DPA case 24/2022 – €35,000 Fine (Greece, 2022)

The first complaint concerned a breach of the provisions concerning the control of the computer during the data subject's work and the second complaint concerned the failure to comply with the right of access. The employer (the controller) processed personal data of the employees on the basis of their contractual relationship and, in exercising its managerial right for the proper functioning of the organisation. The DPA stated that employees have a reasonable expectation of privacy in a workplace, which is not removed by the fact that they use equipment, communications devices or any other professional facilities and infrastructure (e.g. electronic communications network, Wi-Fi, corporate e-mail addresses, etc.) of the employer. The fact that the public employer may be the owner of the means of electronic communication (e.g. computers) does not lead to a a denial of the employees' right to data protection. According to the DPA, the controller was entitled to exercise control over the electronic means of communication provided to the employees for their work, provided that the relevant processing, was subject to the principle of proportionality, necessary for the fulfilment of the legitimate interest of the interest it pursues and provided that this clearly outweighs the rights and interests of the worker, without prejudice to the fundamental rights and interests of the worker, and their fundamental freedoms. In conclusion, the DPA found an infringement of, among others, the principles of legality, transparency and security under Article 5(1)(a) and (f) GDPR, and Article 32(1)(2) GDPR, as well as failure to satisfy the right of access. The DPA imposed a €35,000 fine on the controller.