HDPA (Greece) - 40 /2025

HDPA - 40 /2025
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 31 GDPR
Type:	Complaint
Outcome:	Other Outcome
Started:	06.03.2023
Decided:	07.11.2025
Published:	07.11.2025
Fine:	n/a
Parties:	n/a
National Case Number/Name:	40 /2025
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Greek
Original Source:	HDPA (in EL)
Initial Contributor:	xz

The DPA held that, even though a complaint against a medical doctor, who had allegedly accessed medical files without authorization, was later withdrawn, his failure to cooperate with the DPA still justified issuing a reprimand.

English Summary

Facts

A, B, and C, the data subjects, lodged a complaint with the Greek Data Protection Authority (DPA) against a medical doctor, a controller. The controller was the estranged husband of one of the data subjects. They claimed that the controller illegally accessed their electronic medical records in the National Health System, even though the controller was not their treating physician and they had not given consent.

The DPA, repeatedly sent inquires to the controller to explain himself, and the controller ignored the DPA’s requests. During the DPA proceedings, the data subjects later withdrew the complaint. However, the DPA still had to evaluate the controller’s behavior regarding non-cooperation with the Authority.

Holding

The DPA ruled that regardless of the withdrawal of the complaint, the controller had failed to cooperate with the DPA thus violating Article 31 GDPR. As a corrective measure, the DPA issued a reprimand to the controller under Article 58(2)(b) GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

