Hellenic Data Protection Authority (HDPA) · 25 September 2023
Athens Urban Transport Organization
Non-compliance with general data processing principles
- Regulator
- Hellenic Data Protection Authority (HDPA)
- Decided
- 25 September 2023
- Country
- Greece
- Sector
- Transportation and Energy
- Regulator’s reference
- Not recorded
- Fino case number
- 2023/GR/004
What happened
The Hellenic DPA (HDPA) fined the Athens Urban Transport Organisation (OASA) €50,000 for violating Article 5(1)(e), as their electronic ticketing system was in violation of the principle of storage limitation. Moreover, the HDPA reprimanded OASA for violating Article 35(1) GDPR, as the data protection impact assessment they submitted to the HDPA for their electronic ticketing system was insufficient.
Summary from the GDPRhub page for this decision, written by its volunteers, not by Fino. CC BY-NC-SA 4.0.
Rules involved
- Art. 5Principles relating to processing of personal data5(1)(e)Read →
- Art. 25Data protection by design and by default25(1)Read →
- Art. 35Data protection impact assessment35(1)Read →
- Accountability
- DPIA
- Data principles
Sources
The facts on this page come from the sources above, as they recorded them. Nothing has been estimated or filled in. Not legal advice.
Spotted a mistake? Write to angelillolorenzo@gmail.com and quote 2023/GR/004.