On September 2, 2024, the Hellenic Data Protection Authority (HDPA) announced that it had published its Decision No. 23/2024 as issued on the same date, in which it imposed an administrative fine of €30,000 on the National Center for Immediate Assistance (EKAB) for General Data Protection Regulation (GDPR) violations, following complaints.

Background to the decision

The HDPA noted that it received complaints from two citizens for violations of their right to access their recorded telephone calls to the EKAB's call center. During the investigation, the HDPA mentioned that it discovered that, as a general principle, EKAB does not grant copies of recorded calls on the grounds that it does not identify the callers to the call center and, therefore, is unable to identify them as the appropriate data subjects afterward.

Findings of the HDPA

The HDPA found that after the complainants exercised their right to access their recorded calls, the EKAB, as controller, did not respond to their request, did not inform the applicants of the reasons why it did not act on their request and did not ask for additional information to confirm their identity, but instead ignored the said request as repetitive, abusive, and incomprehensible, thereby violating Article 15(3) of the GDPR.

Furthermore, the HDPA found EKAB in violation of the transparency principle according to Article 13 of the GDPR by failing to inform data subjects via the website of its updated privacy policy.

Outcomes

In light of the above, the HDPA fined EKAB €20,000 for the data subject rights violation and €10,000 for its transparency obligation violation. The HDPA also ordered EKAB to:

• satisfy the data subject's request by providing copies of their recorded telephone conversations; and
• revise its privacy policy to satisfy the right to access of callers in a way that does not prevent, in advance, the exercise of Article 15 of the GDPR.

You can read the press release here and the decision here, both only available in Greek.