- Enforcing jurisdiction
- Greece · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Ministry of Citizan Protection – €150,000 Fine (Greece, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Hellenic Data Protection Authority fined the Ministry of Citizen Protection EUR 150,000 for mishandling personal data related to new identity cards. This case is significant as it stresses the need for transparency and proper data handling by government entities.
What happened
The Ministry of Citizen Protection failed to provide timely and clear information regarding the processing of biometric data for new identity cards.
Who was affected
Citizens applying for new identity cards, whose biometric data was processed, were affected.
What the authority found
The Hellenic DPA ruled that the Ministry violated GDPR by not being transparent and not minimizing data collection appropriately.
Why this matters
This ruling underscores the importance of transparency and data minimization for all organizations, especially government bodies, when handling personal data.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 6 March 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A citizen filed a complaint about the issuance of new identity cards containing biometric data and the Ministry of Citizen Protection's failure to respond to an inquiry about the legality of this data processing. The HDPA initiated an investigation to examine the Ministry's compliance with GDPR, focusing on data minimization, transparency, and security measures. The Ministry explained its actions, including conducting a Data Protection Impact Assessment (DPIA), assessing risks, and implementing safeguards for biometric data. The DPA stressed the importance of providing adequate public information and ensuring individuals' rights regarding personal data access. The Hellenic Data Protection Authority (HDPA) found that the Ministry of Citizen Protection violated provisions of the GDPR related to transparency and data minimization concerning the issuance of new identity cards that contain biometric data. Specifically, the Ministry had failed to provide timely responses and sufficient information to the public regarding the processing of personal data in compliance with GDPR requirements. Reasoning: First, the DPA held that the controller violated Article 12 (Transparency) of the GDPR by failing to provide clear and timely information to the complainant and the public about the processing of their personal data in relation to the new identity cards. This included details about the legality, purpose, and scope of the data collection. Second, the DPA found that the Ministry had not fully complied with the principle of data minimization under Article 5(1)(c) of the GDPR. The authority noted concerns about the scope of biometric data collected and questioned whether all the data being processed was necessary for the stated purpose (issuance of identity cards). Third, the DPA emphasized the need for a Data Protection Impact Assessment (DPIA), as required by Article 35 of the GDPR, due to the high risks posed by the processing of biometric data. The Ministry had initiated th
Related Enforcement Actions (0)
No other enforcement actions found for Ministry of Citizan Protection in GR
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
23 September 2024
Authority
Hellenic Data Protection Authority
Fine Amount
€150,000
About this data
Cite as: Cookie Fines. Ministry of Citizan Protection - Greece (2024). Retrieved from cookiefines.eu
Last updated: