DPA case 50_2024 – Complaint Upheld (Greece, 2024)

The doctor, here the controller, had posted pictures of his former patient on Instagram without hiding distinguishing features. Before undergoing treatment with the controller, the data subject had signed a data processing agreement stating that the processing would take place exclusively for medical and scientific purposes. The controller had assured the patient that her data would only be processed for medical purposes. The data subject expressed that she did not want any of her photos published on the internet or social media. The controller’s office assistant then assured her that no photos would be published without her consent and that the pictures taken immediately before the surgery were for the controller’s own records. After the surgery, the controller again took pictures of the data subject at the post-operative check-up. The data subject alleges that she again expressly stated that she did not want any photos of her to be posted online. Following this appointment, one set of pictures taken of the data subject were posted on Instagram and Facebook. The data subject’s face was not visible but other identifying features were and the operation was described in detail. The data subject in response, contacted the office assistant and asked for the photos to be deleted. The photos were subsequently removed from social media. However, a few months later the controller again uploaded the pictures to social media, allegedly by mistake. The data subject filed a complaint with the Hellenic Data Protection Authority (Αρχή προστασίας δεδομένων προσωπικού χαρακτήρα) on the 12 June 2023 alleging that her doctor had processed her personal data unlawfully. The data subject alleged violations of Articles 17, 18 and 21 GDPR. The controller brought forward that the consent form which the data subject had signed specifically required consent to the publishing of pictures in which the patient cannot be identified. As the data subject could not be identified and the pi