Systematic GDPR Violations by the Greek Authorities

During 2025, the Hellenic Data Protection Authority (HDPA) identified violations by the Greek authorities of numerous provisions of the GDPR and, more broadly, of personal data protection legislation. The measures taken by the HDPA, which include fines, reprimands, orders and warnings issued to public authorities in relation to violations of numerous data protection provisions, demonstrate, for yet another year, that the Greek state has so far failed to fully adapt to the heightened requirements for the protection of personal data, as established under EU and national law.

• Personal data violation by a body supervised by the Ministry of Health: On 7 January 2025, following a relevant ruling by the Council of State (CoS), the HDPA imposed a fine of €3,000 on the National Organisation for the Provision of Health Services (EOPYY), which is supervised by the Ministry of Health, for the unlawful processing of sensitive and personal data concerning a minor, in violation of Article 4(1)(a) of Law 2472/1997 (since replaced by Law 4624/2019). The violation concerned the disclosure of the findings of a Sworn Administrative Inquiry (EDE), which contained information regarding the minor’s health problems.

• GDPR violation by the Athens Administrative Court of Appeal: On 17 March 2025, the HDPA issued a reprimand to the Athens Administrative Court of Appeal for violating the right of access of a judicial employee (Article 15(1) and (3) and Article 12(3) GDPR) and ordered the Court to grant the complainant access to their personnel file and to electronic records containing their name. Pursuant to Article 58(2)(d) GDPR, the independent Authority also requested that the Athens Administrative Court of Appeal, in its capacity as data controller, take the necessary steps to appoint a Data Protection Officer in accordance with the requirements of the GDPR.
• GDPR violation by the Athens Administrative Court of Appeal: On 17 March 2025, the HDPA issued a reprimand to the Athens Administrative Court of Appeal for violating the right of access of a judicial employee (Article 15(1) and (3) and Article 12(3) GDPR) and ordered the Court to grant the complainant access to their personnel file and to electronic records containing their name. Pursuant to Article 58(2)(d) GDPR, the independent Authority also requested that the Athens Administrative Court of Appeal, in its capacity as data controller, take the necessary steps to appoint a Data Protection Officer in accordance with the requirements of the GDPR.
• GDPR violation by the Municipality of Patras: On 30 April 2025, the HDPA imposed a fine of €5,000 on the Municipality of Patras for violating Article 5(1)(c) GDPR. The Municipality had disclosed a citizen’s personal data that were not necessary to achieve the local authority’s legitimate purposes, namely informing residents and enhancing the transparency of administrative action. The disclosure therefore went beyond what was necessary, since these purposes could have been achieved through less intrusive means.
• GDPR violation by the Ministry of Foreign Affairs: On 10 June 2025, the HDPA issued reprimands and imposed a fine of €2,000 on the Ministry of Foreign Affairs for violations of Articles 5(1)(a) and 6(1)(e) GDPR, due to the unlawful inclusion of documents in the complainant’s individual file, as well as the Ministry’s failure to respond within the prescribed time limit to the complainant’s requests for access to and deletion of their personal data.

• GDPR violations by a body under the Ministry of Climate Crisis and Civil Protection: On 23 June 2025, the HDPA imposed a series of fines, reprimands and orders on the Hellenic Fire Service, which falls under the Ministry of Climate Crisis and Civil Protection, for numerous violations of the GDPR. First, the independent Authority imposed a fine of €10,000 for violation of Article 15(1) and (3) GDPR in conjunction with Article 12(3) GDPR. Second, it imposed a fine of €5,000 for violation of Article 38(1) GDPR in conjunction with Article 7(1) of Law 4624/2019, and Article 39(1) GDPR in conjunction with Article 8(1) of Law 4624/2019. Third, it issued a reprimand for violation of Article 24 GDPR. Fourth, it ordered the immediate fulfilment of the complainant’s right of access to a requested document. Fifth, it called for the adoption of guidelines for handling data subjects’ requests and effectively protecting their personal data, with the involvement of the Data Protection Officer.
• GDPR violations by the Municipality of Moschato-Tavros: On 9 October 2025, the HDPA imposed a fine of €7,000 on the Municipality of Moschato-Tavros for violations of Articles 5(1)(c), 5(2) and 25(1) GDPR, as well as a fine of €3,000 for violations of Articles 5(1)(a), 12(1) and 13 GDPR, in connection with the installation of a video surveillance system.

• Warning over potential personal data violations by the Hellenic Coast Guard: On 28 November 2025, following a request by the Hellenic League for Human Rights (HLHR), HIAS Greece, Homo Digitalis and Privacy International for the independent Authority to issue an opinion, the HDPA, pursuant to Article 15(4)(a) in conjunction with Article 82 of Law 4624/2019, warned the Hellenic Coast Guard that the intended data-processing operations that could be carried out through the use of software designed to collect data from social media were likely to violate the provisions of the law. The Authority therefore stated that the software should not be put into operation unless the necessary conditions were met, including the introduction of a specific provision in formal legislation pursuant to Article 8 of Directive (EU) 2016/680, and the carrying out of a data protection impact assessment for the processing in question, pursuant to Article 27(1) of Directive (EU) 2016/680 and Article 65(1) of Law 4624/2019.
• GDPR violations by a company partly owned by the Greek State: On 23 December 2025, the HDPA imposed a fine of €30,000 on the Public Power Corporation (PPC) for multiple violations of Article 12(3) and (4) GDPR, following complaints from citizens concerning the company’s failure to fulfil requests for access to their personal data, specifically recordings of their conversations with company representatives. The independent Authority also ordered the company to organise its internal procedures more effectively with regard to its policy for handling data subject requests. (The Greek State holds a stake of approximately 33% in PPC.)

• Warning over potential personal data violations by the Hellenic Police: On 31 December 2025, following a request by Homo Digitalis for the independent Authority to issue an opinion, the HDPA issued a warning to the Hellenic Police, pursuant to Article 15(4)(a) of Law 4624/2019, with a view to preventing the activation of the Smart Policing System. The Authority reasoned that, under the existing legal framework, any operational use of the system would constitute unlawful processing of personal data and would violate the provisions of the aforementioned law.