Enforcement · Hellenic Data Protection Authority (HDPA) EN LLM context

NOW DOCTOR – Εταιρία Παροχής Ηλεκτρονικών Υπηρεσιών Αναζήτησης και Προβολής Ιατρών Ε.Π.Ε.: Non-compliance with general data processing principles

The Hellenic DPA has imposed a fine of EUR 5,000 on the operator of the medical platform nowdoctor.gr that enables online booking of medical appointments.

€5,000 Fine

NOW DOCTOR – Εταιρία Παροχής Ηλεκτρονικών Υπηρεσιών Αναζήτησης και Προβολής Ιατρών Ε.Π.Ε.

GREECE

Art. 5 GDPR Art. 6 GDPR Art. 12 GDPR Art. 17 GDPR

Personal Data Accountability Controllers Supervisory Authorities Processing

Aug 26, 2021 Source dpa.gr

Full text 2 findings

Paragraphs carrying a topic or an applied provision show those connections inline

The Hellenic DPA has imposed a fine of EUR 5,000 on the operator of the medical platform nowdoctor.gr that enables online booking of medical appointments. A doctor had filed a complaint with the DPA. Accordingly, she had repeatedly stated that she no longer wished to work with the controller and requested the deletion of her data on the platform. The controller did not comply with her request. The deletion did not take place until 18 months later, after the DPA requested the controller to do so. The DPA considered this to be a breach of the controller's accountability obligations and found that the controller had stored the data subject's data longer than necessary for the intended purpose. The purpose, namely the provision of online display services, ceased to exist when the data subject declared that she no longer wished to work with the controller. In addition, the DPA finds that the controller failed to take measures with regard to the requirement of Art. 12 GDPR to facilitate the exercise of data subjects' rights.

Personal Data Controllers Supervisory Authorities applies Art. 12

The controller had publicly provided an e-mail address on its website as a means of communication. However, the controller did not have sufficient staff available to actually process the correspondence. GDPR Articles: Art. 5 (1) a), e) GDPR, Art. 5 (2) GDPR, Art. 6 (1) GDPR, Art. 12 (2), (3) GDPR, Art. 17 GDPR Industry: Health Care

Controllers applies Art. 5(1)Art. 5(2)Art. 6(1)Art. 12(2)

How it connects

2 of 2 paragraphs apply legislation or carry a topic — see them in the full text ↓

References

All 8

Related across sources

C-169/23 Nemzeti Adatvédelmi és Információszabadság Hatóság v UC In Case C-169/23, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Kúria (Hungary) concerning whether the Budapest Metropolitan… Third Chamber Nov 28, 2024 Personal Data Legitimate Interest Supervision

C-252/21 Meta Platforms v noyb C-252/21 (Meta Platforms (noyb)) Jan 12, 2023 Supervisory Authorities IP Address Supervision

C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data

C-231/22 État belge v Autorité de protection des données In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court… Third Chamber Jan 11, 2024 Controllers Personal Data Public Authority

C-136/17 GC and Others v CNIL C-136/17 (GC and Others) Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data

C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) Oct 6, 2015 Privacy Shield Supervision IP Address