[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkyrYPBlRjjS4wlyZIX-EDidwOHmKC6z5Hnv8xQS7mws":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"58ccb282-efda-44d7-9d66-fae105db3044","HDPA (Greece) - 18\u002F2026","hdpa-greece-18-2026-681959","Created page with \"{{DPAdecisionBOX |Jurisdiction=Greece |DPA-BG-Color= |DPAlogo=LogoGR.jpg |DPA_Abbrevation=HDPA |DPA_With_Country=HDPA (Greece) |Case_Number_Name=18\u002F2026 |ECLI= |Original_Source_Name_1=HDPA |Original_Source_Link_1=https:\u002F\u002Fwww.dpa.gr\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-10\u002F18_2026%20anonym_0.pdf |Original_Source_Language_1=Greek |Original_Source_Language__Code_1=EL |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2=...\" Show changes","The Hellenic Data Protection Authority (HDPA) has fined the Decentralized Administration of the Aegean €2,000 for unlawfully publishing an individual's name in eleven administrative decisions on the Diavgeia transparency portal. The HDPA found that the publication lacked a valid legal basis under GDPR and violated the complainant's right to erasure. The authority ordered the removal of the decisions and imposed the fine.","Hellenic DPA fines €2,000 for unlawful publication of personal data.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_18\u002F2026&diff=53445&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-10-18T18:07:34+00:00","2026-10-18T20:00:10.65831+00:00",7,[17,20],{"name":18,"type":19},"HDPA","vendor",{"name":21,"type":22},"Diavgeia","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":63},"greek-authority-fined-for-unlawful-publication-of-personal-data-on-transparency-portal","Greek Authority Fined for Unlawful Publication of Personal Data on Transparency Portal","The Decentralized Administration of the Aegean published an individual's name across eleven administrative decisions on a public transparency portal without a valid legal basis under GDPR, violating the data subject's right to erasure. This incident highlights that transparency obligations do not override data protection requirements — public bodies must carefully assess whether personal data included in published documents is strictly necessary and legally justified. The failure to conduct a proper legal basis assessment before publication demonstrates a gap in data protection awareness and governance processes. Such violations, even when unintentional, carry reputational and financial consequences and erode public trust in how government bodies handle personal information.",[56,57,58,59,60,61,62],"GDPR Article 32","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management",{"GDPR Article 32":64,"NIST SP 800-53 SI-2: Flaw Remediation":65,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":66,"CIS Control 17: Incident Response Management":67,"CIS Control 14: Security Awareness and Skills Training":68,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":69,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":70},"Article 32 requires appropriate technical and organisational measures to ensure data processing is lawful and secure; a pre-publication review process would have prevented the unlawful disclosure of personal data on the portal.","The procedural flaw of lacking a pre-publication legal basis check was never identified or remediated, allowing the same error to be repeated across eleven documents — a systematic process failure this control is designed to prevent.","Clause 7.2 requires organisations to ensure personnel are competent in their data-related responsibilities; inadequate staff training on GDPR lawful basis requirements directly contributed to this violation.","A defined incident response process for data protection complaints — including rapid removal of unlawfully published data — would have enabled the organisation to remediate the issue promptly upon receiving the erasure request, potentially reducing the regulatory penalty.","Structured, role-based privacy and data protection training for staff handling administrative publications would have built the awareness needed to avoid publishing personal data without legal justification.","While procedural rather than technical, this control's spirit of identifying and remediating risks before they become incidents applies — a governance gap in publication workflows allowed the unlawful processing to persist across eleven decisions.","Controlling who can publish documents to public-facing portals, and ensuring those individuals are trained and authorised with clear accountability, would have provided a governance checkpoint to prevent unlawful publication."]