Severity: Info Other, enforcement GR
Authority imposes fine on company for GDPR violations
Original title: Επιβολή προστίμου σε εταιρεία για παραβίαση των αρχών νομιμότητας επεξεργασίας, διαγραφή δεδομένων, μη ικανοποίηση δικαιώματος πρόσβασης και πλημμελή λήψη τεχνικών και οργανωτικών μέτρων ασφάλειας επεξεργασίας των προσωπικών δεδομένων εργαζομένου.
- Published
- Source: dpa.gr
- Effective
- Not stated
- Deadline
- Not stated
- Framework: Greece data protection law
- Law 4624/2019 (as last amended by Law 5221/2025) source
Why it matters
The Data Protection Authority imposed a fine on a company for GDPR violations concerning the processing of employee personal data. The company violated the principles of lawfulness of processing, did not implement required technical and organizational security measures, failed to delete data when required, and did not satisfy the employee's right of access. This decision enforces compliance with the obligations set out in the GDPR for the protection of personal data.
What changed
- Imposed a fine on a company for violating the principles of lawfulness in processing employee personal data
- Identified a violation of the employee's right of access, as the company failed to satisfy the right of access to their personal data
- Found a violation of the data deletion obligation and determined that the company did not delete data that was no longer necessary
- Established that the company did not implement appropriate technical and organizational security measures to protect the employee's personal data
Who is affected
Companies processing employee personal data in Greece
What to do
AI-assisted summary of the official document; the official text prevails. Not legal advice.