[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcbEDPjz2Vrjf_zclIJYd62lPkTJ_D-5NlQsAvfFpKlg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"7cb774db-fdcb-40e0-8a87-737bf12e0ba2","greek-authority-fined-for-unlawful-publication-of-personal-data-on-transparency-portal","58ccb282-efda-44d7-9d66-fae105db3044","Greek Authority Fined for Unlawful Publication of Personal Data on Transparency Portal","The Decentralized Administration of the Aegean published an individual's name across eleven administrative decisions on a public transparency portal without a valid legal basis under GDPR, violating the data subject's right to erasure. This incident highlights that transparency obligations do not override data protection requirements — public bodies must carefully assess whether personal data included in published documents is strictly necessary and legally justified. The failure to conduct a proper legal basis assessment before publication demonstrates a gap in data protection awareness and governance processes. Such violations, even when unintentional, carry reputational and financial consequences and erode public trust in how government bodies handle personal information.","**Immediate actions:**\n- Audit all documents currently published on public transparency portals to identify personal data published without a valid legal basis.\n- Establish a process to respond promptly to erasure requests, including removing or redacting personal data from published decisions within a defined timeframe.\n\n**Governance & process improvements:**\n- Implement a mandatory pre-publication review checklist requiring staff to confirm legal basis before any document containing personal data is published publicly.\n- Appoint or empower a Data Protection Officer (DPO) to review administrative decisions for GDPR compliance before publication on transparency portals.\n- Develop and enforce a data minimisation policy that requires pseudonymisation or redaction of personal identifiers in publicly accessible documents wherever possible.\n\n**Training & awareness:**\n- Deliver targeted GDPR training to all staff responsible for preparing and publishing administrative decisions, focusing on lawful basis requirements and data subject rights.\n- Create clear internal guidance distinguishing between transparency\u002Fopen-government obligations and personal data protection requirements under GDPR.",[12,13,14,15,16,17,18],"GDPR Article 32","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management",{"GDPR Article 32":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":22,"CIS Control 17: Incident Response Management":23,"CIS Control 14: Security Awareness and Skills Training":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Article 32 requires appropriate technical and organisational measures to ensure data processing is lawful and secure; a pre-publication review process would have prevented the unlawful disclosure of personal data on the portal.","The procedural flaw of lacking a pre-publication legal basis check was never identified or remediated, allowing the same error to be repeated across eleven documents — a systematic process failure this control is designed to prevent.","Clause 7.2 requires organisations to ensure personnel are competent in their data-related responsibilities; inadequate staff training on GDPR lawful basis requirements directly contributed to this violation.","A defined incident response process for data protection complaints — including rapid removal of unlawfully published data — would have enabled the organisation to remediate the issue promptly upon receiving the erasure request, potentially reducing the regulatory penalty.","Structured, role-based privacy and data protection training for staff handling administrative publications would have built the awareness needed to avoid publishing personal data without legal justification.","While procedural rather than technical, this control's spirit of identifying and remediating risks before they become incidents applies — a governance gap in publication workflows allowed the unlawful processing to persist across eleven decisions.","Controlling who can publish documents to public-facing portals, and ensuring those individuals are trained and authorised with clear accountability, would have provided a governance checkpoint to prevent unlawful publication.","published","2026-10-18T20:20:25.824395+00:00","2026-10-18T20:20:25.794+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_18\u002F2026&diff=53445&oldid=0","hdpa-greece-18-2026-681959","HDPA (Greece) - 18\u002F2026",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]