On November 18, 2024, the Hellenic Data Protection Authority (HDPA) announced that it had published its Decision 42/2024, as issued on the same date, in which it imposed an administrative fine of €56,000 on Nautical Club of Vouliagmeni (the Group) for General Data Protection Regulation (GDPR) violations, following a request to the HDPA.

Background to the decision

The HDPA noted that a member of the Group sent a request to the HDPA asking how to object to the processing of their biometric data after they were informed by the Group that the controlled entry-exit system would no longer be carried out by presenting a membership card to the security guard but by processing their biometric characteristics. The Group informed the member of this update without providing further information and justification for this measure. While the HDPA recognized that the request was outside of its competence, it announced that it investigated the matter ex officio due to the importance of the matter.

Findings of the HDPA

Following its investigation, the HDPA found the Group in breach of:

• Article 5(1)(a) of the GDPR for processing personal biometric data in a controlled entry system at its facilities in violation of the principle of legality;
• Article 35 of the GDPR for failing to carry out a Data Protection Impact Assessment (DPIA) of the new entry-exit system; and
• Article 38(3) of the GDPR for not appointing a data protection officer (DPO).

Outcomes

In light of the above, the HDPA imposed a €28,000 fine for violating Article 5(1)(a) of the GDPR, €14,000 for violating Article 35 of the GDPR, and €14,000 for violating Article 38(3) of the GDPR, totaling €56,000. The HDPA also ordered the Group to cease processing personal data through the biometric-controlled entry system until it has carried out a DPIA.

You can read the press release, only available in Greek, here.