"A" – Complaint Upheld (Greece, 2023)

On 12 January 2022, a doctor and member of the Board of the Athens Medical Association (AMA) submitted a complaint to the Hellenic DPA (HDPA) against the Athens Medical Association. The complaint alleged the illegal collection of the AMA members' Covid-19 vaccination certificates. The AMA had requested its members who managed private practices to electronically send their Covid-19 vaccination certificates and upload them to an electronic platform created by the Athens Medical Association. In their complaint to the HDPA, the data subject requested the HDPA to prohibit the AMA from collecting members' Covid-19 vaccination certificates or, in any event, if the collection was deemed lawful, to order the AMA bring their processing into compliance with the GDPR. The HDPA contacted the AMA and requested more information from them about their vaccination certificate collection. The AMA replied that the collection was carried out under Articles 6(1)(e) and 9(1)(i) GDPR, in line with Article 206 of Law No. 4820/2021 which prescribed the mandatory vaccination of staff employed in health care. The AMA stated that the purpose of the processing was to allow it to fulfil its duties in inspecting the compliance of health care institutions and professionals under its responsibility. The HDPA held that the processing carried out by the AMA was lawful for the purposes of Articles 5(1)(a) , 6(1)(e) and 9(2)(i) GDPR, but that the AMA had retained the certificates beyond the retention period prescribed by Article 5(1)(e) GDPR. Firstly, in relation to Articles 5(1)(a) , 6(1)(e) and 9(2)(i) GDPR the HDPA took into account Article 206 of Law No. 4820/2021. It held that Article 206 of Law No. 4820/2021 fulfilled the requirements of Article 6(3)(b) GDPR, as it provided for the overriding public interest of protecting public health workers against the Covid-19 virus. Secondly, in relation to the transparency requirements under Article 5(1)(a) GDPR, the HDPA held that the platform used by t