# Headquarter of a Fire Brigade: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Hellenic Data Protection Authority (HDPA)
- Date: 2026-01-08
- Original: https://www.enforcementtracker.com/ETid-2999
- Canonical: https://overview.legal/posts/52353
- Topics: Health Data, Healthcare, Controllers, Healthcare, Employees, Processing, Special Categories of Data, Supervisory Authorities, Processing Agreement, Types of Special Categories of Personal Data

## Summary

The Greek DPA has imposed a fine of EUR 10,000 on a Fire Brigade Head Quarter. The controller had stored health data of an employee which had been in relation with her sick leave. The controller stored every detail of the medical condition, treatment and other related data. The ammount of data processed had not been necessary for the purpose and therefore no legal basis.

## Full text

The Greek DPA has imposed a fine of EUR 10,000 on a Fire Brigade Head Quarter. The controller had stored health data of an employee which had been in relation with her sick leave. The controller stored every detail of the medical condition, treatment and other related data. The ammount of data processed had not been necessary for the purpose and therefore no legal basis.

GDPR Articles: Art. 5 (1) a ), c) GDPR
Industry: Employment

---
Generated by overview.legal · https://overview.legal/posts/52353 · 2026-08-22