15/2026

Athens, July 28, 2026 Ref. No. 3163 DECISION 15/2026 The Data Protection Authority (hereinafter the “Authority”), met, upon invitation by the Acting Chair, Deputy , Georgios Batzalexis, for a meeting via teleconference on December 11, 2025, following a postponement from the meeting scheduled for December 2, 2025, in order to examine the case referred to in the background of this document. Present were the Deputy Chairman, Georgios Batzalexis, and the regular members Spyros Vlachopoulos, Konstantinos Lambrinoudakis, Charalambos Anthopoulos, Christos Kalloniatis, and Katerina Iliadou, as well as the alternate members Demosthenes Vougioukas, as rapporteur, and Maria Psalla, replacing regular member Grigoris Tsolias, who, although duly summoned in writing, did not was unable to attend due to a conflict of interest. Present, at the request of the Vice Chair, without the right to vote, were Georgia Panagopoulou and Ioannis Lykotrafitis, experts IT specialists, serving as assistant rapporteurs, and Irini Papageorgopoulou, an employee of the Authority’s Administrative Affairs Department, serving as secretary. The Authority took the following into consideration: The Ministry of Social Cohesion and Family (hereinafter “YKOISO”) submitted to the Authority, pursuant to Regulation (EU) 2016/679 (General Data Protection Regulation—hereinafter referred to as the GDPR), the notification with ref. no. Γ/ΕΙΣ/1943/07-03-2025 regarding a personal data breach. In this regard, the Hellenic Society for Local Development and Local Government S.A. (hereinafter EETAA) also submitted the ref. no. Γ/ΕΙΣ/1981/10-03-2025 regarding the same personal data breach incident. The notifications concerned data breaches information systems operated by EETA in its capacity as a processor acting on behalf of the controller, YKOISO. Subsequently, in response to an email (Ref. No. Ref. No. Γ/ΕΞΕ/846/10-03-2025) from the Authority to YKOISO, requesting clarifications regarding the type/categories of data affected by the incident, the type/categories and number of data subjects were affected, the roles of the involved entities with respect to the processing and the files that were affected; YKOISO submitted a document bearing ref. no. Γ/ΕΙΣ/2201/17- 03-2025, which states, among other things, the following: According to its report to the YKOISO dated March 6, 2025, the EEETAA suffered a series of cyberattacks, which were first detected on March 3, 2025, and continued to occur until March 5, 2025, at which time they were documented verified by the EETAA. These cyberattacks concerned personal data held by the EETAA for the purposes of implementing Action (a) “Promotion and support of children for their inclusion in preschool education, as well as for the access of school-age children, adolescents, and people with disabilities to creative activity services” (program “Daycare Centers”) for the periods 2014–2015 through 2024–2025 and the pilot App for Action (b) “Neighborhood Nannies.” It should be noted that, in accordance with the provisions of Joint Ministerial Decisions No. 99310 EX 2024 of July 10, 2024 (Government Gazette B 4056) and Joint Ministerial Decision No. 6457 of January 27, 2022 (Government Gazette B 205), respectively. Specifically, with regard to action (a) above, EETAA is the sole processor and is responsible for carrying out all processing operations related to the implementation, Surveillance, and management of the physical and financial scope of the action; in action (b) above, EETAA acts as a joint processor of data, together with the “National Network for Technology and Research Infrastructure S.A.” (EDYTE), although EDYTE’s role is limited primarily to processing related to the execution of payments and the management of the financial aspects of the project. 2 More specifically, regarding these security incidents, according to relevant officials from the EETAA’s Information Technology and Documentation Directorate, who verified the incident, the breach resulted from cyberattacks of the “ransomware” type, which occurred in two phases and lasted a total of from the early morning hours of March 1, 2025, until 2:00 p.m. on March 5, 2025, at which point EETAA’s Management and DPO were notified. As a result of these attacks, the databases were encrypted and possibly downloaded/stolen (according to a note left by the attackers) the databases of the information systems that support the implementation of the two actions mentioned above. It should be noted, that the scope of this data breach is limited to the servers and databases hosted on-site (on- site) of EETAA and did not extend to information systems hosted by other providers in the cloud. Given that at 2:00 p.m. on March 5, 2025, the incident was still ongoing, with no means of containing it, the responsible EETAA officials proceeded to terminate the operations of all affected information systems and place them in “offline” status. This made it impossible to investigate the origin of the cyberattack, as well as the vulnerability that allowed it to occur. An investigation by the relevant EETAA officials identified the vulnerability exploited by the malware, which is described in the Confidential Annex, Point 1. Furthermore, the EETAA’s report to the Ministry of Digital Governance dated March 6, 2025 describes the measures that had been taken prior to the incident, which are included in the Confidential Annex, Point 2, as well as the measures taken immediately after the incident, which are included in the Confidential Annex, Point 3 of this document. Given that, in this case, the cyberattack may have allowed unauthorized persons to gain access to personal data held by EETAA, this incident constitutes a breach of the confidentiality of said personal data. At the same time, the outage of the affected information systems constitutes a data breach of the availability of the personal data as well. Finally, given that at this stage it is estimated that it is possible to restore and restore the affected databases, no breach of the integrity of the personal data stored therein has been identified. In the same supplementary incident report, YKOISO states the following regarding the affected data subjects and the corresponding personal data: With regard to the Action “Promotion and support of children for their integration into preschool education, as well as for the access of school-age children, adolescents, and individuals with disabilities to creative activity services,” the breach specifically concerns the personal data of those applying to participate in the Program, other family members (spouses/partners), and their minor children. More specifically, the data pertains to: a) The beneficiary (infant, toddler, and preschool-aged child, as well as school-age children, adolescents, and individuals with disabilities who fall into the relevant categories and meet the requirements of the applicable Joint Ministerial Decision in order to receive a “placement voucher.” Personal data in this category include: a. Full name, father’s name, b. Date of birth, c. Gender, d. Tax Identification Number (AFM), e. Social Security Number (AMKA), f. Indication of disability and related certificates, h. Indication of adoption/custody/guardianship, g. Income details (income and corresponding tax), h. Daily attendance records at the program’s facilities (time of entry and exit) b) The legal representative/applicant (parent or person with parental responsibility or custody, the foster parent, the guardian, or the advocate for the beneficiary). Personal data in this category include: a. Full name, father’s name, mother’s name; b. Date of birth; c. Nationality and in the case of non-CJEU nationals, a Residence Permit or a relevant application for renewal; d. Address and contact information; e. Marital status; f. Employment status of the applicant and spouse/partner; g. Tax ID number (AFM) and tax office of the applicant and 4spouse/partner; h. AMKA (Social Security Number) of the applicant and spouse/partner; i. Gender; j. Indication of disability status of the applicant and/or spouse/partner and/or child; k. Information on children, etc., dependent family members (full name, date of birth, disability status), (l) Income income of the applicant and spouse/partner (income and corresponding tax) c) To the legal representative of the Agency/Facility (legal representative of the Organization that provides preschool education, care, and creative activities for children and/or individuals with disabilities, within the framework of the Action). The personal data in this category include: a. Full name, father’s and mother’s names, b. Date of birth, c. Address and contact information, d. AMF, e. Proof of social security and tax compliance, f. IBAN of bank account, g. Remuneration for services rendered within the scope of the Action. (d) On the Organization/Structure form (for employees of an organization referred to in para (c) above). The personal data in this category include: (a) Full name, (b) Tax Identification Number (TIN), c. Status According to the same report, given the scope covered by the retention period for the compromised data (a total of 10 years), it is roughly estimated that the number of requests may amount to 700,000 and concern approximately 2,500,000 data subjects. With regard to the pilot App of the “Neighborhood Nannies” initiative, the breach concerns the personal data of the beneficiary (a person who has custody of an infant or toddler). Due to the pilot nature of the project, the total number of such data subjects amounts to approximately 700 individuals. The personal data for this Action include: a. Full name and father’s name, b. Tax ID number, c. Date of birth, d. Address and contact information, e. IBAN of bank account. Subsequently, in an email with reference number Γ/ΕΙΣ/2687/01-04-2025 , YKOISO informed the Authority that it had issued a Press Release on March 31, 2025 regarding the data breach, which was also posted on the YKOISO website. Furthermore, in that message, it stated that, following its actions, YKOISO intends to notify the data subjects individually and that the Authority will be informed as soon as this process is completed. Subsequently, in document no. Γ/ΕΙΣ/5253/12-06-2025, YKOISO informed the Authority that the individual notification of the data subjects whose data were included in the compromised information systems was completed on June 10, 2025, by sending messages to the contact information they had provided (e-mails/SMS). The messages were sent by YKOISO, and the message read as follows: “YKOISO informs you that on Wednesday, March 5, 2025, a cyberattack occurred on the information system of the Hellenic Society for Local Development and Local Government S.A. (EETAA), which manages the “Day Care Centers” and “Neighborhood Nannies” on behalf of the Ministry. The Ministry’s information system was not compromised. Nevertheless, YKOISO, as the data During processing, it immediately reported the incident to the Data Protection Authority and instructed EETAA to take all necessary steps to immediately restore the information system so that it would be able to fulfill its obligations arising from the aforementioned actions. Given that the cyberattack may have allowed unauthorized individuals to gain access to your personal data, the Ministry urges applicants, beneficiaries, and employees involved in the above initiatives to be particularly cautious and not to respond to emails , text messages, or phone calls asking them to provide their personal data (especially financial data, such as bank accounts or credit cards, etc.) or to take any actions related to the above, as these may constitute malicious acts.” None of the messages sent received a system notification indicating that 1 https://minscfa.gov.gr/enimerosi-ypokeimenon-vasei-tou-arthrou-34-tou-genikou-kanonismou- prostasias-dedomenon-ee-2016-679-gkpd/ 6 it was not received or that the transmission was unsuccessful. Subsequently, the Authority summoned YKOISO and EETA via letters bearing ref. nos. G/EXE/3025/01-09-2025 and G/EXE/3030/01-09-2025, respectively, to a hearing via teleconference. The following individuals joined the teleconference on September 9, 2025: Grigoris Lazarakos, Lawyer representing EETAA, Bar Association Registration No. …, A, DPO of YKOISO with Bar Association registration number …, Ioannis Golnas, lawyer with Bar Association registration number …, Georgia Korma, lawyer and associate at the Office of the Minister of Social Cohesion and Family with Bar Association No. …, Georgia Dremetika, lawyer at the Office of the Minister of Social Cohesion and Family, Bar Association registration number …, Chrysa Papaikovou, lawyer to the Deputy Minister of Social Cohesion and Family, Bar Association ID No. …, B, Director in the Office of the Secretary General for Equality and Human Rights, Stavroula Georgoulea, Lawyer and advisor to the Office of the Secretary General for Demographic and Housing Policy, Bar Association Registration No. … Registration No. …, C, Head of the Family Cohesion Support Section of the Directorate of Child and Family Protection, D, Head of the Human Resources Management Section Human Resources of the Directorate of Human Resources Support and Services of YKOISO, and E, Deputy Director of the e-Governance Directorate of YKOISO. The EETAA representative requested a postponement of the hearing due to the company’s General Meeting. Subsequently, October 21, 2025, at 10:45 a.m. as the new date for the hearing, without a new summons being issued. The following participants joined the teleconference on October 21, 2025: On behalf of YKOISO: A, DPO, lawyer with Bar Association registration number…, Stavros Zouboulidis, lawyer with Bar Association registration number…, Georgia Korma, associate at the Office of the Minister of Social Cohesion and Family, Lawyer with Bar Association registration number…, Georgia Dremetika, associate at the Office of the Minister of Social Cohesion and Family, lawyer, Bar Association registration no. …, Chrysa Papaiakovou, adviser to the Deputy Minister of Social Cohesion and Family, lawyer, Bar Association registration no. Bar Association…, B, Director in the Office of the Secretary-General for Equality and Human Rights, Stavroula Georgoulea, staff member in the Office of the General Secretary for Demographic and Housing Policy, Lawyer, Bar Association No. …, C, head of the Family Cohesion Support Division of the Directorate Child and Family Protection, D, Head of the Human Resources Management Section of the Directorate of Human Resources Support and Services of the Ministry of Digital Governance, and E, an official of the e-Governance Directorate of the Ministry of Digital Governance. On behalf of EETAA: F, CEO of EETAA, Evangelos Barbouris, Head of the Legal Support Directorate of EETAA, Lawyer with bar association registration number …, G, Head of the Independent Department of Quality Management and Data Protection at EETAA, H, acting Head of the Documentation and Information Department of EETAA; and Grigoris Lazarakos, a lawyer with Bar Association registration number … Subsequently, YKOISO submitted, within the deadline, the memorandum bearing ref. no. Γ/ΕΙΣ/11578/10-11-2025 along with the relevant supporting documents. Similarly, EETA submitted, within the deadline, the brief bearing ref. no. Γ/ΕΙΣ/11477/07-11- 2025. Specifically, in its aforementioned memorandum, YKOISO briefly states, among other things, the following: YKOISO bore no responsibility for the breach in question, as the affected systems belong exclusively to EETAA. The YKOISO information system was not compromised. YKOISO acts in its capacity as a controller within the framework of the aforementioned programs , responsibility for which was transferred to it by the Ministry of Labor. The delegation of the implementation of the aforementioned programs to EETAA is entirely lawful and based on the legal and contractual framework. As soon as YKOISO became aware of the data breach, it immediately took the actions provided for in Articles 33 and 34 of the GDPR to notify incident to the Authority and to inform the data subjects as soon as it became technically feasible. Furthermore, it immediately contacted EETAA as the processor in order to take all necessary measures to address the incident so that the restore system availability and minimize any consequences for data subjects. Consequently, YKOISO acted strictly within framework of its legal obligations. Regarding the applicable legal and contractual framework for the implementation of these 8 programs, YKOISO states: The “Daycare Centers” program is provided for in Article 104 of Law 4941/2022 “Reform of the Institutional Framework Governing the Operation of the Financial Stability Fund and the Investment Services Guarantee Section, modernization of the Public Debt Management Agency, and other urgent provisions” and is being implemented within the framework of the NSRF Programming Period 2021–2027. The body responsible for implementing these programs is the EETAA, in accordance with the provisions of Article 104 of Law 4941/2022. Specifically, regarding the selection of EETAA as the implementing agency for these programs, the selection procedure provided for in the relevant provisions of the NSRF 2021–2027 under Law 4914/2022 and the regulatory procedures set forth therein, in combination with Article 104 of Law 4941/2022. More specifically, for the implementation of the program, a Joint Ministerial Decision is issued annually titled Management, Evaluation, Surveillance, and Control System—Procedure App for Implementing the Action ‘Promotion and Support of Children for Their Inclusion in Preschool Education, as well as for Access by School-Age Children, adolescents, and individuals with disabilities to creative activity services.” Each relevant Joint Ministerial Decision stipulates that EETAA is responsible for implementing the program as the program beneficiary, and that for the purposes of program implementation, EETAA serves as the processor of the program’s data, with the data controllers being the Ministry of Infrastructure, Transport, and Networks and the Ministry of National Economy and Finance. For the implementation of the 2 program, the corresponding Joint Ministerial Decisions (JMDs) have been issued. With regard to personal data, paragraph 2 of article 17 of each JMD stipulates that during the implementation of the Program, comply with the requirements of the General Data Protection Regulation (GDPR), Law No. 4624/2019, as well as the provisions set forth in the decisions of the Data Protection Authority, in order to ensure all relevant provisions regarding the processing of personal data and 2 For the period 2022–2023, Joint Ministerial Decision No. 77094/August 1, 2022 [B 4049] was issued. For the period 2023–2024, the Joint Ministerial Decision 134974/EX 2025/July 29, 2025 [B 4127] with a two-year term of validity, as amended and currently in force, by Joint Ministerial Decision 15670/2025 (Government Gazette B’ 5646). 9data protection for both the data in question and the data subject rights. Furthermore, the relevant data processing agreement, bearing ref. no. 15321/2022, was signed on November 4, 2022, “which, due to the successive, continuous, and uninterrupted App of this program, with corresponding Joint Ministerial Decisions of 11-month formal validity, fulfills the respective obligations of the Ministries and EETA regarding data protection. It should be noted that the need for the annual issuance of these Joint Ministerial Decisions covered exclusively administrative obligations related to the management of the daycare program with regard its funding and, within the framework of that funding, the manner of handling, primarily, the employment contracts of staff employed at municipal daycare centers participating in the program, since since these are staff employed at these facilities under renewable employment contracts corresponding to the duration of the school year.” In other words, the substance of the obligation of confidentiality and data protection remains consistently the same, while the EETAA system also remained the same each year and under each Joint Ministerial Decision. As part of the implementation of the above project, and specifically regarding the processing of personal data carried out by EETAA for the provision of the services referred to in Joint Ministerial Decision No. 77094/1.8.2022, a Data Processing Agreement between YKOISO and EETAA. Among other things, this Agreement states, regarding the security of processing, that EETAA implements at least the technical and organizational measures set forth in Annex II of the Agreement in order to safeguard personal data, including data protection against a security breach that results in accidental or unlawful destruction, loss, alteration, unauthorized authorization. When assessing the appropriate level of security, the parties shall duly take into account the latest developments, the costs of implementation, the nature, scope, context, and the processing purposes, as well as the risks posed to data subjects. It is also noted that, in the event that EETAA 10breaches its obligations under the Agreement, UKOISO may order EETAA to suspend processing until EETAA complies with the Agreement. Furthermore, EETAA shall immediately notify YKOISO if it is unable to comply with the Agreement for any reason. Annex II of this Agreement states, among other things, that EETAA implements a comprehensive Personal Data Protection Policy, particularly in the areas ensuring the availability, integrity, and confidentiality of EETA’s information resources, such as ICT equipment and systems (including protection of systems against viruses and other malware, backup procedures, etc.) as well as the network and Information Systems (including perimeter security, Surveillance and control, software updates, use of VPNs for remote access, etc.). Regarding the “Neighborhood Nannies” program, this is provided for in provisions of Article 44 of Law 4837/2021 [A 178], while Joint Ministerial Decisions Nos. 6457/2022 [B 205] and 26460/2022 [B.1328], respectively, regulated the operational aspects of the registry of caregivers and the information system for selecting beneficiaries. To finance the pilot program, Decision No. 76042EX2024/May 30, 2024, Act of the General Secretary for Program Management of the European Social Fund was issued to finance the Action “Pilot App for the ‘Neighborhood Nannies’ initiative’ under the Human Resources and Social Cohesion Program, with the General Secretariat for Equality and Human Rights, the National Infrastructure, Technology, and Research Network S.A. and EETAA.” The duration of the project was set from February 1, 2022, to March 31, 2025. Specifically, within the framework of this program, EETAA undertook the implementation Subproject 5; furthermore, for this purpose, a program contract dated May 12, 2022, was signed between the General Secretariat for Equality of the Ministry of Labor and Social Affairs [as of June 27, 2023, YKOISO], which regulates confidentiality matters regarding data protection. It should be noted that the vulnerability exploited by the malicious 11software that carried out the attack—and which is described in the confidentiality Appendix, Point 1, concerns a system used to support outdated apps that supported the “Database for Abused Women.” This program was implemented and funded by the NSRF 2014–2020 with resources from the European Social Fund under the Operational Program “Administrative Reform.” Specifically, pursuant to Decision No. 1522/August 12, 2016, of the Special Secretary for the Management of Sectoral Programs of the European Social Fund for the Programming Period NSRF 2014–2020, the project was incorporated into and funded by the Operational Program Administrative Reform. The beneficiary of the Program was EETAA, and the funding agency—the competent ministry—was the Ministry of the Interior. This action was initially funded for the period from January 1, 2016, to December 31, 2021, and subsequently, following successive amendments, through December 31, 2023, with a final expiration date of April 16, 2024. For the period following the completion of the project and given the transfer of the substantive authority of the General Secretariat for Equality to YKOISO (which was established on June 27, 2023) and for the purpose of the continued operation of this system, it was decided to assume costs of the program agreement in question from the regular budget of YKOISO for two fiscal years (2024–2025). Finally, on December 19, 2024, Program Agreement No. 7883/14.12.2024 was signed between the General Secretariat for Equality and Human Rights of the Ministry of Equality, Social Solidarity, and Social Inclusion and EETAA, the programmatic agreement No. 7883/December 14, 2024, in which the confidentiality provisions pertaining to the system in question are included in Article 10 thereof, pursuant to which, in paragraph d), “EETAA shall comply with the obligations arising from the General Data Protection Regulation (GDPR), applicable national and EU legislation, and maintains all necessary licenses regarding data protection,” while paragraph (e) states that “H.E.E.T.A.A. is obligated to take all necessary measures to protect the database and the information and data it contains from any cyber threats and cyberattacks in accordance with national and EU legislation.” 12 Finally, the Ministry of Digital Governance states that regarding EETAA’s claim, made during the hearing on October 21, 2025, that it had informed the Ministry of Digital Governance of the need upgrade its systems to make them more secure and more functional—even though the relevant authority falls outside YKOISO’s and lies with the Ministries of the Interior and of National Economy and Finance, no such communication or notification appears to have taken place regarding the transfer of jurisdiction over the “Daycare Centers” and “Neighborhood Nannies” programs to the Ministry of Social Affairs and Solidarity. Accordingly, in its aforementioned memorandum, EETAA briefly states, among other things, the following: The primary cause of this incident is believed to be the presence outdated software on several servers within EETAA’s IT infrastructure. These systems supported programs that served the public interest (such as the server hosting the program to support abused women), which (programs) EETAA could not discontinue, on the one hand, because they existed to serve the public interest and there was a policy decision to continue them, and, secondly, because discontinuing them fell under the exclusive authority of the data controller, YKOISO, and not EETAA, which merely acted as “processor.” Following the incident, EETAA commissioned a specialized company to conduct a thorough audit and cleanup of all its Information systems Systems of any malware that may have been installed on them during the cyberattack, restore its computer systems, and to strengthen the security of its Information Systems. For years now, EETAA has been undertaking projects and initiatives with extremely high demands on technological infrastructure and even greater demands regarding information security regarding the data processed in its Information Systems. These projects and initiatives involve large-scale processing of personal data, which entails serious risks regarding the assurance of confidentiality, integrity, and 13availability of data, as well as business continuity (Business Continuity)—that is, the organization’s inherent ability to consistently provide its services at acceptable, predefined qualitative and quantitative levels, even after the occurrence of events that cause an interruption in the operation of its core technological infrastructure. Unfortunately, EETAA’s ability to provide the services required by its institutional role—while respecting and, above all, ensuring the security of the personal data of the beneficiaries of each program, is being further diminished due to the ongoing reduction in regular staff, especially after 2020, and the high average age—factors that have created significant shortages in many sectors, both in terms of required staffing and skill adequacy. EETAA, recognizing the risk posed to current, as well as future programs—but above all, the personal data of beneficiaries processed in its information systems— commissioned, three years ago, a company specializing in the field of cybersecurity to conduct a series of audits to assess the vulnerability of its systems to cyberattacks, as well as the provision of relevant consulting services to EETAA. The initial findings, which EETAA received verbally toward the end of 2022, were alarming and reinforced the conviction that immediate improvement of EETA’s Information and Communication Technology infrastructure was necessary, along with strengthening the security of the systems and data security, as well as integrating the use of ICT at all levels of EETAA’s operations, with the ultimate goal of achieving efficiency and efficiency in the provision of services and the achievement of its objectives, while respecting beneficiaries and, in particular, their personal data, which is processed in its systems. EETAA states in its memorandum that, in light of the above, the relevant IT staff, the Data Protection Officer, and, most importantly, the Management 14 of EETAA, initiated a series of contacts with the three relevant ministries (Interior, Digital Governance, and YKOISO) in order to secure the necessary financial resources that would enable EETAA to address and resolve the aforementioned problems—namely, to modernize its information systems and strengthen security measures to ensure the protection of personal data in particular that were stored and processed in those systems. In fact, EETAA notes that these contacts were successful, as one year later, on October 21, 2024, a Program Agreement was signed between EETAA and KtP S.A. for the upgrade of EETAA’s information systems (specifically, the title of the agreement is “Digital Transformation of EETA S.A.”). This agreement was not implemented because the relevant Technical Data Sheet was submitted on January 21, 2025, approximately one month before the data breach. The measures planned to be taken are described in the Confidential Annex, Point 4. Finally, EETA notes that it could not have halted the implementation of the programs when it became aware of the underlying security issues, nor could it refuse to provide services and implement the Programs in the coming years, but was obligated to provide—both then and in the future—its services with the available resources and to the best of its ability, while simultaneously striving to keep the relevant authorities (ministries) constantly informed about the status of its Programs and the security conditions. Furthermore, EETAA itself did not have the substantial financial resources needed to modernize its information systems, as it was entirely dependent on government funding. The Authority, after reviewing the case file and hearing the rapporteur and the clarifications provided by the assistant rapporteurs, who were present without the right to vote, and following a thorough discussion, 15 CONSIDERED IN ACCORDANCE WITH THE LAW

