Sign in

Info Other, enforcement EU

Hellenic DPA publishes decision on E.E.T.A.A. data breach involving Ministry of Social Cohesion and Family Affairs

Original title: Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs

Published
Source: edpb.europa.eu
Effective
Not stated
Deadline
Not stated
Framework: GDPR
Regulation (EU) 2016/679 (as corrected 2018) source
in 14 days
Indicative European Parliament plenary date (first reading) for the small mid-caps omnibus, COM(2025) 501, which would raise the Article 30 records exemption to organisations under 750 employees - a forecast, not a fixed date source

Why it matters

The Hellenic Data Protection Authority issued a decision on a major data breach affecting E.E.T.A.A.'s information systems used by the Ministry of Social Cohesion and Family Affairs, which exposed identification, contact, financial, and health data of numerous data subjects. While the Ministry complied with breach notification obligations to the Authority and affected individuals, the DPA found that E.E.T.A.A.'s use of outdated systems and inadequate security measures directly enabled the attack. The DPA imposed administrative fines totalling EUR 350,000 (EUR 200,000 on the Ministry; EUR 150,000 on E.E.T.A.A.) and ordered both parties to execute a data processing agreement under Article 28 GDPR and implement comprehensive security improvements.

What changed

  • Decision page now includes 'Key words: Fines, Data subject rights' metadata field following the 'Decision' section
  • Complete decision text and compliance order details have been added to the page, including specific information about the EUR 200,000 fine for the Ministry and EUR 150,000 fine for E.E.T.A.A.
  • Page now specifies the requirement for parties to enter into a data processing agreement pursuant to Article 28 GDPR and fully implement planned security measures
  • Legal reference to Article 34 GDPR (Communication of a personal data breach to the data subject) has been explicitly included in the decision summary
  • Decision includes findings on infringements of Article 32 GDPR (Security of processing) and Article 28 GDPR (Processor obligations) with details on outdated systems and inadequate security measures

Who is affected

Data controllers and processors in the EU public sector, particularly those processing sensitive personal data (financial and health information); government agencies using third-party processors for information systems; E.E.T.A.A. S.A. and similar processor entities responsible for maintaining adequate security measures.

What to do

Open the official document

AI-assisted summary of the official document; the official text prevails. Not legal advice.

More changes in GDPR