Greek Authority Fined for Unlawful Publication of Personal Data on Transparency Portal
The Decentralized Administration of the Aegean published an individual's name across eleven administrative decisions on a public transparency portal without a valid legal basis under GDPR, violating the data subject's right to erasure. This incident highlights that transparency obligations do not override data protection requirements — public bodies must carefully assess whether personal data included in published documents is strictly necessary and legally justified. The failure to conduct a proper legal basis assessment before publication demonstrates a gap in data protection awareness and governance processes. Such violations, even when unintentional, carry reputational and financial consequences and erode public trust in how government bodies handle personal information.
Tactical Insight
Immediate actions
- Audit all documents currently published on public transparency portals to identify personal data published without a valid legal basis.
- Establish a process to respond promptly to erasure requests, including removing or redacting personal data from published decisions within a defined timeframe.
Governance & process improvements
- Implement a mandatory pre-publication review checklist requiring staff to confirm legal basis before any document containing personal data is published publicly.
- Appoint or empower a Data Protection Officer (DPO) to review administrative decisions for GDPR compliance before publication on transparency portals.
- Develop and enforce a data minimisation policy that requires pseudonymisation or redaction of personal identifiers in publicly accessible documents wherever possible.
Training & awareness
- Deliver targeted GDPR training to all staff responsible for preparing and publishing administrative decisions, focusing on lawful basis requirements and data subject rights.
- Create clear internal guidance distinguishing between transparency/open-government obligations and personal data protection requirements under GDPR.