Background information
Date of final decision: 9 March 2022
Cross-border case or national case: National case
Controller: Foreign languages private school
Legal Reference: GDPR: Article 5(1)(a): Principle of lawfulness, fairness and transparency. Article 5(2): Principle of accountability. Article 13: Information to be provided where personal data are collected from the data subject. Article 21: Right to object
Decision: Infringement of the GDPR, Administrative fine
Key words: Right to object, unlawful processing of personal data
Summary of the Decision
Origin of the case
A teacher (employee) complained that the controller-owner of a foreign languages private school constantly monitored his/her online courses, taught via “Zoom” platform, despite his/her objections.
Key Findings
The Greek Supervisory Authority (SA) found that the right to object of the complainant was not satisfied by the controller and that the processing in question was carried out in breach of the provisions of Articles 5(1)(f)(a), 5(2) and 13 of the GDPR and in any case without clearly specifying the legal basis upon which it is based, in accordance with Article 6 of the GDPR.
Decision
The Greek Supervisory Authority (SA) imposed a fine of €2,000 οn the controller-employer for failure to satisfy the right to object of the complainant and infringement of Articles 5(1)(a), 5(2) and 13 of the GDPR in accordance with Articles 58(2)(i) and 83(5)(a) and (b) of the GDPR.
For further information: Decision 12/2022 (EL)
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.