The Hellenic Data Protection Authority ruled on a large-scale data breach involving the Ministry of Social Cohesion and Family Affairs and its subcontractor, the Hellenic Agency for Local Development and Local Government (EETAA) S.A.

The investigation followed a security breach affecting EETAA's information systems, used for Ministry programs, which exposed personal data of a large number of individuals, including identification, contact, financial, and health details. Although the Ministry complied with its notification obligations, the authority concluded that the success of the attack resulted from EETAA's use of outdated information systems and inadequate security measures, despite its awareness of the risks. Failures to meet the security requirements of processing (Article 32) and shortcomings in the relationship between controller and processor (Article 28) were identified.

Consequently, the authority imposed administrative fines of €200,000 on the Ministry of Social Cohesion and Family Affairs and €150,000 on EETAA. It also ordered both parties to conclude a data processing agreement compliant with Article 28 and to fully implement the measures planned to strengthen the security of their information systems.