Enforcement · Hellenic Data Protection Authority (HDPA) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

School: Non-compliance with general data processing principles

The Hellenic DPA has fined a school EUR 15,000.

€15,000 Fine
School
GREECE
Art. 5 GDPR Art. 6 GDPR Art. 12 GDPR Art. 13 GDPR Art. 30 GDPR
Legitimate Interest Controllers Personal Data Supervisory Authorities Processing
Sep 9, 2022 Source dpa.gr

Full text

The Hellenic DPA has fined a school EUR 15,000. The school had installed several video surveillance cameras on the building, which permanently recorded students, teachers and visitors. During its investigation, the DPA found that the school did not have a sufficient legal basis for the video surveillance. In view of the extensive video surveillance and the resulting restriction of the personal rights of the data subjects, the school could not rely on a legitimate interest (protection of property). In addition, the DPA found that the controller had violated its duty to inform by informing teachers and parents only verbally and incompletely about the video surveillance system.

Industry: Public Sector and Education

How it connects

References

All 7

Related across sources

C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik. A new page has been created with the following information: "" CJEU Jan 7, 2026 Personal Data Fairness & Transparency Controllers
42 K 51.25 VG Berlin: DPA correctly found residential video surveillance for property protection The property management company of a high-rise building (the controller) had a video surveillance system installed at the entrances of the building in 2021. The installation was… Administrative Court Berlin Apr 20, 2026 Legitimate Interest Supervisory Authorities Retention Period
10 A 5144/23 VG Hannover: Controller appeals DPA reprimand over unlawful workplace video surveillance The owner of a doner kebab production facility (the controller) had installed video cameras to monitor virtually every room of the business premises. Cameras were placed in the… Administrative Court Hannover Aug 7, 2026 Controllers Supervisory Authorities Legitimate Interest
C-604/22 IAB Europe v Gegevensbeschermingsautoriteit In Case C-604/22, the Court of Justice of the European Union ruled on a preliminary reference from the Brussels Court of Appeal in proceedings between IAB Europe and the Belgian… CJEU ·Fourth Chamber Mar 7, 2024 IP Address Controllers Personal Data
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data
C-362/14 Maximillian Schrems v Data Protection Commissioner C-362/14 (Schrems I) CJEU Oct 6, 2015 Privacy Shield Supervision IP Address
Related documents