Complainant – €2,000 Fine (Greece, 2026)

The complainant, an electrical engineer, submitted a complaint to the Hellenic DPA on 26-03-2024 after the Decentralized Administration of the Aegean refused her requests to remove her name from eleven administrative decisions published on the Diavgeia portal (open-government platform that publishes official public sector decisions and expenditures online). These decisions concerned the rejection of applications submitted by third parties for drilling and water-use permits, where the complainant acted as an authorized representative or engineer. According to the complaint: -The published decisions explicitly identified the complainant by name and referred to her role as the authorized representative of the applicants. -The decisions stated that requested supporting documents had not been submitted and that no response had been received from the authorized representative or the applicants within the prescribed deadlines. -The complainant argued that she had never consented to the publication of her personal data and that the wording of the decisions created the false impression that the permit applications were rejected because of her professional inadequacy, thereby harming her professional reputation. -On 24-05-2023 and through subsequent requests, she exercised her right to erasure and requested the removal of her name from the published decisions. The Administration rejected those requests, maintaining that publication was legally required by the legislation governing Diavgeia and that the GDPR right to erasure did not apply. During the DPA proceedings, the Administration argued that the publication served the objective of public-sector transparency and that the complainant's name was necessary for adequately explaining the reasons for rejecting the permit applications. The Hellenic DPA held that the publication of the complainant's personal data in the eleven decisions was unlawful. According to Article 76(3)(k) of Law 4727/2020, only individual administrative acts whose publication is expressly required by a specific legal provision may be uploaded to Diavgeia. The Administration relied on Article 4(10) of Joint Ministerial Decision 146896/2014, which requires publication of decisions granting water-use and water-resource permits. However, the Authority found that this provision applies only to granted permits and not to decisions refusing permit applications. Therefore, the eleven rejection decisions were not legally required to be published on Diavgeia. As a result, the Administration could not rely on Article 6(1)(c) GDPR (processing necessary for compliance with a legal obligation), and the publication lacked a valid legal basis. The Authority therefore found a violation of the principle of lawfulness under Article 5(1)(a) GDPR and Article 6(1)(c) GDPR. The DPA further held that the Administration unlawfully refused the complainant's erasure requests. Since the processing itself was unlawful and the Administration failed to demonstrate any exception under Article 17(3) GDPR, it should have removed the complainant's name from the decisions or otherwise anonymized the information. Its failure to do so constituted a violation of Article 17(1)(d) GDPR. Consequently, the Hellenic DPA: -Imposed a €2,000 administrative fine on the Decentralized Administration of the Aegean for violating Articles 5(1)(a) and 6(1)(c) GDPR; -Issued a reprimand for violating Article 17(1)(d) GDPR; -Ordered the Administration to immediately remove the eleven decisions from Diavgeia and report compliance to the Authority within 20 days.