DPA case 31/2024 – Complaint Upheld (Greece, 2024)

On 07 October 2022, the data subject filed a report with the Municipality of Metamorfosi (the controller) about a sidewalk obstruction caused by a gate mechanism at a specific property. The controller contacted the property owner requesting to remove the illegal sidewalk obstruction. The data subject later discovered that the controller had disclosed their name and address to the property owner involved in the complaint, prompting the data subject to file a complaint with the Greek DPA. The DPA reaffirmed its prior stance ([https://www.dpa.gr/el/enimerwtiko/prakseisArxis/prosbasi-kataggellomenoy-se-stoiheia-kataggellontos-sto-plaisio Decision 73/2010]) that in case individuals are accused of illegal conduct, they have a right to access the respective file, which may include personal data of the individual reporting the illegal conduct, in this case the data subject. However, in this case, the DPA found that the Municipality disclosed the data subject’s personal information on its own initiative, without a request from the property owner. This disclosure was deemed unnecessary and unlawful, falling outside the GDPR's fundamental principles for data processing (lawfulness, fairness and transparency, Article 5(1)(a) and data minimisation, 5(1)(c) GDPR). As a result, the Greek DPA issued a reprimand to the controller.