Hellenic DPA decision on a data breach involving E.E.T.A.A. S.A. as processor for the Ministry of Social Cohesion and Family Affairs

What happened

The Hellenic Data Protection Authority investigated a large-scale breach at E.E.T.A.A. S.A., which processes data for the Ministry of Social Cohesion and Family Affairs. The breach exposed personal, financial and health data of many citizens. The Authority found the Ministry had met breach‑notification duties, but both parties failed to secure the systems and to have a proper Article 28 processing agreement. It imposed administrative fines of €200,000 on the Ministry and €150,000 on E.E.T.A.A. and ordered a compliant data‑processing contract and security upgrades.

Why it matters

Greek public bodies must ensure up‑to‑date security controls and formalised Article 28 processor agreements, or risk similar fines.

Business impact

Failure to modernise legacy IT and formalise contracts can lead to significant financial penalties and mandatory remediation projects.

Checklist

• Review processor contractsHigh priority

  Ensure all data‑processing agreements meet GDPR Article 28 requirements.

• Upgrade security measuresHigh priority

  Replace outdated information systems and implement robust technical safeguards.

Who reported it

Discussion