Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs
Hellenic DPA fines Ministry of Social Cohesion €200K and E.E.T.A.A. €150K for data breach with outdated security
The Hellenic Data Protection Authority investigated a large-scale personal data breach affecting E.E.T.A.A. S.A.'s information systems used by the Ministry of Social Cohesion and Family Affairs, exposing identification, financial, and health data. While the Ministry complied with breach notification obligations, the DPA found that E.E.T.A.A. used outdated systems and inadequate security measures despite awareness of risks, violating GDPR Articles 25, 28, and 32. The DPA imposed fines totaling €350,000 and ordered both parties to execute a data processing agreement and implement security improvements.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ministry of Social Cohesion and Family Affairs?
Get an email when a new story names Ministry of Social Cohesion and Family Affairs, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonE.E.T.A.A. S.A. operated legacy, outdated information systems to process sensitive identification, financial, and health data on behalf of the Greek Ministry of Social Cohesion and Family Affairs — despite being aware of the associated security risks. This negligence violated GDPR Articles 25 (data protection by design and default), 28 (processor obligations), and 32 (security of processing), resulting in a large-scale personal data breach. The case highlights the critical accountability gap that emerges when data processors fail to maintain adequate technical safeguards proportionate to the sensitivity of the data they handle. It also underscores that awareness of risk without remedial action constitutes a serious compliance failure, not a mitigating factor.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.