- Enforcing jurisdiction
- Greece · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
DPA case 26/2023 – Dismissed (Greece, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A person requested access to a school database for genealogical research but was denied by the Directorate of Primary Education. The Greek Data Protection Authority dismissed the complaint, stating the request did not qualify under privacy laws. This highlights the limitations of accessing personal data for non-scientific research.
What happened
A person sought access to a pupil registration database for genealogical research.
Who was affected
The individual requesting access to the school database.
What the authority found
The Hellenic Data Protection Authority found that the request did not meet the criteria for accessing personal data under GDPR.
Why this matters
This ruling indicates that requests for genealogical research may not be protected under privacy laws, guiding individuals on what data access rights they have.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
On 5 August 2022, the data subject filed a complaint against the Directorate of Primary Education. The data subject wanted to conduct a genealogical investigation on his family surname. He sent an email to the Directorate of Primary Education (the controller), requesting access to their pupil registration database to search the entries of his surname therein. In addition, the data subject requested in his complaint that the Authority order the Directorate of Primary Education to allow him immediate research access to the books of the closed/abolished Primary School's curriculum, to research the surname entries in them. The controller replied that they were only able to provide him with numerical data (number of pupils per year) and not the names, as this would be an unlawful disclosure of personal data. The Authority dismissed the complaint, holding that there was no violation of the data subject's rights and that access requests for research purposes was not within the competence of the Authority to order. In particular, the Authority considered that his request to the controller (Directorate Primary Education) did not constitute an exercise of the right of access to personal data concerning him/her under Article 15 GDPR, but a request to carry out scientific research. On 26 October 2022, the data subject lodged an objection to the decision and a request for a review of his case, in which he alleged that his request was "not a request to carry out scientific research, but a personal genealogical research, which is far from scientific research and the data in the requested search concern him and thus fall under Article 15 GDPR." The DPA rejected the request for review. Genealogical research on a family surname did not fall within the scope of Article 15 GDPR, as "personal data concerning [the data subject]." The data subject's request was not an access request for the purposes of Article 15 GDPR. He requested access to the Directorate's entire database (conta
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 26/2023 in GR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 26/2023 - Greece (2023). Retrieved from cookiefines.eu
Last updated: