[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXe5WiYGVfnFDP5AwHYqyxPxDc-GUvETnVRJ0G4z4ZQU":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":72},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"51f9ce32-9848-4454-b2b3-08c25632e61d","HDPA (Greece) - 10\u002F2026","hdpa-greece-10-2026-534b8c","Created page with \"{{DPAdecisionBOX |Jurisdiction=Greece |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoGR.jpg |DPA_Abbrevation=HDPA |DPA_With_Country=HDPA (Greece) |Case_Number_Name=10\u002F2026 |ECLI= |Original_Source_Name_1=HDPA |Original_Source_Link_1=https:\u002F\u002Fwww.dpa.gr\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-06\u002F10_2026%20anonym.pdf |Original_Source_Language_1=Greek |Original_Source_Language__Code_1=EL |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source...\" Show changes","The Hellenic Data Protection Authority (HDPA) has fined two companies, MEDE S.A. and MARKET IN S.A., a total of €160,000 for multiple GDPR violations. The violations stemmed from inadequate responses to data subject access requests concerning CCTV footage, unlawful processing, and unauthorized disclosure of personal data. Both companies were found to have delayed cooperation with the DPA during the investigation.","Greece's HDPA fines two companies €160,000 for GDPR violations related to CCTV footage.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_10\u002F2026&diff=52012&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-06-30T08:21:16+00:00","2026-06-30T10:00:19.20701+00:00",7,[17,20,23,25],{"name":18,"type":19},"HDPA","vendor",{"name":21,"type":22},"CCTV","product",{"name":24,"type":19},"MEDE S.A.",{"name":26,"type":19},"MARKET IN S.A.","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":27,"icon":29,"name":30,"slug":31},null,"Policy","policy",[33,38,43,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,24,26],{"controls":53,"vendors":71},[54],{"slug":55,"name":56,"problem":57,"products":58},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[59,65],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":60,"product_name":61,"url":63,"description":64},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":66,"product_name":67,"url":69,"description":70},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":73,"title":74,"body":75,"framework_refs":76,"framework_notes":89},"greek-dpa-fines-two-companies-160000-for-gdpr-violations-over-cctv-data-mishandling","Greek DPA Fines Two Companies €160,000 for GDPR Violations Over CCTV Data Mishandling","MEDE S.A. and MARKET IN S.A. failed to adequately respond to data subject access requests related to CCTV footage, unlawfully processed personal data, and disclosed it without authorization — all core GDPR obligations. Delayed cooperation with the Hellenic Data Protection Authority during the investigation compounded the violations and likely contributed to the severity of the fines. These failures highlight that GDPR compliance is not only about technical safeguards but also about having clear, documented processes for handling data subject rights and regulatory inquiries. Organizations operating CCTV systems must treat video footage as personal data subject to the full scope of GDPR protections. Failure to respond promptly to both data subjects and supervisory authorities signals a systemic lack of data governance maturity.",[77,78,79,80,81,82,83,84,85,86,87,88],"GDPR Article 12 – Transparent information and communication on data subject rights","GDPR Article 15 – Right of access by the data subject","GDPR Article 5(1)(f) – Integrity and confidentiality principle","GDPR Article 31 – Cooperation with the supervisory authority","GDPR Article 35 – Data Protection Impact Assessment","NIST SP 800-53 AC-3 – Access Enforcement","NIST SP 800-53 IR-6 – Incident Reporting","NIST Privacy Framework PR.PO-P1 – Policies and procedures for data processing","CIS Control 3 – Data Protection","CIS Control 17 – Incident Response Management","ISO\u002FIEC 27701 – Privacy Information Management System (PIMS)","ITIL Service Management – Compliance and Audit Management",{}]