Not fulfilling a data subject access request 30K Euros fine
Hellenic DPA fines Company for failure to comply with a data subject’s access request for a video recording, resulting in a € 30’000 GDPR Fine.
Based on the complaint of a data subject, the Greek Data Protection Authority imposed the fine because the company had not properly complied with the complainant’s request for information.
The data subject was involved in a car accident on the company premises of ΟΡΓΑΝΙΣΜΟ ΛΙΜΕΝΟΣ ΗΡΑΚΛΕΙΟΥ, which had been recorded by the company’s video surveillance system. However, when he submitted a written request to the fine recipient for access to the recordings, he was denied. Initially, ΟΡΓΑΝΙΣΜΟ ΛΙΜΕΝΟΣ ΗΡΑΚΛΕΙΟΥ had invoked alleged data protection reasons for this.
Later, the company had in turn claimed that the records had already been deleted and could therefore not be handed over to the person concerned. However, a check by the authority revealed that the data had still been available at the time of the request.