Centre for speech therapy – €5,000 Fine (Greece, 2020)

The complainant requested twice via e-mail all data that the Centre as data controller held on his minor child. The controller refused to provide the data because of the complainant's ex-wife's (and mother's of his child) refusal. The controller argued that the mother had custody. The HDPA first asked the controller to immediately fulfill the complainant's request according to Article 15(1) and (3) GDPR and inform the authority accordingly. It invoked is own case law, according to which any parent who has parental responsibility of the child may have the right of access according to Article 15, even if they don't have custody, unless there is a specific court decisions ordering otherwise e.g. prohibition of communication with the child. The controller did not comply and it did not notify the HDPA of any decision it took with this regard. May a data controller refuse to fulfill the right of access without any response of a parent who exercise it on behalf of their minor child, if this parent has parental responsibility but not custody? The HDPA, as had initially decided, found that the controller should have fulfilled the complainant's right of access or should have justified its refusal to do so -especially after the HDPA's initial order. Thus, it found that the controller had violated Article 15 (1) and (3) as well as the principle of accountability as provided for in Article 5(2) GDPR.