Enforcing jurisdiction
Greece · Geography does not establish applicable law.
Confirmed applicable legislation

A, B, C, D, E, F (data subjects) – €1,000 Fine (Greece, 2025)

€1,000Hellenic Data Protection Authority6 February 2025Greece
final
Fine

Privacy enforcement record

This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.

A natural person was fined EUR 1,000 for disclosing personal data of six individuals to ecclesiastical authorities without permission. This case is important because it emphasizes the need for individuals to protect personal information, even in disputes. It shows that sharing sensitive data without consent can lead to legal consequences.

What happened

A natural person disclosed personal data of six individuals to ecclesiastical authorities without their consent.

Who was affected

The six individuals whose personal data was disclosed were affected.

What the authority found

The Hellenic DPA decided that the natural person violated GDPR by transmitting personal data without a valid legal basis.

Why this matters

This ruling underscores the importance of safeguarding personal information in all situations. It serves as a reminder that individuals must be cautious about sharing others' data, even in personal disputes.

Recorded legal citations
Automatically processed
Art. 2(2)(c) GDPR
Art. 6(1)(f) GDPR
View original scraped data
Art. 2(2)(c) GDPR
Art. 6(1)(f) GDPR

Original imported citations before automated processing; the processing history does not establish independent verification.

Entities Involved

A, B, C, D, E, F (data subjects)
Data Controller (natural person)

Source checks

Linked-source text retrieved.

Automated check recorded — 16 March 2026.

Processing notes: articles corrected.

Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources

Full Legal Summary
Detailed

In 2022 the DPA received six complaints from six (6) different data subjects, regarding the illegal disclosure of their personal data to ecclesiastical authorities by a natural person (controller). Three (3) of the data subjects were clergymen. In the course of a legal dispute between the controller and the six data subjects, the controller sent two complaint letters to several ecclesiastical officials and authorities (inter alia, two Archbishops, one Archimandrite and the General Hierarchical Commissioner of the Holy Metropolis). The conflict related to the controller's purchase of an apartment in a building in which the data subjects reside. Both letters of complaint were accompanied by numerous supporting documents containing a multitude of personal data of the six data subjects (home addresses, contact information, marital status, tax identification number, professional capacity, property details). According to the controller, the purpose of his letters of complaint was to provide the ecclesiastical authorities with full information, in order to discipline the three clergymen/data subjects by any appropriate means at their discretion, so that peace and tranquility may prevail in my home and in my personal life. Regarding the controller's claim that the above letters of complaint sent to the ecclesiastical authorities were part of a household activity, the DPA held that a submission before a body or authority (such as an ecclesiastical authority) entails at least the use and disclosure through transmission of personal data within the scope of Article 4(1) and (2) GDPR. The DPA found, that only two recipients of the complaint letters had any disciplinary authority relating to the controller's complaints over only three of the six data subjects. Thus, the DPA held, that * the transmission of the data of the three clergymen to all recipients and * the transmission of the data of the data subjects who do not have the status of clergy to any recipient was not ne

Related Enforcement Actions (0)

No other enforcement actions found for A, B, C, D, E, F (data subjects) in GR

This is the only recorded action for this entity in this jurisdiction.

Details

Fine Date

6 February 2025

Authority

Hellenic Data Protection Authority

Fine Amount

€1,000

About this data

Data: GDPRhub (noyb.eu)
Licensed under CC BY-NC-SA 4.0
Automatically normalized and classified

Cite as: Cookie Fines. A, B, C, D, E, F (data subjects) - Greece (2025). Retrieved from cookiefines.eu

Report Inaccuracy

Last updated: