A public authority cannot rely on a legal transparency obligation to publish personal data if the acts concerned are not explicitly targeted by the law, such processing then lacking a legal basis and justifying the exercise of the right to erasure.

Facts and context

The Hellenic Data Protection Authority today published a sanction decision against the Decentralized Administration of the Aegean Sea, including the imposition of a fine of €2,000, for breaches related to the publication of personal data on a transparency portal without a valid legal basis.

The case originated from a complaint by an engineer whose name appeared in eleven refusal of authorization decisions published online on the "Clarity" portal (ΔΙΑΥΓΕΙΑ).

Grounds of the decision

• Obligation of lawfulness of processing (Article 5(1)(a) of the GDPR and Article 6(1)(c) of the GDPR): The administration justified the publication of the contested decisions, containing the complainant's name, by a legal transparency obligation. However, the authority found that the national legislation invoked (Article 4(10) of Ministerial Decision 146896/2014) only imposed publication for granted water resource exploitation permits, not for refusal decisions. In the absence of a specific legal provision requiring publication of these refusals, the processing lacked a legal basis within the meaning of Article 6(1)(c) of the GDPR, thus violating the lawfulness principle of Article 5(1)(a) of the GDPR.
• Obligation to respect the right to erasure (Article 17(1)(d) of the GDPR): The complainant exercised her right to erasure, which the administration rejected invoking the exception of Article 17(3)(b) of the GDPR relating to compliance with a legal obligation. The authority held that, since the initial processing was unlawful, the erasure condition under Article 17(1)(d) of the GDPR ("the personal data have been unlawfully processed") was met. Consequently, the invoked exception was not applicable, as there was no legal obligation justifying keeping the data online, and the administration should have complied with the deletion request.

Authority's decision

Consequently, the authority imposed a fine of €2,000 on the Decentralized Administration of the Aegean Sea.

Furthermore, the authority ordered the immediate deletion of the eleven decisions from the "Clarity" program and issued a reprimand for violation of the right to erasure.

Lessons learned

This decision reminds that:

• The existence of a legal obligation justifying data processing, including publication, must be interpreted strictly and cannot be extended by analogy to situations not explicitly provided for by law.
• The unlawfulness of the initial data processing constitutes an autonomous ground justifying the exercise of the right to erasure under Article 17(1)(d) of the GDPR.
• A controller cannot invoke the exception to the right to erasure based on a legal obligation (Article 17(3)(b) of the GDPR) if the supervisory authority has previously found that this same legal obligation did not exist for the initial processing.