The Hellenic Data Protection Authority sanctioned a company for failing to comply with its cooperation obligation, demonstrated by its repeated absence from hearings, even before ruling on the substance of the complaint regarding unlawful video surveillance.

Facts and context

The Hellenic Data Protection Authority (hereinafter the authority) issued a sanction decision against Ap. Polyzos Construction P.C. – APL, including the imposition of a fine of €3,000, for failing to cooperate with the authority.

The case originated from a complaint by an employee concerning the installation of a hidden camera in the company's women's restroom, which allegedly recorded videos and photos of the employees.

Reasons for the decision

The authority found a single breach by the company:

• Obligation to cooperate with the supervisory authority (Article 31 of the GDPR): During the investigation of the complaint, the authority summoned the company twice for hearings. The company did not attend either session. For the first, no justification was provided. For the second, the company submitted a brief the day before the hearing, requesting a postponement of the procedure due to ongoing civil and criminal disputes on the same facts, but sent no representative. The authority considered that this repeated absence, despite proper summons, constituted an obstruction to its investigative duties and a manifest violation of the cooperation obligation imposed by the GDPR.

Authority's decision

Consequently, the authority imposed a fine of €3,000 on Ap. Polyzos Construction P.C. – APL.

Furthermore, the authority specified that it reserves the right to rule on the substance of the complaint (the legality of the video surveillance system) at a later date, this decision only addressing the failure to cooperate.

Lessons learned

This decision reminds that:

• The obligation to cooperate with the supervisory authority, provided for in Article 31 of the GDPR, is an autonomous obligation whose breach can be sanctioned independently of other potential violations under investigation.
• Submitting written observations does not exempt a data controller from the obligation to attend a hearing when summoned by the supervisory authority; absence constitutes a failure to cooperate.
• The existence of parallel judicial proceedings (civil or criminal) on the same facts does not constitute a legitimate reason to refuse to cooperate with the supervisory authority or to fail to attend a summons.