Greece’s Data Protection Authority has fined the Migration 8 Asylum Ministry with of €175,000 for the systems “Kentavros” and “Iperion” for the surveillance of asylum seekers.
The DPA found violation of the General Data Protection Regulation (GDPR) (which things don’t seem to be going too well with lately).
The fine is the heaviest imposed on a public body in the country.
Two years ago, in February 2022, Homo Digitalis filed a complaint against the Ministry of Immigration and Asylum in collaboration with the civil society organizations Hellenic Union for Human Rights and HIAS Greece, as well as the academic Niovi Vavoulas. “Kentauros” and “Iperion” systems in the reception and accommodation structures for asylum seekers.
The “Kentauros” system is a digital electronic and physical security management system around the perimeter and inside the facilities, using cameras and algorithms for behavioral analysis (Artificial Intelligence Behavioral Analytics), while the “Hyperion” system is the asylum seeker management system, regarding all the needs of the Reception and Identification Service, while it is also the basic tool for the responsibility of access control (entrance – exit) to these facilities using biometric data.
In its ruling, the DPA stated that after receiving knowledge regarding the development and implementation of the “Centaur” and “Uperion” Programs by the Ministry of Immigration and Asylum in facilities of the Closed Controlled Structures Centers and Reception and Identification Centers for citizens of third countries , proceeded to a thorough check of the integrated digital electronic and physical security management system – “Kentauros” and the integrated entrance-exit control system with a reader combined with a fingerprint (i.e. with processing of biometric data) – “Iperion” in the facilities of the aforementioned guest structures as well as employees and certified members of non-governmental organizations.
The Authority found deficient cooperation on the part of the Ministry of Immigration and Asylum as the Controller and further considered that the required Data Protection Impact Assessments carried out by the Ministry were materially incomplete and limited in scope, and that there remain serious omissions regarding with the Ministry’s compliance with specific provisions of the GDPR regarding the implementation of the disputed systems.
The Authority gave the Migration Ministry a compliance order within three months regarding its GDPR obligations, media reported.
