Fine EUR 150,000 to multinational company in Greece for GDPR violations


The Greek Data Protection Authority has imposed a fine of 150,000 euros on PWC BS A.E. for violations of the General Data Protection Regulation. In particular, the Personal Data Protection Authority, upon a complaint, investigated on its own motion the legality of the processing of the personal data of employees of PWC BS (PRICEWATERHOUSECOOPERS BUSINESSSOLUTIONS SA) pursuant to which the abovementioned employees were forced to consent to the processing their personal data for three (3) distinct purposes.
The Authority considered PWC BS as the controller:
1) has undergone unlawful processing, in breach of the provisions of Article 5 (1) (e); a) of the GDPR (principle of legality), the personal data of its employees, as it applied an inappropriate legal basis under Art. 6 (1)  a  GDPR (consent) instead of the appropriate legal basis for the performance of the contract, compliance with a legal obligation and the superior legal interest (Art. 6 (1), b, c' and g  GDPR).
2) in an unlawful and no transparent manner, in breach of Article 5 (1) (e); (a) b and c (GDPR) (the principle of objectivity and transparency), the personal data of its employees, as it gave them the false impression that they processed it in accordance with the legal basis of their consent in accordance to 6 (1) a’GDPR.In practice, it was processed on another legal basis, for which the employees were never informed.
3) as controller, although he was responsible, was unable to comply with and demonstrate compliance with Article 5 (1) of the GDPR in breach of the principle of accountability provided for in Article 5 (2) and he carried the burden of compliance on employees.

Comments

Post a Comment

Popular posts from this blog

Imposition of fines and order to comply following a leak of expats’ personal data file by Greek Data Protection Authority

Image
The Greek Supervisory Authority for Data Protection imposed on the Greek Ministry of the Interior,  an administrative fine totalling EUR 400,000 and on a Member of European Parliament an administrative fine totalling EUR 40,000 for infringements of GDPR. The Hellenic Data Protection Authority received a large number of complaints regarding unsolicited political communication via e-mail sent on 1/3/2024 and entitled "100 days before the European elections", by Member of European Parliament Anna-Michelle Asimakopoulou. Following this, the Authority investigated the case ex officio, exercising immediately its powers of investigation and auditing the bodies involved. Following a series of on-the-spot audits and the receipt of evidence and data in the context of the audit, it was found that a file containing personal data of all registered Greek expatriate voters for the June 2023 elections, for which the Hellenic Ministry of the Interior is the controller, and for which the leg...
Read more

Greek Administrative Court rules state liable for Covid-19 vaccine side effects due to "excessive sacrifice"

Image
Greece: The Administrative Court of First Instance of Athens, in its decision no. 4202/2025, has ruled that the Greek State is liable for damages sustained by an individual due to side effects following a preventive "COVID-19" vaccination. This landmark decision was issued in a compensation lawsuit filed against the Hellenic Republic. The Case: Seeking Compensation for Vaccine-Related Harm The lawsuit was brought by a plaintiff seeking compensation for material damage and moral harm (non-pecuniary damage), alleging that they suffered severe side effects after their preventive COVID-19 vaccination with a specific vaccine. The initial claim was for €461,835.26, but this amount was subsequently restricted during the proceedings. The plaintiff based their claim on two legal grounds: Article 105 of the Introductory Law of the Civil Code (EισNAK): This article concerns the State's liability for compensation arising from illegal acts or omissions of its organs in the exe...
Read more

European Commission refers Poland to the Court of Justice to protect judges from political control

Image
European Commission decided to refer Poland to the Court of Justice of the EU regarding the new disciplinary regime for Polish judges, requesting an expedited procedure. On 3 April 2019, the Commission launched this infringement procedure on the grounds that the new disciplinary regime undermines the judicial independence of Polish judges and does not ensure the necessary guarantees to protect judges from political control, as required by the Court of Justice of the EU. Specifically, the Polish law allows ordinary court judges to be subjected to disciplinary investigations, procedures and sanctions on the basis of the content of their judicial decisions, including the exercise of their right under Article 267 of the Treaty on the Functioning of the European Union (TFEU) to request preliminary rulings from the Court of Justice of the EU. Moreover, the new disciplinary regime does not guarantee the independence and impartiality of the Disciplinary Chamber of the Supreme Co...
Read more

Following the tragic death of lawyer Ebru Timtik, the CCBE calls on the EU and Turkish authorities to take urgent measures to prevent the death of lawyer Aytaç Ünsal

Image
The Council of Bars and Law Societies of Europe (CCBE) is deeply shocked by the death of Turkish lawyer Ebru Timtik on 27 August after a 238 days hunger strike. Lawyers Ebru Timtik and Aytaç Ünsal, respectively sentenced to 13 and 6 months and 11 years and 6 months in prison, decided to go on an unlimited hunger strike to denounce their unfair trial as well as the unfair trial of several dozens of Turkish lawyers. ( Read more here ) Since 2017, several Turkish lawyers belonging to the Progressive Lawyers Association and the People's Law Office, among which Ebru Timtik and Aytaç Ünsal, have been victims of judicial harassment. These lawyers who have fought for Justice and the Rule of Law have defended, among others, persons considered to be opponents of the Turkish government, families of miners massacred in Soma and Ermenek, populations expelled from their homes as victims of urban transformation, families of citizens killed under torture in police stations and prisons as well as...
Read more

Ombudsman inquiry on Commission President’s text messages is a wake-up call for EU

Image
The European Ombudsman inquiry into the Commission’s handling of a request for text messages between its President and the CEO of a pharmaceutical company is a wake-up call for all EU institutions about ensuring accountability in an era of instant messaging. One year after the initial request by a journalist, the Commission has still not clarified whether messages reported to concern major vaccine procurement deals exist and whether the public is entitled to see them. The Ombudsman had asked the Commission, in a finding of maladministration in January, to conduct a more thorough search for the text messages. The Commission’s recent response failed to say whether it had looked directly and correctly for the text messages and if not, why not. While the response recognised that work-related text messages can be EU documents, it reiterated that the Commission’s internal policy is, in effect, not to register text messages. The Ombudsman has closed  the inquiry  and upheld...
Read more

The Title Deed Issue in Cyprus and the "Trapped Buyers" Phenomenon

Image
Article By Giorgos Kazoleas, Lawyer LL.M.  The issue of title deeds in Cyprus and the phenomenon of "trapped buyers" constitutes one of the greatest legal, financial, and social peculiarities of Cypriot real estate law. The Cypriot Peculiarity: Sale Without a Title Deed Under Cypriot law (pursuant to the Immovable Property (Tenure, Registration and Valuation) Law, Cap. 224), legal ownership of a property is transferred and acquired solely upon its registration with the Department of Lands and Surveys and the issuance of the relevant Certificate of Registration (Title Deed). However, a major peculiarity exists: it is entirely legal to sell a property that does not (yet) possess a separate title deed. This typically occurs in new developments (apartment buildings or residential complexes), where the title deed for the plot of land belongs to the developer, but the separate title deeds for each apartment or house can take years to be issued due to bureaucracy, pending ap...
Read more

Status of long-term resident in Cyprus: Appeal against the rejection decision

Image
By Giorgos Kazoleas, Lawyer in Cyprus Third-country nationals residing in areas controlled by the Government of the Republic legally and continuously for the last five years prior to the submission of the application and holding a valid residence permit in the Republic can apply along with the required original documents in order to obtain the status of long-term resident in Cyprus. It often happens that the Administration (in this case the Immigration Department) does not properly assess the facts and circumstances of the applicant and does not properly check the requirement for obtaining the status, resulting in a rejection decision. This decision is notified to the applicant and must contain clear justification for the reasons for the rejection of the application. It must also state that the applicant has the right to appeal against the rejection decision within 75 days from the notification of the decision. According to the Aliens and Immigration Law, [1]   in order to...
Read more