Hellenic SA: Imposition of a Fine and Order to Comply Following a Leak Of Expats’ Personal Data File

On September 2, 2024, the European Data Protection Board ("EDPB") published an announcement on its official website that the Hellenic Supervisory Authority (“Hellenic SA”) has completed its investigation into the unsolicited political communications related to the 2024 European elections. The investigation revealed significant data protection violations, resulting in substantial fines.

According to the announcement;

• The Hellenic SA received multiple complaints on 1 March 2024 regarding unsolicited political communications sent via email. These emails were connected to an initiative for the European elections and were allegedly distributed by one of the controllers. In response, the Hellenic SA conducted an in-depth investigation, exercising its powers to audit the entities involved.
• After a series of on-the-spot audits and review of the available evidence, it was discovered that a file containing the personal data of all registered expatriate voters for the June 2024 elections was unlawfully transferred outside the Ministry of the Interior. This data included email addresses and telephone numbers, which are explicitly prohibited from being shared outside the Ministry. The file was sent to a second potential controller, but the identity of the sender remains unidentified. The data was reportedly used for election result analysis.

As a result;

• The Hellenic SA imposed a fine of €400,000 on the Ministry of the Interior for violations of Articles 5, 25, 30, 32, and 33 of the GDPR. Additionally, the Ministry has been ordered to ensure that its processes comply with the GDPR within a specific timeframe. It was emphasized that the identified violations do not relate to the voting process itself.
• The second controller received a fine of €40,000 for breaching Articles 5, 6, and 14 of the GDPR and was instructed to delete the unlawfully processed data.
• As for the political party New Democracy and another potential controller involved, the Hellenic SA postponed issuing a final decision due to the need for further investigation.
• The public is invited to review the full decision, National Decision 16/2024, and submit their opinions by contacting the Hellenic SA.

You can access the full text of the announcement here.

You can access the Hellenic SA’s press release (in English) here.

Kind regards,
Zumbul Attorneys-at-Law
info@zumbul.av.tr