DPA case 7/2021 – Violation Found (Greece, 2021)

The Athens Bar Association (ABA), in the context of the upcoming elections of its representatives, asked the Hellenic Data Protection Authority (HDPA) whether they were allowed under the GDPR to provide the candidates with the names and contact details of the members of ABA. The main purpose was to allow those candidates to reach out to members of the ABA to share projects and ideas as part of the upcoming electoral campaign. After reviewing the facts of the case, the HDPA first stated that each candidate for the elections should be considered as a 'third party' in the sense of Article 4(10) GDPR in relation to the disclosure of the personal data by the ABA, and also as a separate controller in the sense of Article 4(7) GDPR when further processing the personal data of the members of the ABA. Regarding the lawfulness of the processing, the HDPA considered that the processing of personal data by the ABA for its own internal organisation is allowed under Article 6(1)(e) GDPR, in the sense that such processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. As a consequence, the HDPA decided that the ABA may generally process the personal data of its members when necessary for its organization, without having to obtain the prior consent of the individuals concerned. Regarding the sharing of members' personal data with candidates for the elections, the HDPA further considered that, even though the data subjects (i.e. ABA's members) did not specifically consent to this type of processing, it would still be permitted under the Article 6(4) GDPR, since such processing is compatible with the purpose for which the personal data were initially collected at the time each member registered with the ABA. In order for the sharing of the members' personal data with the elections' candidates to remain lawful, however, the HDPA specified that each candidate must grant to these mem