On 1 August 2024, the independent Data Protection Authority (DPA) published a decision in which it found that the Ministry of National Defence violated the right of access of a retired soldier to data in his personal file. As part of its decision, the DPA imposed two administrative fines totalling EUR 5,000 on the ministry for violating a number of provisions of the General Data Protection Regulation (GDPR).
Let us take a detailed look at the provisions of the GDPR that were violated by the Ministry of National Defence, as well as the administrative fines imposed against it, in accordance with the relevant competence of the DPA, as it follows from article 58 (2) of the GDPR.
The complainant, a retired soldier, lodged a complaint before the DPA against the Submarine Command of the General Staff of the Navy for violation of his right of access to personal data concerning him.
More specifically, the complainant claimed before the independent authority that he requested access to his service file and in particular to the special reports on his evaluation during his military service via an e-mail to the Ministry of National Defence. After filing this request (the DPA has deleted the time references from its decision and therefore they are not mentioned in our analysis either), the General Staff replied to the retired military officer that the Submarine Command destroys the relevant records after two years have elapsed since the retirement of military personnel and, in view of the fact that two years have elapsed since his own retirement, the data requested has been destroyed.
Following the non-fulfilment of the retiree’s request and his complaint to the DPA, the independent authority took up the case. After reviewing the evidence in the file and the hearing, to which representatives of the General Naval Forces, the Submarine Operations Command of the Salamis Naval Station and the General Staff of National Defence (GNDF) were invited, the independent authority noted that the standard protocol is to maintain data for a period of twenty years, and that the Authority required substantiation of the protocol referred to by the Ministry. The authorities however, failed to produce any evidence to substantiate the destruction of the data requested by the complainant and, consequently, of the inability to provide them to the complainant.
The DPA rejected as irrelevant the Ministry’s claim that its failure to produce the Standing Order under which the above procedure for the destruction of the contested data is regulated and carried out is due to its classified nature. The Authority maintains that it has repeatedly pointed out that the processing of personal data carried out in the field of national defence does not in any way escape the scope of the legislation on the protection of personal data.
The authority therefore maintained that the Ministry of National Defence did not provide relevant evidence showing that the procedure for the destruction of the data in question constitutes, in accordance with Article 10(5) of Law 4624/2019, “an activity concerning national security” and therefore the Standing Order should have been presented before the Authority in order for the Authority to be able to judge on the compliance of the destruction procedure with regard to the disputed data, the independent Authority noted.
The DPA concluded that the Ministry of National Defence did not sufficiently document before the Authority the impossibility of providing the requested data to the complainant, and furthermore, on the basis of the principle of accountability, it should have made available to the Authority the relevant framework of procedures for the destruction of the contested data. It also found a violation – on the part of the ministry – of the provisions of Article 15 (1, 3) of the GDPR in conjunction with the provisions of Article 12 (3, 4) of the GDPR, as well as a violation of Article 31 of the GDPR concerning cooperation with the independent authority.
Based on the above, the DPA imposed an administrative fine of EUR 2,000 on the Ministry of National Defence for violation of the provisions of Article 15 (1, 3) GDPR in conjunction with the provisions of Article 12(3, 4) of the GDPR, and an administrative fine of EUR 3,000 for infringement of the provisions of Article 31 of the GDPR.
Under the rule of law, public authorities must strictly comply with EU and national legislation on the protection of citizens’ personal data in their data processing procedures.
However, the Data Protection Authority (DPA)’s investigation has in this case documented that the Ministry of National Defence violated several provisions of the General Data Protection Regulation (Article 15 (1, 3) in conjunction with the provisions of Article 12(3 and 4) of the General Data Protection Regulation.)
Bank Account number: 1100 0232 0016 560
IBAN: GR56 0140 1100 1100 0232 0016 560
BIC: CRBAGRAA
In a time where the very foundations of democracy are gradually being eroded by the rise of extreme nationalism, alt-right movements, the spread of disinformation and corporate capture, the efforts of organisations such as Vouliwatch are more relevant than ever.
We rely on the generosity of each and every one of you to continue with our efforts for more transparency and accounta
By financially supporting Vouliwatch you support our litigation strategy, our campaigns for transparency and accountability in the political system, the development of new civic tech tools, our research projects and last but not least our impartial and accurate