It follows from the provisions of Articles 51 and 55 of the GDPR and Article 9 of Law 4624/2019 (Government Gazette A’ 137), it follows that the Authority has the competence to supervise the implementation of the provisions of the GDPR, this Law, and other regulations concerning the protection of individuals with regard to the processing of personal data.

According to Article 4(12) of the GDPR, a “personal data breach ” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to personal data that has been transmitted, stored, or otherwise processed.”

According to Article 4(1) of the GDPR, personal data is “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one whose identity can be determined, directly or indirectly, in particular by reference to an identifier such as a name, an an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural, or

According to Article 4(8) of the GDPR, the processor is “the natural or legal person, public authority, agency, or other body that performs personal data processing on behalf of the controller .”

Article 5(1) of the GDPR sets forth the principles governing the processing of personal data. These include the principles of integrity and confidentiality (subparagraph (f)), according to which data shall be processed in a manner that ensures appropriate security of personal data, including, among other things, protection against unauthorized or unlawful processing and 16 accidental loss, destruction, or damage, through the use of appropriate technical or organizational measures.

Furthermore, in accordance with the principle of accountability introduced by the second paragraph of the aforementioned Article 5, it is expressly stipulated that the controller “shall be responsible for and be able to demonstrate compliance with paragraph 1 (“accountability”)”. This principle, which constitutes a cornerstone of the GDPR, entails the obligation of the controller to design, implement, and generally adopt the necessary measures and policies, so that data processing complies with the relevant legal provisions and, furthermore, to be able to demonstrate at any time compliance with the principles of Article 5(1) of the GDPR.

In accordance with the definitions in Article 25 of the GDPR: “1. Taking into account the latest developments, the costs of app development, and the nature, scope, the context and the processing purposes, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons arising from the processing, the controller shall implement, effectively, both at the time of determining processing operations and during processing, appropriate technical and organizational measures—such as pseudonymisation—designed to implement data protection principles, such as data minimisation, and to incorporate the necessary safeguards into the processing in such a way as to meet the requirements of this Regulation and to protect the data subject rights.”

Article 28(3) of the GDPR provides that: “Processing by the processor shall be governed by a contract or other legal act under Union or Member State law, which binds the processor in relation to the controller and specifies the scope and duration of the processing, the nature and processing purpose, the type of personal data and the categories of data subjects, and the obligations and rights of the controller. Such a contract or other legal instrument shall provide, in particular, that the processor: 17 (a) processing of personal data is carried out only on the basis of documented instructions from the controller (…) c) takes all necessary measures pursuant to Article 32 (…) f) assists the controller in ensuring compliance with the obligations arising from Articles 32 through 36, taking into account the nature of the processing and the information available to the processor (…) (h) makes available to the controller any necessary information regarding processing information to demonstrate compliance with the obligations set forth in this article and shall allow for and facilitate audits, including audits, carried out by the controller or by another auditor authorized by the controller .”

Article 32(1) and (2) of the GDPR provide that: “1. Taking into account the latest developments, the costs of implementation, and the nature, scope, context, and the processing purposes, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks (…) 2 When assessing the appropriate level of security, , particular account shall be taken of the risks arising from the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to personal data that have been transmitted, stored, or otherwise processed .”

According to Article 33 of the GDPR: “1. In the event of a personal data breach, the controller shall notify the supervisory authority without undue delay and, if possible, within 72 hours of becoming aware of the fact, the personal data breach to the SA that is competent pursuant to Article 55, unless the personal data breach 18 is unlikely to pose a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by an explanation for the delay. (...) 3 The notification referred to in paragraph 1 shall, at a minimum: (a) describe the nature of the personal data breach , including, where possible, the categories of data and approximate number of data subjects affected, as well as the categories and approximate number of personal data files; (b) provides the name and contact information of the data protection officer or other point of through which further information can be obtained; c) describes the potential consequences of the data breach , (d) describes the measures taken or proposed to be taken by the controller to address the personal data breach, as well as, where appropriate, measures to mitigate any potential adverse consequences thereof. 4 If and to the extent that it is not possible to provide this information at the same time, it may be provided in stages without undue delay. 5 The controller shall document any personal data breach consisting of the facts relating to the personal data breach, the consequences, and the corrective measures taken. Such documentation shall enable the SA to verify compliance with this article.”

According to Article 34 of the GDPR: “1. Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall notify the data subject of the personal data breach without undue delay . 2 The notification to the data subject, as referred to in paragraph 1 of this article, shall clearly describe the nature of the personal data breach and 19 shall contain at least the information and measures referred to in article 33(3)(b), (c), and (d). 3 Notification to the data subject data subject referred to in paragraph 1 is not required if any of the following conditions are met: (a) the controller has implemented appropriate technical and organizational protection measures during processing, and those measures have been applied to the personal data affected by the breach , in particular measures that render the personal data unintelligible to anyone who is not authorized to access it, such as encryption, (b) the controller subsequently took measures to ensure that the high risk to the rights and freedoms of the data subjects, c) it would require disproportionate effort. In this case, a public announcement shall be made instead, or a similar measure is taken by which the data subjects are informed in an equally effective manner. 4 If the controller has not already notified the data subject of the data breach to the data subject, the supervisory authority may, after assessing whether the personal data breach is likely to result in a high risk personal data breach, request that the controller do so or may decide that any of the conditions referred to in paragraph 3 are met.”

The Authority notes that the security obligation set forth in Article 32 of the GDPR is a means-based obligation rather than a results-based one and imposes on the controller to take appropriate technical and organizational measures, which, taking into account the characteristics of the specific processing, are intended both to reduce the likelihood of a personal data breach and, where appropriate, to limit its severity. Therefore, it is not required that security measures eliminate every form of risk, and the mere occurrence of a personal data breach does not, in and of itself, constitute a violation of Article 32 of the GDPR. The above interpretation has been 20 confirmed by the Court of Justice of the European Union in its decision in Agence nationale des recettes publiques de Bulgarie (Dec. 14, 2023, C-340/21, paragraphs 29–31), in which it was held that the reference in Article 32(1) and (2) of the GDPR to a “security level appropriate to the risk” and to an “appropriate security level” demonstrates that the GDPR establishes a risk management framework and does not aim to eliminate the risks of personal data breaches personal data. The wording of Articles 24 and 32 of the GDPR indicates that these provisions impose on the controller to adopt technical and organizational measures with the purpose of preventing, to the extent possible, personal data breaches . The appropriateness of these measures must be assessed on a on a case-by-case basis, taking into account the criteria set forth in the above articles, as well as the specific data protection needs and the risks arising from the specific processing.

In the present case, the evidence in the case file shows that EETAA, as the implementing body for social policy programs, acts as a processor carrying out large-scale data processing on behalf of YKOISO, as the controller, and other entities, within the meaning of Article 4(8) of the GDPR. Overall, the controller and the processor appear to have complied with their legal obligations, which arise from the aforementioned Articles 33 and 34 of the GDPR regarding the handling of personal data breach incidents personal data, given that: a) the processor notified the controller when it became aware of the personal data breach, b) the controller submitted the relevant notification to the Authority, within seventy-two (72) hours of becoming aware of the incident, c) the notification as a whole, as completed, provides all the information required under Article 33 of the GDPR, 21 d) it assessed the risks to the affected data subjects resulting from the incident and notified them, in accordance with the relevant provisions of Art 34 of the GDPR.

Regarding the causes of the incident, the violation of Article 32 of the GDPR was due to the operation of an old application server, using outdated technology and a low level of security. This technical vulnerability was known, reasonably foreseeable, and exploitable using common cyberattack methods. Keeping an outdated information system with known vulnerabilities in operation violates the obligation to take measures , taking into account the latest developments—that is, in accordance with state of the art, especially when security updates or alternative solutions are available, given that the obligation under Article 32 is not limited to the initial implementation of measures, but includes continuous updating, vulnerability management, and the decommissioning of legacy systems. The Authority finds that the vulnerability was known to the cybersecurity community, exploiting it was technically straightforward, therefore the risk was foreseeable and preventable, and thus the failure to take measures constitutes, at the very least, gross negligence. EETAA’s argument that “we could not stop because of the public interest” is rejected because the public interest does not override the obligation to ensure security, just as the public interest is harmed when vulnerable information systems containing critical personal data remain in operation. Similarly, the reference to a lack of resources does not constitute grounds for exemption, since financial constraints do not waive the obligation to comply with Article 32 of the GDPR. Furthermore, it does not appear that addressing the vulnerability would entail such costs, would have been taken into account and led to the rejection of the relevant measure due to the high cost of App development.

While EETAA states that it had informed UKOISO of the need to upgrade its systems in order to make them more secure and more functional, no documentation of such communication has been provided. UKOISO, furthermore, denies having received any such communication. 2216. The controller must use only processors that provide sufficient guarantees regarding the implementation of appropriate processing technical and organizational measures, and the responsibility for compliance with Article 32 is not transferred to the processor. The Authority accepts that a violation of Article 32 by the processor does not exempt the controller when the latter failed to ensure in advance that the measures were adequate. The controller failed to fulfill the obligation to select a processor that provides adequate safeguards, as it did not conduct a substantive assessment of the security of its information systems, nor did it ensure the existence of appropriate technical and organizational measures. The use of outdated technology with known vulnerabilities demonstrates that the safeguards provided were not adequate.

Regarding the YKOISO’s delegation to EETA of the implementation of the relevant programs, it should be noted that, although every year a new Joint Ministerial Decision was signed for each program, for the “Daycare Centers” program during the period of the alleged violation, there was no active contract covering it, as the most recent one covered the 2022–2023 period, in violation of Article 28(3) of the GDPR, primarily with regard to YKOISO, which acted as the 23 for processing, but also for EETA in its capacity as the processor. The controller permitted the processing of data without the required contract or other legal basis being in place. The Authority finds that the existence of a contract is not a formal requirement, but an essential guarantee of the lawfulness of the processing. The data controller did not demonstrate that it had secured a contractual commitment from the processor nor did it clearly define the processor’s obligations, making it impossible to demonstrate compliance. The absence of a contract resulted in a lack of clear security obligations and mechanisms control and accountability mechanisms, thereby contributing substantially to the incident. The controller violated Article 28(3) of the GDPR by permitting the processing of personal data by a processor without a valid contract in place governing the processing.

The processor was required to ensure that the processing was carried out on the basis of a valid contract. The Authority acknowledges that the requirement for a contract applies to both parties. The processing lacks the required legal framework and is therefore unauthorized. The absence of a contract implies a lack of clear Directives, a lack of security measures, and a lack of oversight, a fact that increased the risk. The processor violated Article 28 (3) of the GDPR, as it processed personal data without a valid contract with the controller governing the terms of such processing. In determining the administrative fines, the Authority takes into account that the controller bears primary responsibility for compliance with the GDPR, particularly with regard to the selection and supervision of the processor. In this case, the complete absence of a valid contract pursuant to Article 28 of the GDPR and the failure to conduct a substantive assessment of the security level of the processor constitute particularly serious violations.

Consequently, based on the foregoing, the Authority finds the following violations on the part of YKOISO as the controller: (a) Article 5(1)(f) in conjunction with Article 32(1) of the GDPR regarding the security of processing (see Recital 15 above), and 24 (b) Article 28(3) of the GDPR regarding the absence of a valid contract between the controller and the processor (see above Recital 18).

Furthermore, based on the foregoing, the Authority finds the following violations on the part of EETAA as the processor: (a) Article 5(1)(f) in conjunction with Article 32(1) of the GDPR regarding the security of processing (see Recital 14 above), and b) Article 28(3) of the GDPR regarding the lack of a valid contract between the controller and the processor (see above Recital 19).

Based on the foregoing, the Authority finds that there are grounds to exercise its corrective powers under Article 58(2) of the GDPR in relation to the established violations of the GDPR.

Furthermore, the Authority considers that, with regard to the established violations, in accordance Article 58(2), pursuant to the provision of Article 58(2)(i) of the GDPR, it is appropriate to impose an effective, proportionate, and deterrent administrative fine, in accordance with Articles 83 of the GDPR and 39 of Law 4624/2019, on both the controller and the processor processing.

In determining the amount of fines, pursuant to Article 83 of the GDPR, the Authority takes into account EDPB Guidelines 4/2022 on the calculation of administrative fines and the following: i) The established violation of Article 5(1)(f) of the GDPR by the data controller falls, in accordance with the provisions of Article 83(para.) 5(a) of the GDPR, to the highest category provided for in the administrative fine scale. ) The established violation of Article 28 of the GDPR by the controller in relation to the processing falls, in accordance with the provisions of Article 3 https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-042022-calculation- administrative-fines-under_en - version 2.0, following consultation 25 83(4)(a) of the GDPR, to the lowest category provided for in the administrative fine scale. iii) The personal data breach relates to the core activities of the controller. iv) The incident resulted in the compromise of a special category of personal data, the breach of which may result in serious 4 risks. v) The number of data subjects affected by the incident is exceptionally large. vi) No previous similar breach has been identified on the part of the controller. vi) The established violation of Articles 32 and 28 of the GDPR by the processor falls, in accordance with the provisions of Article 83(4)(a) of the GDPR, to the lowest category provided for in the system for classifying administrative fines. vi) The personal data breach relates to the main activities of the processor. ix) The incident resulted in the compromise of a special category of personal data, the breach of which may entail serious risks. x) The number of data subjects affected by the incident is exceptionally large. xi) The fact that the company’s revenue for the 2024 fiscal year amounted to 10,187,657 euros.6 4See also Recital 57 of the EDPB Guidelines 4/2022. 5 See also Recital 57 of the EDPB Guidelines 4/2022. 6 https://publicity.businessportal.gr/company/377501000 26 x) No previous similar violation has been established on the part of the processor.

The Authority finds that, based on the established facts and the above criteria, the sanctions set forth in the operative part of the decision constitute an effective, proportionate, and deterrent measure, both to restore compliance and to punish the unlawful conduct. FOR THESE REASONS The Authority: a) Pursuant to Article 58(2)(i) of the GDPR, imposes an administrative fine on the Ministry of Social Cohesion and Family in the total amount of 150,000 euros, for violating Article 5(1)(f), in conjunction with Article 32(1) of Regulation (EU) 2016/679. b) Pursuant to Article 58(2)(i) of the GDPR, it imposes an administrative fine on the Ministry of Social Cohesion and Family in the total amount of 50,000 euros, for the violation of Article 28(3) of Regulation (EU) 2016/679. c) Pursuant to Article 58(2)(i) of the GDPR, it imposes an administrative fine on the company named “Hellenic Company for Local Development and Local Government S.A.” in the total amount of 100,000 euros, for the violation of Article 32(1) of Regulation (EU) 2016/679. (d) Pursuant to Article 58(2)(i) of the GDPR, it imposes an administrative fine on the company named “Hellenic Local Development and Local Government Company S.A.” in the total amount of 50,000 euros for the violation of Article 28(3) of Regulation (EU) 2016/679. e) Orders, pursuant to Article 58(2)(d) of the General Data Protection Regulation (GDPR), the Ministry of Social Cohesion and Family and the company named “Hellenic Company for Local Development and Local Government S.A.” to immediately enter into the required contract in accordance with Article 28 of the GDPR within an exclusive 27-day period of one month from receipt of this decision and to inform the Authority accordingly. (f) Orders, pursuant to Article 58(2)(d) of the GDPR, the company named “Hellenic Company for Local Development and Local Government S.A.” to proceed to fully implement all the measures listed in the Confidential Annex, which it has already planned, within an exclusive deadline of one month from receipt of this letter and to inform the Authority accordingly by submitting the appropriate documentation. Acting Chair Vice Chair The Secretary Georgios Batzalexis Irini Papageorgopoulou 28