Parent of a minor (data subject) – €3,000 Fine (Greece, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A parent of a minor was awarded €3,000 after a tutoring center refused to provide access to their child's personal data. This case is important because it reinforces the rights of parents to access their children's information. Educational institutions must ensure they comply with data access requests to avoid penalties.
What happened
The tutoring center failed to respond to a parent's requests for access to their child's personal data.
Who was affected
The minor student and their parent who sought access to the child's personal data.
What the authority found
The Hellenic DPA ruled that the tutoring center violated GDPR rules by not providing the requested information to the parent.
Why this matters
This decision underscores the obligation of educational institutions to respect parental rights regarding data access. It serves as a reminder for all organizations that they must be transparent and responsive to data requests.
GDPR Articles Cited
Entities Involved
On 16 December 2022 the parent of an underage boy (data subject), filed a complaint with the DPA for the fact that the data subject's private tutoring centre (the controller) wouldn't respond to his repeated requests, via phone calls and SMS, for access to the personal data of the data subject. In particular, the controller had failed to provide the tax receipts corresponding to the lessons attended by the data subject at the tutoring centre for the academic years 2021-2022. The DPA requested from the controller clarifications on whether the parent had indeed requested access to the data subjects personal data, if the relevant information had been provided and what response was given. On 8 March 2023, the controller replied to the DPA that the student had not attended classes for the academic year 2022-2023, but as the controller's reply was deemed irrelevant, the DPA repeated its request, to which on 6 September 2023 the controller replied that they had already provided answers. On 26 October 2023 the DPA convened a hearing by means of a teleconference which the controller failed to attend, despite being duly invited. The Hellenic DPA held that according to Articles 15 and 12 GDPR: a) Data subjects have the right to know whether personal data concerning them are being processed, and to obtain knowledge of it, without the need to invoke their legitimate interest as a legal basis for their request. b) Controllers are not exempted from their obligation to inform data subjects on the sole ground that the requested data do not exist in a file held by them. Furthermore, according to the DPA's established case law, a person who has parental responsibility for their child, has in principle as a legal representative, the right of access to the data relating to their minor child, as referred to in Article 15 GDPR, unless otherwise provided for by a Court decision. Finally, the DPA held that by showing indifference and failing to provide adequate clarifications r
Related Enforcement Actions (0)
No other enforcement actions found for Parent of a minor (data subject) in GR
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
26 October 2023
Authority
Hellenic Data Protection Authority
Fine Amount
€3,000
GDPRhub ID
gdprhub-8650About this data
Cite as: Cookie Fines. Parent of a minor (data subject) - Greece (2023). Retrieved from cookiefines.eu
Last updated: