HDPA (Greece) - 18/2026
Hellenic DPA fines €2,000 for unlawful publication of personal data.
Run HDPA?
Get an email when a reviewed story names HDPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Hellenic Data Protection Authority (HDPA) has fined the Decentralized Administration of the Aegean €2,000 for unlawfully publishing an individual's name in eleven administrative decisions on the Diavgeia transparency portal. The HDPA found that the publication lacked a valid legal basis under GDPR and violated the complainant's right to erasure. The authority ordered the removal of the decisions and imposed the fine.
The lesson from this incident
Full lessonThe Decentralized Administration of the Aegean published an individual's name across eleven administrative decisions on a public transparency portal without a valid legal basis under GDPR, violating the data subject's right to erasure. This incident highlights that transparency obligations do not override data protection requirements — public bodies must carefully assess whether personal data included in published documents is strictly necessary and legally justified. The failure to conduct a proper legal basis assessment before publication demonstrates a gap in data protection awareness and governance processes. Such violations, even when unintentional, carry reputational and financial consequences and erode public trust in how government bodies handle personal information.