Organization of Urban Transport of Thessaloniki (OASTH) – €10,000 Fine (Greece, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Organization of Urban Transport of Thessaloniki was fined for publicly sharing personal details of former shareholders. This included their names and financial information, which was then widely circulated. The case stresses the importance of protecting personal data, even during public disputes.
What happened
OASTH disclosed personal information of former shareholders during a press conference and in a press release.
Who was affected
Former shareholders of OASTH whose personal and financial details were made public.
What the authority found
The Hellenic Data Protection Authority fined OASTH for failing to protect personal data, violating GDPR's transparency and data protection rules.
Why this matters
This ruling highlights the importance of safeguarding personal data, even in contentious situations. Organizations should be cautious about sharing personal information publicly, especially during disputes.
GDPR Articles Cited
National Law Articles
Entities Involved
The Organization of Urban Transport of Thessaloniki (OASTH) was one of the largest transport company in Greece. A few months before OASTH entered in insolvency proceedings, employees of the city of Thessaloniki organized strikes during several days. Those strikes were organized, inter alia, to protest against the fact that dividends had been paid to shareholders, while some due salaries had not been paid to employees. This strike was a central political issue not only for Thessaloniki but also for the entire country. Two years after having been acquired by the Greek State, OASTH remained at the center of many political debates. Aware of this, the President of OASTH decided to implement a policy of transparency towards the public. In 2021, several former shareholders of OASTH started contesting the return/value of the shares of OASTH. In the context of this dispute, some of the former shareholders entered into settlement negotiations with OASTH, while others got involved is a public feud with the company. During a press conference, the identity of several former shareholders involved in the dispute was disclosed by the President of OASTH. On the same day, the names of twenty-nine former shareholders were also published in a press release written by OASTH, together with the percentage of their participation in the capital of OASTH, the date of acquisition of the shares, and the acquisition price in euros. Those information were further picked up by journalists and shared in the press and on social media. Following the publication of these information, nine shareholders decided to exercise their right to access to their personal data, and their right to object to the processing of personal data, in accordance with Article 12 and Article 13 of the Law 2472/1997. OASTH however did not follow up on these requests, before arguing that the shareholders had not paid the administrative fee which was due to submit such requests. In this context, twelve of the former shareholde
Related Enforcement Actions (0)
No other enforcement actions found for Organization of Urban Transport of Thessaloniki (OASTH) in GR
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
7 September 2021
Authority
Hellenic Data Protection Authority
Fine Amount
€10,000
GDPRhub ID
gdprhub-4042About this data
Cite as: Cookie Fines. Organization of Urban Transport of Thessaloniki (OASTH) - Greece (2021). Retrieved from cookiefines.eu
Last updated: