Vodafone Greece – ΠΑΝΑΦΟΝ Ανώνυμη Ελληνική Εταιρεία Τηλεπικοινωνιών – €22,000 Fine (Greece, 2026)

The data subject was a former employee of Vodafone – Panafon S.A. (the controller). The data subject had filed a lawsuit against the controller on November 2020 regarding a labour dispute between them. In that context, on 4 December 2020 the data subject had submitted an access request to the controller, under Article 15 GDPR. She aimed to access her personal data, including all emails sent from her corporate account and those in which she was listed as either the sender or the recipient. The controller had not provided the requested documents, stating that it had deleted them in 2016 within ninety days of the termination of the employment relationship and did not keep them in its records. The controller had further argued that the deletion of an employee’s email account upon their departure from the company cannot be extended to any sent messages that were scattered within and outside its organisation. On 12 January 2021 the data subject filed a complaint with the Greek DPA against the controller. The DPA issued the decision 19/2022 on this matter. The DPA reprimanded the controller for failing to notify the data subject in time about the extension of the deadline for responding to her access request. However, it did not order Vodafone to provide copies of the requested emails, finding that the data subject had not sufficiently specified which emails she sought and why they were necessary for the pending labour proceedings. On 9 February 2023, the data subject filed a request for reconsideration with the DPA, relying on new evidence. She submitted printouts of six emails which the controller had submitted to the court on 13 December 2022 during the labour proceedings, although it had previously stated that it no longer held such emails. Regarding the new submitted evidence, the controller argued that these did not originate from the data subject’s email account but from the email account of her former supervisor. The former supervisor claimed that, upon leaving the company in 2017, for sentimental reasons, he requested and received a copy of his corporate email correspondence, including emails in which he was either the sender or the recipient. He argued that he could not be considered a controller because he kept the entire archive of his correspondence in electronic form for purely personal use and therefore the household exemption applied in his case in accordance with Article 2(2)(c) GDPR. He claimed that he kept the contents of his corporate account in his personal files until 2022, at which point he forwarded part of that file, specifically six emails, to the controller so that it could use them in court as defence against the data subject’s claims. In addition, the former supervisor alleged that he retrieved and submitted these six emails to dispute specific allegations made by the data subject, which, as he contended, were defamatory toward him. He argued that using these emails was necessary to protect his overriding legitimate interest in safeguarding his honour and reputation, under Article 6(1)(f) GDPR. The controller also pointed out that the key difference compared to the data subject's case and her former supervisor' s was the timing of their requests. The data subject exercised her right five years after departure, by which time the data had already been deleted. In contrast, her former supervisor made his request upon the termination of his employment. Therefore, according to the controller, both requests were answered appropriately. Since some of the alleged violations occurred before the GDPR took effect on 25 May 2018, the DPA also considered Greek Law 2472/1997. This law had incorporated the EU Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and the free movement of such data into Greek law. The DPA acknowledged that the controller lawfully fulfilled the former supervisor’s access request by providing him with the contents of his corporate email account, since these also constituted his personal data under Law 2472/1997. However, it also held that as the emails also contained the data subject’s personal data and were disclosed to him as a third party after the end of his employment, the controller should have informed the data subject before the transfer, pursuant to Article 11(3) Law 2472/1997. The DPA further noted that the controller had enough time to inform the data subject about the six emails containing her personal data before the court hearing. The data subject only learned of this transmission after the emails were submitted to the court during the labour dispute. The DPA later assessed whether the former supervisor had acted as a separate controller for his own processing of the emails. It concluded that he was a separate controller regarding the collection and subsequent retention of the data subject's personal data. According to the DPA, as the file consisted of professional correspondence and was involved in litigation proceedings, it did not qualify as an "exclusively" domestic or personal activity pursuant to Article 2(2)(c) GDPR. The DPA further noted that the reason behind the data subject's former supervisor collection and retention of her personal data was to defend himself against any legal dispute regarding matters he had handled as a supervisor. The DPA acknowledged that this processing was based on his legitimate interest. It also ruled that the collection of the data in 2017 and the retention until 25 May 2018, was lawful under Article 5(2)(e) Law 2472/1997, while retention since then was based on the legal basis of Article 6(1)(f) GDPR. The DPA held that due to the fact that the supervisor, acting as a separate controller, did not inform the data subject about these actions at the time of collection in 2017 nor before transferring the six messages about her to the controller in 2022, he violated Article 11(1) Law 2472/1997 and Article 14(3)(c) GDPR. The DPA fined the controller €20,000 for the violation of Article 11(3) Law 2472/1997. It also fined the data subject’s former supervisor as a separate controller €2,000 for the violations of Article 11(1) Law 2472/1997 and Article 14(3)(c) GDPR.