ALLSEAS MARINE S.A.

The senior manager of a shipping company filed a complaint with the Hellenic DPA alleging that such company (i) had not properly informed him of his data protection rights and refused to provide access to his personal data stored in his business computer, including corporate emails and files, and (ii) has unlawfully installed cameras at the company's premises. The case related to an investigation initiated by the company to the corporate emails and documents stored in the business computer of the senior manager and to extracts recorded by the company's CCTV following reasonable suspicion that the senior manager embezzled company's funds. When the senior manager asked to have access to his personal data stored in his business computer, the company refused to satisfy his right without providing adequate justification and did not inform him of the right to lodge a complaint with the Hellenic DPA. Also, it was found that the company had placed cameras, some of which were hidden, without any warning signs and notices, as required. The Hellenic DPA held that the conducting of an investigation on the business computer of the manager was conducted in accordance with the GDPR, since the investigation was limited to specific data relating only to one employee, and was based on the overriding legitimate interest of the company to protect its assets. The Hellenic DPA concluded that, although the investigation was lawful, the company had unlawfully refused to satisfy the right of access of the senior manager and operated the CCTV in violation of the GDPR and the regulatory framework. Authority: HELLENIC DATA PROTECTION AUTHORITY