- Enforcing jurisdiction
- Greece · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Athens Urban Transport Organization (OASA) – €50,000 Fine (Greece, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Hellenic Data Protection Authority fined the Athens Urban Transport Organization EUR 50,000 for mishandling personal data in its electronic ticketing system. The authority found that the organization kept personal data for too long without justification. This case highlights the importance of data retention policies for companies handling personal information.
What happened
The Hellenic Data Protection Authority fined OASA for retaining personal data for 20 years without demonstrating necessity.
Who was affected
Passengers using the electronic ticketing system were affected by the mishandling of their personal data.
What the authority found
The authority found that OASA violated data protection rules by not adhering to the principle of storage limitation.
Why this matters
This case serves as a reminder for organizations to regularly review their data retention practices and ensure compliance with data protection regulations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 12 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Athens Public Transport Authority's (OASA) established a new electronic ticketing system. The system used passengers' passport number or other official identification document, their 8-digit code (PIN), their month and year of birth, and if applicable, their category of social beneficiary (for instance, if a passenger received social welfare benefits). In 2017, the HDPA had issued two opinions regarding the OASA's electronic ticketing system. In these opinions, the HDPA considered that the OASA, as the controller, should carry out a data protection impact assessment (DPIA) for their electronic ticketing system. On 18 November 2019, the Authority carried out an on-site inspection at OASA to determine compliance with the previously issued opinions. Following this inspection, the HDPA found remaining issues and ordered OASA to make amendments to their system. In March 2020, the OASA made new submissions to the DPA. These included a new DPIA, their record of prior processing activities, as well as a technical report from their contracted processor, "HELLAS SMARTICKET S.A.". Following these submissions, the HDPA still considered there to be issues with OASA's systems and requested additional information from them. After receiving this information, the HDPA deemed it to be unsatisfactory, and on 25 September 2023, the DPA proceeded to issue a decision. The DPA found that the controller had violated Article 5(1)(e) GDPR and Article 35(1) GDPR. (a) The DPA found that the controller had breached the principle of storage limitation under Article 5(1)(e) GDPR. In the course of their investigation, the DPA found that the controller aimed to retain personal data collected from their customers for 20 years, without demonstrating why this was necessary. (b) The DPA found that the controller had violated Article 35(1) GDPR, as their DPIA insufficiently identified the data retention purposes in relation to their records of processing. Moreover, the DPIA was unclear in ter
Related Enforcement Actions (0)
No other enforcement actions found for Athens Urban Transport Organization (OASA) in GR
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
13 June 2023
Authority
Hellenic Data Protection Authority
Fine Amount
€50,000
About this data
Cite as: Cookie Fines. Athens Urban Transport Organization (OASA) - Greece (2023). Retrieved from cookiefines.eu
Last updated: