- Enforcing jurisdiction
- Greece · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 40 /2025 – Order (Greece, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A medical doctor illegally accessed electronic medical records of three individuals, including his estranged wife, without their consent. The Greek Data Protection Authority found that the doctor ignored requests to explain his actions, which is a serious violation. This case shows that even medical professionals must respect patient privacy and cooperate with authorities.
What happened
A medical doctor accessed the electronic medical records of three individuals without their consent.
Who was affected
Three individuals, including the estranged wife of the doctor, were affected by the unauthorized access to their medical records.
What the authority found
The DPA ruled that the doctor failed to cooperate with the authority, violating GDPR rules.
Why this matters
This ruling highlights the need for professionals to respect privacy laws and cooperate with regulatory bodies. It serves as a warning that non-compliance can lead to reprimands, even if complaints are later withdrawn.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A, B, and C, the data subjects, lodged a complaint with the Greek Data Protection Authority (DPA) against a medical doctor, a controller. The controller was the estranged husband of one of the data subjects. They claimed that the controller illegally accessed their electronic medical records in the National Health System, even though the controller was not their treating physician and they had not given consent. The DPA, repeatedly sent inquires to the controller to explain himself, and the controller ignored the DPA’s requests. During the DPA proceedings, the data subjects later withdrew the complaint. However, the DPA still had to evaluate the controller’s behavior regarding non-cooperation with the Authority. The DPA ruled that regardless of the withdrawal of the complaint, the controller had failed to cooperate with the DPA thus violating Article 31 GDPR. As a corrective measure, the DPA issued a reprimand to the controller under Article 58(2)(b) GDPR.
Outcome
Order
A binding order requiring the controller to take specific action.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 40 /2025 in GR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 40 /2025 - Greece (2025). Retrieved from cookiefines.eu
Last updated: