|
|
| (7 intermediate revisions by 3 users not shown) |
| Line 7: |
Line 7: |
| |DPA_With_Country=HDPA (Greece) | | |DPA_With_Country=HDPA (Greece) |
|
| |
|
| |Case_Number_Name=901 | | |Case_Number_Name=8 |
| |ECLI= | | |ECLI= |
|
| |
|
| Line 31: |
Line 31: |
|
| |
|
|
| |
|
| |National_Law_Name_1=11 (3) 3471/2006 | | |National_Law_Name_1= |
| |National_Law_Link_1=
| | |National_Law_Link_1=Article 11(3) 3471/2006 |
|
| |
|
| |Party_Name_1= | | |Party_Name_1= |
| Line 54: |
Line 54: |
| }} | | }} |
|
| |
|
| The Greek DPA held that a 2000€ fine should be imposed to a candidate of the municipal elections for illegal processing of personal data for the purpose of political communication via emails. | | The Greek DPA fined a political candidate €2000 for processing personal data for the purpose of political communication via email without the data subject's consent. |
|
| |
|
| == English Summary == | | == English Summary == |
|
| |
|
| === Facts === | | === Facts === |
| The complainant received an SMS from the political candidate which was promoting the candidate’s participation at the municipal elections without having granted a consent to do so. The political candidate, wasn’t able to provide proofs that the complainant and other data subjects gave their consent for the processing. | | The complainant received an SMS from the political candidate which was promoting the candidate’s participation at the municipal elections without having granted a consent to do so. The political candidate, wasn’t able to provide proof that the complainant and other data subjects gave their consent for the processing. |
|
| |
|
| === Dispute === | | === Dispute === |
| Line 84: |
Line 84: |
| | | |
| | | |
| The Personal Data Protection Authority met in
| |
| at its seat on 02-12-2020 at the invitation of the
| |
| of its President, in order to examine the case relating to the case history of the
| |
| of the present case. In attendance were George Batzalexis, Deputy Chairperson,
| |
| in the absence of the Chairman of the Authority, Konstantinos Menoudakou, the full member
| |
| Charalambos Anthopoulos and the alternate member Evangelos
| |
| Papaconstantinou, as Rapporteur, replacing the alternate member
| |
| Konstantinos Lambrinoudakis, who, although duly invited in writing, was not able to attend the meeting.
| |
| was absent due to an impediment. The alternate member Spyridon Vlahopoulos, although invited to attend, was not present.
| |
| duly invited in writing, did not attend due to his absence. The following were present at the meeting
| |
| by order of the President, Mr Ioannis Lycotrafitis, Specialist Scientist - Controller, as
| |
| as assistant rapporteur and Irene Papageorgopoulou, official of the
| |
| Administrative Affairs Department of the Authority, as Secretary.
| |
| The Authority took note of the following:
| |
| Complaint No. C/EIS/1717/06-03-2019 was submitted to the Authority,
| |
| The complaint was received on 17/17/77/63, which concerns the receipt of unsolicited political communication (sms) by A for the purpose of receiving unsolicited political communication (sms) from A.
| |
| (a) The request for information (a) is in response to a request for a political communication from A. The request was made in response to an e-mail sent to A. The request was in response to a request for information (a) to promote his candidacy in the municipal elections of ....
| |
| 2
| |
| According to the above complaint, the complainant received on ..., on his mobile phone
| |
| a short text message (SMS) from the complainant on his mobile phone with the number ...
| |
| (the sender of the message appeared to be the surname of the complainant
| |
| "A"), which was of a political nature for the purpose of promoting the
| |
| candidacy in the forthcoming municipal elections of ..., without having - as
| |
| the complainant alleges - any previous relationship with him.
| |
| In the context of its examination of this complaint, the Authority sent the complainant
| |
| the complainant the document No C/EX/1717-1/19-03-2019 in which
| |
| requesting its views on the complainants, taking into account the
| |
| Guidelines issued by the Authority on political communication.
| |
| The complainant replied to the Authority by letter No C/EIS/6683/04-
| |
| 10-2019, in which it states, inter alia, in summary
| |
| mentioned:
| |
| 1) In order to promote his candidature, he used all legal
| |
| He used all legal means available to him, including short text messages via mobile phones.
| |
| (sms). The sending of these messages was mass, i.e. not
| |
| personalised to selected persons or telephone numbers, did not
| |
| was not addressed to anyone personally and did not affect any personal data
| |
| of the recipient. In fact, as regards the recipients, when they were sent they did not
| |
| the complainant did not even know whether they were voters in Municipality F.
| |
| 2) The lists of cell phones used for the mailings
| |
| of the messages were delivered to him either by candidates for city council
| |
| and related to persons controlled by them, or from lists that had been
| |
| previously used by other politicians to any degree
| |
| involvement in elections, or from the Internet where telephone numbers were posted that
| |
| were used to promote or advertise the holder and the capacity that
| |
| he or she has (e.g. professional advertising, etc.).
| |
| 3) It does not constitute a violation of Law no. 3741/2006 does not constitute an offence if such messages are sent, the
| |
| which was of course used as a method of promotion by all
| |
| This case does not fall under the mandatory concession of the
| |
| 3
| |
| possibility for the complainant to object to the use of his telephone after
| |
| the number used was freely accessible to third parties.
| |
| The Authority then invited the complainant by letter C/EX/1717-2/06-11-2019
| |
| document inviting the complainant to a hearing by videoconference in order to
| |
| to discuss the above-mentioned complaint as well as the general practice followed by
| |
| by the candidate for political communication by electronic means.
| |
| The meeting of 11-11-2020 was attended by teleconference by A, who
| |
| presented his views orally. The complainant was given a deadline, but did not
| |
| submitted a memorandum.
| |
| The Authority, after examining the evidence on the file, the hearing
| |
| hearing and having heard the rapporteur and the assistant rapporteur, who
| |
| having left the case after the hearing and before the hearing and the adoption of the
| |
| after a thorough discussion,
| |
| CONSIDERED IN ACCORDANCE WITH THE LAW
| |
| 1. In accordance with Article 4(4)(a), (b) and (c), after deliberation and after having considered the case in accordance with Article 1(1), (d) and (e), the parties have decided on the basis of Article 1. 7 of the General Regulation (EU) 2016/679 for the
| |
| Protection of natural persons with regard to the processing of data
| |
| Protection of personal data against the processing of personal data and on the free movement of such data
| |
| (hereinafter, the Regulation), which has been in force since 25 May 2018, as
| |
| controller is defined as 'the natural or legal person, the public
| |
| authority, agency or other body which, alone or jointly with others, determines
| |
| the purposes and means of the processing of personal data
| |
| personal data'.
| |
| 2. The issue of making unsolicited communications with any
| |
| means of electronic communication, without human intervention, for the purposes of
| |
| direct marketing of products or services and for any kind of
| |
| advertising purposes, is regulated by Article 11 of Law No. 3471/2006 on the
| |
| protection of personal data in the electronic communications sector.
| |
| According to this article, such a communication is only allowed if the
| |
| The communication is only allowed if the subscriber has expressly consented in advance. Exceptionally, according to
| |
| 4
| |
| Article 11 par. 3 of Law no. 3471/2006, the contact details of electronic
| |
| legally acquired in the context of the sale of products or
| |
| services or other transaction, may be used for the direct sale of goods and services or other
| |
| direct marketing of similar products or services of the supplier or for
| |
| or for similar purposes, even if the recipient of the message
| |
| has not given his or her prior consent, provided that
| |
| is given the opportunity to object in a clear and distinct manner, by
| |
| in an easy manner and free of charge, to the collection and use of his or her electronic
| |
| data and this during the collection of contact data, as well as at any
| |
| message, in the event that the user did not initially object to this
| |
| use. Moreover, according to paragraphs 1 and 4 of Article 13 of the same law.
