, letter i' and 83, paragraph 5, letter i'. b GDPR and in the amount of two thousand (2,000) euros for the above-identified violation of Article 31 GDPR, in accordance with Articles 58 par. 2 letter i and 83 par. 4 letter a GDPR, while at the same time it instructed the company complained about, in accordance with Article 58 par. 2 letter c of the GDPR, to examine the complainant's exercised right of access and to fully satisfy it as set out in the above considerations.
