- Enforcing jurisdiction
- Greece · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 2/2023 – Complaint Upheld (Greece, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A hotel made a photocopy of a guest's Covid-19 certificate without permission. The Greek Data Protection Authority found this processing of personal data was not justified. This case highlights the need for hotels and similar businesses to respect guests' privacy and follow data protection laws.
What happened
A hotel employee copied a guest's Covid-19 certificate despite the guest's objections.
Who was affected
The guest who was required to show their Covid-19 certificate at the hotel.
What the authority found
The Greek DPA concluded that the hotel did not have a valid reason for keeping a copy of the guest's vaccination certificate.
Why this matters
This case serves as a reminder for businesses to handle personal data carefully and only keep what is necessary. It reinforces the need for clear policies on data processing.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
When registering at the data controller's hotel, the data subject was required to present a Covid-19 certificate. The hotel employee made a photocopy of the certificate, despite the data subject's protests. The data subject considered the processing of their personal data to be unlawful and lodged a complaint with the Greek DPA. In the complaint, the data subject asked the following questions to the DPA: (i) whether the data controller had the right to retain a copy of the vaccination certificate; (ii) the number of persons that would have access to the certificate; (iii) the time that the certificate would be stored; and (iv) how the certificate would be deleted after the retention period. In view of the lack of direct response by the controller, the HDPA requested the information and reminded it of its duty of cooperation under Article 31 GDPR. The controller then replied that: (i) it informed the data subject as to specific measures adopted for the prevention of Covid-19 and as to the maintenance of records for public safety reasons, with the exception of data related to health; (ii) the copy of the vaccination certificate was made with the only purpose of keeping the Head of the Hotel's reception up to date as they were not there when the data subject arrived; (iii) the copy of the certificate was kept only for the necessary time period and was not shared with any third party, being immediately shredded upon the arrival of the Head of the reception; (iv) the employee was taken aback by the deletion request and refused to do so and during their stay in the hotel, the data subject did not the deletion of the copy again. Moreover, the controller claimed that at the time of the processing there were strict regulations requiring the presentation of the certificate as a condition to gain access to indoor places. The Greek DPA stressed that the existence of a legal basis for the processing of personal data does not relieve the data controller of the obligation to com
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2/2023 in GR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2/2023 - Greece (2023). Retrieved from cookiefines.eu
Last updated: