AMERICAN COLLEGE OF GREECE (ACG)

The complainant used to be a professor at the American College of Greece who was then transferred to a different position of the institution following reports by students that he uploaded hateful and transphobic posts on his public social media accounts. Two students claimed that they felt the learning environment was unsafe for them and they requested that the College's HR department address the situation. The College elected not to terminate the employment but rather to transfer the complainant to a different non-teaching function. Afterwards, the complainant made repeated requests of access and deletion towards the HR and other administration departments asking to be provided the contents of his employee folder and of the contents of any reports made against him and for such to be deleted. The College requested the consent of the two students who had made the reports in order to provide them to the complainant. One of the students stated that she was afraid of her safety and did not want her name or the contents of the report to be disclosed to the complainant. The other student provided her consent. The College replied to the complainant after the lapse of the 30 day response period as provided in Article 12 par.3 of the GDPR providing the information requested but only one of the student reports. They also informed the complainant that not all the data could be deleted as it was necessary for the establishment, exercise and defense of legal claims as provided in Article 15 par.3(e) of the GDPR.<br />The Hellenic DPA ruled that the College violated the complainant's right to access by asking for the consent of the reporting students, as. in the balancing exercise, there is no indication that the students were in immediate danger to their rights and freedoms and their legitimate interest's could not override the complainant's right to defend himself against a possible insult to his personality. Considering that this was a minor violation of the complainant's rights and the College acted in good faith to protect the students' interests, the DPA decided on a minimal fine.