In a decision sanctioning two companies for a total of €155,000, the Hellenic Data Protection Authority analyzes in detail the breaches related to the secondary use of video surveillance images for judicial purposes and the deliberate obstruction of the right of access of a data subject.

Facts and context

The Hellenic Data Protection Authority published on October 13, 2026, a sanction decision against the companies MEDÉ AE and MARKET IN AEVE (including the imposition of a total fine of €155,000) for breaches related to the use of a video surveillance system and compliance with the right of access.

The case originated from a complaint filed on July 21, 2023, by a natural person concerning the unlawful processing of their data by video surveillance, their communication to third parties, and the non-compliance with their right of access by the two companies.

Grounds of the decision

The authority found several GDPR violations against the two data controllers, based on the accountability principle which requires implementing appropriate measures to ensure and demonstrate compliance.

• Obligation of lawfulness, fairness, transparency, and purpose limitation (Article 5(1)(a) and (b) of the GDPR): The authority found that the two companies used video surveillance images for judicial purposes, which constitutes further processing for a purpose different from the initially intended one (protection of property and persons). This change of purpose was not communicated to the data subject, rendering the processing unlawful and unfair. The authority recalls, citing the Court of Justice of the European Union ruling in case C-201/14 (Smaranda Bara), that prior information to the data subject is an essential condition for lawful processing.

• Obligation of data minimization (Article 5(1)(c) of the GDPR): The company MARKET IN AEVE manually manipulated and redirected its cameras to specifically target and record the complainant's vehicle. The authority judged that this action, which was not part of the normal operation of the security system, constituted irrelevant and excessive data collection regarding the initial purpose, thus violating the minimization principle.

• Obligation of transparency and information (Article 12 and Article 13 of the GDPR): The two companies did not provide the complainant with the information required by the GDPR. The video surveillance information signs were incomplete and, above all, no information was communicated about the further processing of images for judicial purposes, violating Article 13(3). Moreover, by responding to the complainant's requests with unnecessary clarification demands, they hindered the exercise of their rights instead of facilitating it, as required by Article 12.

• Right of access (Article 15 of the GDPR): The data controllers did not respond satisfactorily to the complainant's clear access request. They initially denied the communication of data before admitting it and did not provide a copy of the personal data processed and communicated to judicial authorities, thus failing to comply with the obligations under Article 15(1) and (3).

• Obligation to cooperate with the supervisory authority (Article 31 of the GDPR): The company MARKET IN AEVE did not cooperate with the authority during the investigation, notably by not responding to communications and not submitting a defense statement despite the deadlines granted. This behavior was qualified as a separate breach.

• Obligation to notify the contact details of the data protection officer (Article 37(7) of the GDPR): The authority noted that the company MEDÉ AE had not communicated the contact details of its data protection officer, as required by this provision.

Authority's decision

Consequently, the authority imposed a fine of €60,000 on MEDÉ AE and a fine of €95,000 on MARKET IN AEVE.

Lessons learned

This decision confirms that:

• The use of video surveillance recordings in the context of judicial proceedings constitutes processing for a new purpose that must be subject to specific information to the data subject, in accordance with Article 13(3) of the GDPR.

• Manually manipulating a surveillance camera to target a specific person or vehicle goes beyond the legitimate purpose of protecting property and persons and violates the data minimization principle.

• Responding to an access request with unjustified clarification demands, aiming to delay or evade the response, constitutes a violation of the obligation to facilitate the exercise of data subjects' rights (Article 12 of the GDPR).