Hellenic Data Protection Authority (HDPA) — Ministry of Migration and Asylum
The HDPA fined the Ministry EUR 175,000 with a compliance order over the 'Centaur' (AI behavioural-analytics cameras, drones, CCTV) and 'Hyperion' (RFID + fingerprint biometric entry-exit) surveillance systems at reception centres on five Aegean islands, finding the DPIAs substantially incomplete.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-18. Every holding carries a short verbatim quote from that text.
- Decided by
- Hellenic Data Protection Authority
- Parties
- Hellenic Data Protection Authority v. Ministry of Migration and Asylum
- Decision date
- April 3, 2024
- Remedy
- The Hellenic Data Protection Authority imposed an administrative fine of 175,000 EUR on the Ministry of Migration and Asylum and ordered it to comply with GDPR obligations within three months.
- Amount
- €175,000
- Appeal
- Appeal status not stated
Key holdings
The Ministry of Migration and Asylum failed to cooperate with the Authority and submitted substantially incomplete impact assessments.
“The Authority found a lack of cooperation on the part of the Ministry of Migration and Asylum, as data controller, and further considered that the required Data Protection Impact Assessments”
The Hellenic Data Protection Authority imposed a 175,000 EUR fine for GDPR violations and issued a compliance order.
“For these reasons, the Authority imposed an administrative fine of € 175,000 on the Ministry of Migration and Asylum for the breaches found”
The Hyperion and Centaur programs process personal data, including images and biometric fingerprints.
“through which personal data, in particular biometric data, are processed.”
In plain English
Following an own-initiative investigation, the Hellenic Data Protection Authority took action against the Ministry of Migration and Asylum regarding surveillance and entry-exit control systems, known as Centaur and Hyperion. The Centaur system utilized motion analysis cameras, artificial intelligence behavioral analytics, closed-circuit television, and drones to process image data at reception and accommodation facilities across several islands. Meanwhile, the Hyperion system processed biometric data, specifically fingerprints paired with radio-frequency identification technology, to control access for guests, facility staff, and non-governmental organization members. The investigation revealed that the Ministry failed to cooperate sufficiently with the authority. Additionally, the authority determined that the required data protection impact assessments conducted by the Ministry were substantially incomplete and limited in scope, leaving serious compliance shortcomings under applicable data protection rules. As a consequence, the Hellenic Data Protection Authority issued an administrative fine of 175,000 euros against the Ministry of Migration and Asylum. In addition to the monetary penalty, the authority ordered the Ministry to bring its operations into full compliance with data protection obligations within three months.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.