Athens, 7-11-2025 No. Prot. 3791 DECISION 40 /2025 The Personal Data Protection Authority, following the resignation of the President of the Authority, Konstantinos Menudoucos, on 25-6-2025, met at the invitation of its Deputy President, Georgios Batzalexis, via videoconference on Wednesday, October 22, 2025, in order to examine the case referred to in the history of this case. The Deputy Chairman of the Authority, Georgios Batzalexis, the alternate members of the Authority, Maria Psalla and Dimosthenis Vougioukas, in place of the regular members Grigoriou Tsolias and Konstantinos Lambrinoudakis, who, although legally summoned, did not attend due to impediment, as well as the alternate member of the Authority, Nikolaos Livos, as rapporteur without the right to vote. Present without the right to vote were the auditor - lawyer Anastasia Tritaki, as assistant rapporteur, and the employee of the administrative affairs department Irini Papageorgopoulou, as secretary. The Authority took into account the following: By the no. In the complaint of the Authority C/ΕΙΣ/1635/06-03-2023, the complainants: 1) A, 2) B, 3) Ccomplained before the Authority against the doctor D, the estranged spouse of the complainant under 1) (since March 2022), for unlawful access to personal data concerning them. Specifically, the complainants state that the complainant gained access to their Personal Electronic Health Record, without having the status of their treating physician and without their consent, as follows: 1) Regarding A, on 15-11-2022, 20-11-2022 and 07-12-2022. 1 Kifissias Ave. 1-3, 11523 Athens T: 210 6475 600 E: contact@dpa.gr www.dpa.gr 2) Regarding B, on 15-11-2022 and 07-12-2022. 3) Regarding C, on 15-11-2022. The Authority, in the context of examining the above complaint, with its document with the no. of the Authority's prot. G/EX/1429/06-06-2023, invited the complainant to present his views on it. Due to the lack of response to the above document, the Authority sent to the complainant the no. Authority's prot. G/EX/2966/23-11-2023 reminder document via email, as well as Authority's prot. G/EX/876/14-03-2024 reminder document, via registered letter (which, as appears from the data kept in the Protocol, was not returned to the Authority as undelivered), reminding with both of the above documents, the obligation to cooperate with the Authority under article 31 GDPR. Subsequently, due to the continued lack of response from the complainant, the Authority with the no. The Authority, by document no. G/EX/648/21-02-2025, requested the assistance of the competent Police Department of area X for the re-service of the above documents to the defendant, who re-served the above documents to the defendant on 12/03/2025 (proof of service with document no. G/EIS/2068/12-03-2025). Following the examination of the file, the Authority sent the document no. G/EX/1872/29-05-2025 summons for hearing to the defendant and the document no. Authority's prot. G/EX/1871/29-05-2025 to the complainants, in order to attend, via videoconference, a hearing before the Department of the Authority on Wednesday, June 11, 2025 at 10.30 a.m. regarding the discussion of the above complaint, as well as the non-cooperation of the complainant with the Authority, in accordance with Article 31 GDPR. During the hearing on Wednesday, June 11, the complainant A was present and requested a postponement of the hearing due to the impediment of her attorney, Dimitra Sidera, which was accepted, while the complainant did not attend. The Authority then summoned the parties again for a hearing before a Department of the Authority on Wednesday, July 9, 2025 at 10:00 a.m., the complainants with the Authority's original summons number G/EX/2349/30-06-2025, and the respondent with the Authority's original summons number Γ/ΕΞ/2351/30-06-2025 summons, which was served on him on 2/7/2025 with the assistance of Police Department 2 of area X. During the hearing on Wednesday, July 9, complainant A appeared and requested a postponement of the hearing again due to the impediment of her attorney, Dimitra Sidera, while the defendant appeared through the attorney of Ariadne Nouka, who consented to the said request, which was ultimately accepted by the Authority. Following this, the Authority again summoned the parties to a hearing before the Department of the Authority on Wednesday, July 23, 2025 at 10:00, the complainants with the no. Prot. Authority G/EX/2498/14-07-2025 summons, and the defendant with the no. Prot. Authority G/EX/2500/14-07-2025 summons. During the above hearing, the complainant under 1) A appeared with the power of attorney of Dimitra Sidera (AM Board of Directors …), and the complainants under 2) and 3) B and C appeared with the same power of attorney of their lawyer as above, while the defendant appeared with the power of attorney of Ariadnis Noukas (AM Board of Directors …). The complainants during the above hearing and with the no. prot. C/ΕΙΣ/7146/29-07-2025 following the hearing of their memorandum, they further developed the allegations they previously raised before the Authority and added, among other things, that the defendant was never their personal physician, while after the period of interruption of his cohabitation with the complainant under 1), he never informed or received relevant permission from the complainants regarding his access to their medical files. They added, however, that following the consensual dissolution of the marriage of the complainant under 1) with the defendant, and the settlement of the issues concerning their common child, the complainants under 1), 2) and 3) wish to withdraw the complaint as an indication of their willingness to have a good climate with the defendant and with the legitimate interest of the common child in mind. The defendant, during the above hearing, claimed that his access to the complainants' medical file took place in order to check whether there was evidence of illness, in cases where the complainants would invoke illness in order, according to his allegations, to deny him communication with his child. For the said acts, defendant 3 claimed that he has apologized to the complainants with a private contractual document and has promised not to repeat the acts in the future. When asked about the lack of response to the Authority's calls for clarification, the defendant admitted that he received the aforementioned calls, however, he cited a poor psychological state, as well as being busy with other legal proceedings, given that a lawsuit and a report to the medical association had been filed against him by the complainants for the disputed acts of access to their medical file. The defendant did not file a memorandum following the hearing. The Authority, after examining the elements of the file and what emerged from the hearing before it and the memoranda of the parties, after hearing the rapporteur and the clarifications from the assistant rapporteur, following a thorough discussion, DECIDED IN ACCORDANCE WITH THE LAW 1) Because it follows from the provisions of articles 51 and 55 of the General Data Protection Regulation (Regulation 2016/679) and article 9 of law 4624/2019 (Government Gazette A' 137) that the Authority has the competence to supervise the implementation of the provisions of the GDPR, law 4624/2019 and other regulations concerning the protection of individuals from the processing of personal data. In particular, from the provisions of articles 57 par. 1 letter f of the GDPR and 13 par. 1 letter g of law 4624/2019, it follows that the Authority has the competence to handle the alleged complaint, as it concerns the subject's access to personal data, including in an archiving system within the meaning of article 4 letters 1) and 6) of the GDPR. Therefore, this is processing falling within the regulatory scope of articles 2 par. 1 of the GDPR and 2 of law 4624/2019. 2) Because according to Article 57(1) GDPR: “Without prejudice to the other tasks laid down in this Regulation, each supervisory authority in its territory shall: (..) f) handle complaints submitted by the data subject or by a body, organisation or association in accordance with Article 80 and investigate, to the extent appropriate, the subject matter of the complaint (…)”, while according to Article 77(1) GDPR: “Without prejudice to any other administrative or judicial remedy, each data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which he has his habitual residence or place of work or the place of the alleged infringement, if the data subject considers that the processing of personal data concerning him infringes this Regulation.” It follows from the provisions of Article 57(1)(a) of the GDPR that the Authority is responsible for handling complaints submitted by the data subject pursuant to Article 77 of the GDPR and for investigating, to the extent appropriate, the subject matter of the complaint. According to the case law of the Court of Justice of the European Union, the competent supervisory authority responsible for monitoring compliance with EU rules on the protection of personal data investigates the subject matter of the complaints to the extent necessary and with due diligence. It follows from the above that in cases of complaint submission, the subject matter and scope of the Authority's control regarding compliance or non-compliance with the rules on the protection of personal data is limited and specified to the extent necessary, based primarily on the subject matter of the complaint. Furthermore, any obligation on the competent national authorities to examine the entire compliance of the natural or legal person being checked, regardless of the content of the data subject's complaint, would entail a disproportionate administrative burden for these Authorities. Otherwise, the data subject would not need to submit a complaint with specific content regarding the violation of his rights but would request the Authority to proceed with a full compliance check of each controller.

1
UF (C-26/22), AB (C-64/22) v Land Hessen, represented by: SCHUFA Holding AG, judgment of
07.12.2023, para. 56, TR v Land Hessen (C-768/21), judgment of 26.9.2024, para. 32,
Maximillian Schrems v Data Protection Commissioner, represented by: Digital Rights
Ireland Ltd (C-362/14), judgment of 06.10.2015, para. 63 and Data Protection Commissioner
v Facebook Ireland Ltd, Maximillian Schrems, represented by: The United States of America,
Electronic Privacy Information Centre, BSA Business Software Alliance Inc., Digitaleurope (C-311/18),
judgment of 16.7.2020, para. 109).
2DIE C-92/09 and C-93/09, judgment of 09.11.2010, paragraph 87 final paragraph).
53) Whereas, in accordance with Article 31 GDPR: “The controller and the processor and, where applicable, their representatives shall cooperate,

upon request, with the supervisory authority for the performance of its tasks”.
This provision introduces a general obligation for each controller to

cooperate with the supervisory authority when a relevant request is submitted in the performance of the tasks assigned to it by the European legislator, while

a breach of its fulfilment automatically entails the imposition of the administrative

fine referred to in Article 83(4)(a) GDPR. It is noted that this obligation

together with the principle of accountability of Article 5 par. 2 GDPR strengthens the role of

the Supervisory Authority in exercising its powers towards the realization of

the purpose of the effective implementation of the personal data protection rules

3
.

4) Because both during the hearing before the Department of the Authority on 23-7-2025, and
with the no. In the case of the Authority G/EIS/7146/29-07-2025 following the hearing of the memorandum, the complainants stated that, following the consensual resolution of the marriage of the complainant under 1) with the respondent, and the settlement of the issues concerning their common child, all complainants wish to withdraw the complaint as an indication of their willingness to maintain a good atmosphere with the respondent and in the interests of the common child. Taking into account the complainants' withdrawal from the case of the Authority G/EIS/1635/06-03-2023 and the considerations set out in paragraph 2), the Authority considers that the above complaint should be dismissed. 5) Because, with regard to the lack of cooperation of the accused with the Authority, the

accused invoked during the hearing a bad psychological state,

as well as his employment in parallel legal proceedings against him

as a lawsuit and a report have been submitted in parallel before the medical

association, for the disputed data processing operations. However, these allegations
were not sufficiently substantiated before the Authority, since no

3See. Decisions of the Authority 33/2021, section 9, 28/2022, section 8.
4In accordance with article 3 par. 2 of Law 2690/1999.

6 no relevant document, while taking into account the number of calls and

documents sent to the complainant by the Authority and the

extensive period of time that elapsed from the sending of the first document in chronological order (06-06-2023) until his summons to a hearing, the

allegation in question cannot justify the lack of any

response on his part to the Authority's requests.

6) Following the above, a violation of Article 31 GDPR regarding cooperation with the

Authority is established by the complainant. The Authority considers that in relation to the above violations, there is a case for
exercising its corrective powers in accordance with Article 58(2) of the GDPR,

as well as recital 148 of the GDPR.

Based on the above, the Authority unanimously decides that the administrative sanction referred to in the operative part

that is appropriate in this specific case, in accordance with the

specific circumstances of this case, should be imposed on the accused controller.

FOR THESE REASONS

The Authority

a) sets the no. proc. Authority C/EIS/1635/06-03-2023 complaint on file and
b) finds that the complainant has violated his obligation under Article 31

GDPR to cooperate with the supervisory authority in the exercise of its

duties, for which he addresses a reprimand to the complainant, under

Article 58paragraph 2b) GDPR, for the reasons extensively analyzed in the reasoning of

this.

The Acting President The Secretary

Deputy President

Georgios Batzalexis Irini Papageorgopoulou

7