Hellenic Ministry of Interior – €440,000 Fine (Greece, 2024)

The Hellenic DPA (HPDA) received 236 complaints regarding unsolicited political communication sent via e-mail by MEP Anna Michelle Asimakopoulou on 1 March 2024. In response, the HDPA initiated an investigation, which consisted of communications and requests for information from the Ministry, the New Democracy party, and Ms Asimakopoulou -- all of which were considered controllers for the processing. The HDPA found a file containing personal data of all registered voters abroad for the June 2023 elections, for which the Ministry of Interior is a controller. The file was created for internal use at the Ministry of Interior in connection with a purpose related to the electoral process. It contained the names, countries, email addresses and telephone numbers of over 20,000 overseas voters. This data was not otherwise available. On 18 March 2024, the HDPA received a notification of a personal data breach from the Ministry, which approximated the date of the incident as May 2023. The HDPA determined that the leak of this file from the Ministry occurred between 8 and 23 June 2023. On 23 June 2023, the file was provided to the then New Democracy Secretary of Greek Expatriates (political party) by an unidentified sender. On 20 January 2024, the then-secretary sent Ms Asimakopoulou the file via Whatsapp. Upon receiving the file, the MEP then processed the data, exporting the email addresses to MailChimp to add them to her mailing list. On 1 March 2024, she emailed the mailing list, including the data subjects mentioned above. Her email did not inform recipients of how their data was obtained. The MEP claimed to have received the file on the basis of party instructions. She also argued that there was no specific regulation on political communication and she had reasonably considered she had an overriding legitimate interest in informing unknown voters about absentee voting. The Hellenic DPA imposed an administrative fine of €400,000 for violations of Articles 5, 25, 30, 32 and 33 GDPR and instructed the Ministry of Interior to bring their actions into compliance with the GDPR. The DPA also imposed a fine of €40,000 on MEP Anna Michelle Asimakopoulou, as controller, for infringing Articles 5, 6 and 14 GDPR and ordered the deletion of the data. Ministry of Interior Although the HDPA could not ascertain how the transmission of data from the Ministry of the Interior to the Secretary of Expatriates of the New Democracy was made, it found that it undoubtedly constituted a breach of confidentiality and therefore a breach of personal data, in accordance with the definition of Article 4(12) GDPR. The HDPA considered that the Ministry's investigation was no exhaustive in attempting to determine the time and scope of the breach. It also found that the policies and procedures followed by the Ministry for the movement of overseas voter data did not contain specific security measures for the movement of the records and restrictions (regarding the recipients of the records), nor did they contain provisions for recording and documenting the actions and approving the purpose of the export. The planned procedures also did not include any measures to mitigate the risks caused by human error. It also emerged that the measures in place were not reviewed for the specific needs of the processing of overseas electoral rolls. Further, the HDPA noticed deficiencies in the Ministry's data protection procedures and policies. In particular, the Ministry had not effectively implemented the means of processing with appropriate technical measures or organisational measures to implement data protection principles, as required by Articles 24 and 25 GDPR. It also failed to fulfill its Article 33 GDPR obligations to notify the breach to the supervisory authority correctly; its notification did not include any information that was publicly disclosed. Finally, HDPA found that there were deficiencies and inaccuracies in the records of activities related to the Ministry's processing activities, in violation of Article 30 GDPR. MEP The HDPA found that the MEP's collection of personal data of absentee voters and usage of the data to send political communications breached the principle of lawfulness, fairness and transparency under Article 5(1)(a) GDPR. Indeed, the HDPA determined, the processing was done in violation of a number of provisions of the electoral legislation and could not be used to send a political communication message. Data subjects were not provided with appropriate information in accordance with Article 14 GDPR -- in particular, the source of their data -- resulting in a violation of the principle of transparency. The MEP also infringed Article 6(1) GDPR in processing the data. Given that such processing (collection) was carried out in violation of a number of provisions of electoral legislation, voters abroad could not have reasonably expected that their personal data held by the Ministry of Interior would be processed in this way. Legitimate interest did not lend a valid legal basis either: the HDPA noted that the right of expatriate voters to the protection of their personal data prevails over the legitimate interest of the MEP to communicate with them individually. New Democracy The DPA postponed adopting a decision with regard to New Democracy because of additional evidence submitted, which the HDPA decided to further investigate.