The Hellenic Data Protection Authority (DPA) has published a decision addressing a personal data breach that involved E.E.T.A.A. S.A., a public-interest company acting as a data processor on behalf of Greece's Ministry of Social Cohesion and Family Affairs.
The case was referenced by the European Data Protection Board (EDPB) as part of its ongoing reporting on national supervisory authority decisions across the European Union. Details of the specific findings, sanctions, or corrective measures imposed were not included in the summary released.
This decision falls under the General Data Protection Regulation (GDPR) rather than the EU AI Act, but it is relevant to organisations tracking how national authorities approach processor accountability, particularly in public sector data-sharing arrangements involving sensitive social welfare data.
Organisations that combine GDPR-regulated processing with AI systems, for example, automated eligibility assessments or risk-scoring tools used in social welfare administration, should note that processor-level data breaches can carry implications beyond data protection law.
Where AI systems rely on data processed by third parties, breaches of this kind may also trigger obligations under the EU AI Act relating to data governance and record-keeping, particularly for high-risk systems listed in Annex III, such as those used in the administration of essential public benefits.
As a compliance matter, entities engaging processors for AI-enabled public services should review data processing agreements, incident response protocols, and oversight mechanisms to ensure alignment with both GDPR and emerging AI Act requirements.
This case serves as a reminder that enforcement activity by data protection authorities continues to shape the operational environment in which AI systems handling personal data are deployed and governed.