Sign in

Hellenic DPA fines Ministry and processor for data breach involving outdated systems and inadequate security

Original title: Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs

Info Other, enforcement EU

The Hellenic Data Protection Authority issued administrative fines totalling EUR 350,000 following a large-scale personal data breach affecting the Ministry of Social Cohesion and Family Affairs and its processor E.E.T.A.A. S.A., which compromised identification, contact, financial and health data of numerous data subjects. While the controller properly notified the breach, the DPA found that the processor continued using outdated information systems and inadequate security measures despite awareness of risks, violating Article 32 GDPR requirements and Article 28 GDPR processor obligations. The Ministry must now enter into a proper data processing agreement with the processor and implement planned security remediation measures.

What changed

  • EUR 200,000 administrative fine imposed on the Ministry of Social Cohesion and Family Affairs for security and processor agreement deficiencies
  • EUR 150,000 administrative fine imposed on E.E.T.A.A. S.A. for continued use of outdated information systems and inadequate security measures despite known risks
  • Compliance order requiring the Ministry and E.E.T.A.A. to enter into a data processing agreement compliant with Article 28 GDPR
  • Requirement to fully implement planned security measures to remediate the vulnerabilities that enabled the breach
  • Finding that while the controller met notification obligations under Articles 33-34 GDPR, the processor failed to maintain adequate technical and organisational measures under Article 32 GDPR

Who is affected

Public sector controller (Ministry of Social Cohesion and Family Affairs) and its processor in Greece; affects data subjects whose identification, contact, financial and health data was compromised in the breach

Summary generated by a language model; the official text prevails. Not legal advice.

More changes in GDPR