- Enforcing jurisdiction
- Greece · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2/2022 – Complaint Upheld (Greece, 2022)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Hellenic Data Protection Authority upheld a complaint against Greece's Ministry of National Defense for including unnecessary details in a military status certificate. This ruling matters because it emphasizes the need for organizations to limit the information they collect and share. Companies should only collect data that is necessary for their purposes.
What happened
The Ministry of National Defense included excessive information in a military status certificate.
Who was affected
A person requesting a military status certificate was affected by the unnecessary details included.
What the authority found
The Hellenic Data Protection Authority ruled that the Ministry violated the principle of data minimization under GDPR.
Why this matters
This decision sets a precedent for limiting data collection to what is strictly necessary. Organizations should review their data practices to ensure compliance with data minimization principles.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject complained to the Ministry of National Defense that his military status certificate ("Type A Certificate") mentioned that he "has not fulfilled his military obligations and is currently under no military obligation because he is exempt from military service". The Ministry of National Defense rejected the complaint. As a result, the data subject lodged a complaint with the HDPA (Greece). The HDPA upheld the complaint and held that Ministry of National Defense violated the principle of dataminimisation under Article 5(1)(c) GDPR. It reasoned that the Type A Certificate's general purpose is to only certify that the holder is not subject to military obligations. As long as there are no special circumstances which require the certificate to mention further information, the certificate's purpose is achieved by just mentioning the name of the holder. Special circumstances may be the particular objectives which the applicant pursues with the certificate or legal provisions requiring additional information. Since no special circumstances existed, the Ministry of National Defense violated Article 5(1)(c) GDPR.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2/2022 in GR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2/2022 - Greece (2022). Retrieved from cookiefines.eu
Last updated: