The Data Protection Authority received a large number of complaints regarding an unsolicited political communication via e-mail sent on 1/3/2024, entitled “100 days before the European elections“, by the MEP Anna Michelle Asimakopoulou.

Following these, the Authority investigated the case ex officio, exercising the powers of investigation it has directly and controlling the bodies involved.

Following a series of on-site inspections and obtaining evidence and evidence in the context of the audit, it was established that a file with personal data of all registered foreign voters for the June 2023 elections, for which the Ministry of the Interior is responsible for processing, and for which the current legislation does not foresee any case of its transmission to recipients outside the Ministrywas trafficked outside the Ministry.

The file in question contained, in addition to the known details of the electoral rolls, the e-mail addresses and contact telephone numbers of foreign voters, data which are excluded from the provision of copies of electoral rolls to the beneficiaries.

The file in question was created on 8 June 2023 for internal use at the Ministry of the Interior in relation to a purpose relating to the electoral process.

It is concluded that the leak of the particular file occurred between June 8 and 23, 2023, as it turned out that on June 23, 2023 the file was forwarded to the then Secretary of Expatriates of the New Republic, Nikos Theodoropoulosfrom a sender whose identity and status have not been determined to date, in order, according to his claims, to use it to analyze the election results.

On January 20, 2024, the file in question was sent to Ms. Asimakopoulou by Mr. Theodoropoulos.

Ms. Asimakopoulou then processed the file originating from the Ministry of the Interior in order to send an e-mail to all the voters contained in it. Ms. Asimakopoulou’s electronic message did not include the information required by Article 14 of the GDPR to inform its recipients, in particular about the source of their personal data.

As far as the Ministry of the Interior is concerned, the leak of a file intended solely for internal use is a breach of personal data confidentiality and therefore a breach of personal data. During the audit carried out by the Authority at the Ministry of the Interior, deficiencies were identified in the procedures and applied data protection policies, faults in the investigation of the incident as well as undocumented announcements of the circumstances of the incident. Finally, deficiencies and inaccuracies were found in the content of the relevant activity records kept.

As far as Ms. Asimakopoulou is concerned, the Authority found that the collection of personal data of emigrant voters, including electronic communication details and their use for sending a political communication message, was in violation of the basic principle of legality, objectivity and transparency of the processing, as it was in violation of a number of provisions of the electoral legislation and furthermore could not reasonably be expected for the data subjects (foreign voters).

The Authority imposed on the Ministry of the Interior, as controller, an administrative monetary fine of a total of 400,000 euros for violations of Articles 5, 25, 30, 32 and 33 of the GDPR and instructed it to take actions regarding the compliance of the observed measures and procedures with the GDPR, on a specific schedule.

The Authority points out that the detected violations are not related to the voting process.

The Authority imposed on Anna Michele Asimakopoulou, as data controller, an administrative fine of a total of 40,000 euros for violations of Articles 5, 6 and 14 of the GDPR and ordered the deletion of said data.

As for New Democracy and Mr. Theodoropoulos, the Authority postponed the issuance of a decision, given that the latter, after the hearing and the submission of pleadings, presented his affidavit regarding the method of access to the electoral rolls, as a new crucial element, from the content of which arises the need to further investigate the allegations made there.