the Ministry of Rural Development and Food – €25,000 Fine (Greece, 2024)

On 03.05.2023 the HDPA sent a single questionnaire to be completed on the designation and position of the Data Protection Officer (DPO) to selected public bodies, such as the Ministry of Rural Development and Food. The deadline for submission of the questionnaire was set for 19 May 2023. The Ministry of Rural Development and Food did not submit the questionnaire on time and a new closing date of 31.05.2023 was set. Despite being urged by the authority, the questionnaire was not submitted. The authority was informed that during the concerned period, the Ministry of Rural Development and Food was in the process of designating a DPO. On 28.11.2023, the authority sent a summons to the Ministry of Rural Development and Food to be heard on 19.12.2023. The Ministry of Rural Development and Food in a memorandum clarified that the contract of the DPO of the Ministry had expired on 04. 08.2022, while a new DPO was appointed on 20.06.2023; in the interim period, during which there was no designated DPO, it was stated that a personal data protection and security plan was in place and that the data subjects did not suffer any harm. Further, they claimed that an employee of the Directorate of Administrative Organization and Supervision of Legal Entities of the Ministry after receiving the second letter on 26.05.2023 immediately proceeded to complete and submit the questionnaire, which could not be done due to a technical error. The HDPA assessed the above facts and the late submission of the questionnaire, but also the failure to inform the authority about the technical problem faced by the Ministry, as claimed. Based on the above, the Authority found that the Ministry of Rural Development and Food violated Article 31 GDPR with regard to the cooperation of the controller with the Authority and Article 37 GDPR with regard to non-designation of DPO for the period from 04.08.2022 to 20.06.2023. Taking into account the above and the fact that no material damage occurred to the data