AEGEAN MARINE PETROLEUM NETWORK INC.

A marine bunkering company created a back-up of a database server which contained personal data. The personal data in question related to a branch's employees (e.g. documents, company profiles, email communications) as well as third parties whose offices were located in the same building and were informally using the same server. The fined company had also not implemented any policies/procedures for compliance with data protection legislation. The Hellenic DPA held that the company was responsible to implement measures of logical and technical distinction of the files it needed to back-up and to adequately inform all employees of the further processing and the reasons thereof. By indiscriminately cloning the server it violated the principles of transparency, data minimization, data integrity and accountability. It was given 3 months to implement the appropriate policies and procedures and render itself fully compliant. Authority: HELLENIC DATA PROTECTION AUTHORITY