Υπουργείου Υποδομών και Μεταφορών – No Violation (Greece, 2026)

The DPA started an investigation, after receiving 83 complaints from data subjects, against the Ministry of Infrastructure and Transportation (the controller). Particularly, regarding the sending of an SMSs, prior to the national holiday on October 28th, to mobile phone subscribers (the data subjects) without prior information or consent. The complaints included: * The violation by the controller of Article 14 GDPR as the data subjects were not priorly informed that their phone numbers would be processed for this purpose, leaving them without information and the subsequent right to object. * The processing of all mobile phone subscriber’s data regardless of whether they are drivers. Contrary to the principle of purpose limitation and data minimisation. * The wrong application by the controller of legal basis, that is, processing for the public interest. Claiming that the controller lacks the jurisdiction for the purpose of raising awareness to also process personal data. * The fact that the controller should have initiated the procedure through the Ministry of Digital Governance, which applies to the citizens which have consented to the sending of messages by public agencies. * The data subjects claimed that the controller actually was the Ministry of Data Governance, and the mobile phone companies which ultimately sent out the message acted as processors. In that regard, such a relationship should have been governed by contract, however the controller (in the present case) was unable to present such to the DPA. The controller clarified that the purpose of this campaign was as a preventative/awareness-raising tool within its broader safety strategy, and based in accident statistics. The transmission of the SMSs was carried out by mobile phone operators, in cooperation with the controller, without disclosing the data to the controller. Such communication was authorised by national law which allowed for processing beyond the purpose for which the data was collected when necessary to protect national security and public safety. In that regard, processing was carried out in accordance with Article 6(1)(e) GDPR. The controller deemed sending SMSs as the appropriate communication method which is non-intrusive, immediate and universally accessible. Finally, in light of the national holiday on the 28th of October there was an increased risk, rendering the implementation of such SMSs necessary and proportionate to protect human life. The DPA held the processing activities of the controller in compliance with the principles of lawful processing pursuant to Article 5(1) GDPR. Particularly, as a result of the increased risk posed by the national holiday, the DPA found it necessary to take action raise awareness for drivers regarding road safety, and deemed the means, immediately through SMS, appropriate. The DPA further found that in light of proportionality and data minimisation, the one-time notification without the controller gaining access to the data subject’s personal data was compliant. As regards the legal basis, the DPA agreed with the controller, that they were pursuing a public interest, namely to promote road safety and safe mobility. Similarly, the DPA held that national law permits private entities to process data for purposes beyond that for what it was originally collected, provided it prevents threats to public safety and is made at the request of a public authority. Therefore, the DPA held that the sending of this SMS was lawful and in compliance with the GDPR. Nonetheless, it advised the controller, for future initiatives, to inform data subjects in accordance with Article 14 GDPR, provide them an option to opt-out. Furthermore, when such messages are outsourced to processors, to ensure such is established through a contract (defining nature and purpose of processing, and type of data and categories of data subjects) in accordance with Article 28 GDPR, and to subsequently inform data subjects of such.