| |
| 3471/2006, as regards compliance with that law, the Data Protection Authority
| |
| Personal Data Protection Authority has the powers conferred on it by Law No. 2472/1997, as amended.
| |
| and shall impose the sanctions provided for by the latter law
| |
| in the event of a breach of the provisions of the aforementioned law. 3471/2006.
| |
| 3. Especially for political communication through electronic means without human
| |
| intervention and in accordance with the Authority's guidelines on
| |
| processing of personal data for the purpose of political communication
| |
| In accordance with the provisions of Article 11 of Law No. 3471/2006, as well as the
| |
| Directive 1/2010 of the Authority on political communication, as well as the General
| |
| EU Regulation (EU) 2016/679 on the protection of natural persons with regard to the communication of personal data in the context of electronic communications
| |
| processing of personal data which is in application
| |
| from 25 May 2018, the following shall apply:
| |
| Political communication1 is of interest from the point of view of the protection of
| |
| It is relevant from the point of view of personal data protection, it takes place in any period of time,
| |
| from the point of view of data protection in terms of privacy, at any time, whether electoral or non-electoral, by political parties, MPs, MEPs, MEPs,
| |
| Whether in political parties, whether in elections, political parties, MEPs, political parties and holders of elected office in local government or
| |
| candidates in parliamentary elections, elections to the European Parliament
| |
| and local government elections. Such persons shall be responsible for
| |
| processing, in accordance with Regulation (EU) 2016/679, Article 4, point 7)
| |
| 1 See definition in Article 1 par. 2 of Directive 1/2010 of the Authority.
| |
| 5
| |
| in so far as they determine the purpose and means of the processing. For example, where
| |
| Members of Parliament or parliamentary candidates receive data from political parties
| |
| parties and process them for their personal political communication,
| |
| they also become data controllers. In this capacity and on the basis of
| |
| the principle of accountability2 , they must be able to demonstrate compliance with the
| |
| their obligations and the rules on processing.
| |
| 4. Where the political communication is made by electronic means
| |
| without human intervention, through public networks
| |
| public communication, such as in the case of e-mails
| |
| (e-mail), the communication presupposes, in accordance with Article 11 (par. 11), that the communication is subject to the use of the electronic communication system. 1 ν.
| |
| 3471/2006, as in force, the prior consent of the data subject is required.
| |
| data subject, without prejudice to paragraph 3 of the same Article, as applicable.
| |
| It should also be noted that short text messages (SMS) also constitute
| |
| e-mails in accordance with the definitions of the Act on the Protection of Personal Data, as amended by Act No.
| |
| 3471/2006 and Directive 2002/58/EC.
| |
| 5. Political communication using electronic means is permitted without
| |
| The use of electronic media without human intervention and without the consent of the data subject is permitted.
| |
| The following conditions must be fulfilled without the consent of the data subject:
| |
| (a) The contact data have been lawfully acquired in the context of
| |
| (a) the contact information has been legally obtained in a previous, similar contact with the data subjects; and
| |
| The data subject was informed of their use at the time of collection of the data by means of a previous and similar contact with the data subject, and the data subject was informed of their use by means of a prior contact with the data subject.
| |
| The data subject has been informed of the use of the data for the purpose of political communication, has been given the opportunity to express his or her views on the use of the data for the purpose of political communication
| |
| to object to such use but did not do so. The previous contact was not
| |
| need not necessarily be of a purely political nature, e.g. is it lawful to
| |
| where the email details are not legally valid?
| |
| were collected in the context of a previous invitation to participate in a
| |
| event or action, regardless of its political nature. On the contrary, it is not
| |
| is not considered to constitute a similar contact and it is not lawful to use the
| |
| electronic contact details for the purpose of political communication
| |
| where such information was obtained in the context of a professional relationship, such as 2 As set out in Article 5 par. 2 of the GDPR
| |
| 6
| |
| for example the use of the client file by a candidate for parliament.
| |
| (b) The controller must provide the data subject with the information on the
| |
| data subject to exercise the right to object in an easy and
| |
| clear, and this in every political communication message. In each communication
| |
| shall clearly and unambiguously indicate the identity of the sender or
| |
| the person for whose benefit the message is being sent, as well as
| |
| and a valid address to which the recipient of the message can
| |
| request termination of the communication.
| |
| 6. In this particular case, the complainant, as controller, shall
| |
| carried out a political communication by sending short written messages to the data subject, and
| |
| (sms). The legality of the sending is ensured if the following have been complied with
| |
| the above considerations 4, 5.
| |
| the following emerge from the data controller's response:
| |
| 7. The controller has not provided evidence that
| |
| that the required prior consent of the recipient had been obtained
| |
| of the offending SMS message. On the contrary, the complainant notes that
| |
| he used several sources (other candidates, internet sites)
| |
| and that the mailing was sent in bulk, without knowing at the time of sending whether the
| |
| recipients were voters in the municipality in which he was a candidate, i.e. the municipality in question.
| |
| that communication was made without any of the following
| |
| conditions of legality described in Considerations 4 and 5 above.
| |
| Moreover, the controller has not demonstrated that it follows procedures,
| |
| regarding the sending of short text messages for the purposes of
| |
| communication policy, which ensure that the above mentioned conditions are met?
| |
| conditions of legality.
| |
| 8. The controller did not provide relevant information on other persons
| |
| to whom he has sent political communication messages, nor has he identified the
| |
| specified the exact number of messages sent.
| |
| 9.
| |
| The complainant was not given the opportunity to exercise the right to object in an easy manner.
| |
| and clear, to the offending sms message of the complaint.
| |
| 10. The controller cooperated satisfactorily with the Authority, since
| |
| 7
| |
| responded to the document for clarifications, providing the information that
| |
| requested, as well as at the meeting of the Authority.
| |
| 11. No administrative sanction has previously been imposed by the Authority on the
| |
| The Authority has not been previously sanctioned by a controller.
| |
| On the basis of the above, the Authority unanimously considers that in accordance with Article 11 of Act No.
| |
| 3471/2006, the Authority considers that the conditions for imposing an administrative penalty on the controller are fulfilled.
| |
| on the basis of Article 13 of Law No. 3471/2006, in conjunction with Article 13 of Article 13 of Regulation (EC) No 3471/2006.
| |
| Article 21(21) of Regulation (EC) No 3471/71, in conjunction with Article 21(2)(a) of Regulation (EC) No 3471/2006. 1(b) of Law No. 2472/1997 and with Article 84 of Law No. 84. 4624/2019, and
| |
| on the other hand, Article 58 par. 2(i) of the Rules of Procedure and Article 15(2)(i) of the Rules of Procedure and Article 15(2)(i) of the Rules of Procedure. 6 of Act No.
| |
| 4624/2019, the administrative sanction referred to in the operative part of this Order,
| |
| which is effective, proportionate and dissuasive, taking into account the
| |
| aggravating elements referred to in paragraphs 7, 8 and 9 of this Article and the
| |
| mitigating circumstances set out in paragraphs 10 and 11 of this Decision.
| |
| FOR THESE REASONS
| |
| The Data Protection Authority:
| |
| Impose on A the effective, proportionate and dissuasive administrative
| |
| appropriate in the specific case in accordance with the
| |
| 2 000,00 euros (EUR 2 000,00) for the specific circumstances of the case, for the following
| |
| for the above-mentioned violations of Article 11 of Law No. 3471/2006.
| |
| The Deputy President The Secretary
| |
| Georgios Batzalexis Irene Papageorgopoulou
| |
|
| |
|
| |
|
| |
|
| </pre> | | </pre> |
