DPA case 39/2025 – €4,000 Fine (Greece, 2025)

A father exercising parental responsibility (the data subjects' father) contacted a private tutoring centre, the controller, requesting copies of tax receipts relating to tuition fees paid for his two minor children, who were students at the centre (the data subjects). In addition, the applicant asked for a certificate demonstrating the amounts paid within the period from September 2024 to February 2025. The controller answered that the requested receipts, pursuant to its internal policy, had already been sent to the email address of the data subjects' mother and advised the data subjects' father to receive them from her. Following this answer, the data subjects' father repeated his request, but the controller did not provide the documents in question. Subsequently, the applicant lodged a complaint with the Greek Data Protection Authority (DPA). During the investigation, the DPA attempted several times to inform the controller about the complaint via email and registered letters. As the communications remained unanswered and the letters were returned unclaimed, the complaint was ultimately served through the police authority. However, the controller did not submit any response. In its defense, the controller mentioned that it had asked the data subjects' father to appear in person to verify his identity and that the documents were finally sent to him after the involvement of the DPA. The DPA held that the data subjects' father, as a parent exercising parental responsibility, was entitled to exercise the right of access on behalf of his minor children. First, the DPA ruled that the controller did not satisfy the data subjects' father’s access request fully and promptly, thereby violating Article 15(1) GDPR in conjunction with Article 12(3) and (4) GDPR. Second, the DPA found that the controller failed to collaborate effectively and in good faith with the Authority during the investigation process, in violation of Article 31 GDPR. Consequently, the DPA imposed