HDPA (Greece) - 57/2021

HDPA (Greece) - 57/2021
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 13 GDPR Article 14 GDPR N.3471/2006 Article 11
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	12.07.2021
Published:	31.12.2021
Fine:	25,000 EUR
Parties:	PLUS REAL ADVERTISMENT
National Case Number/Name:	57/2021
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Greek
Original Source:	HDPO (in EL)
Initial Contributor:	eleni.papadopoulou

The Hellenic DPA fined a controller €25,000 for failing to provide information concerning their personal data to data subjects under Article 13 GDPR and Article 14 GDPR.

English Summary

Facts

Two individuals submitted complaints before the Hellenic DPA (HDPA) against advertising company PLUS REAL ADVERTISMENT(henceforth: PLUS REAL) for unlawful processing of personal data for purely marketing purposes. PLUS REAL used an automated mechanism making telephone calls in order to contact individuals for advertising and marketing purposes. As regards the first complaint, the individual received a phone call from an unknown number with a recorded message informing him he won a prize of 680,00 euros. After some seconds a human person was in line telling the individual he had to make an extra call and give a special code in order to win his prize, without giving him more details as for the real call charges. The individual made that second call and heard from recorded message that the call charges are bigger than the ones mentioned at the first call and that the line was occupied so he had to call again. After his third attempt, the individual spoke to a woman and realised that the prize was actually vouchers offered only in case the individual would make high cost purchases. As for the second complaint, the individual mentioned that he received a telephone call from an unknown number with a recorded message telling him he won money as prize for a competition, but the individuals did not manage to hear the name of the company referred. The Hellenic DPA asked integrated communication solutions companies MICROBASE and LEXITEL to whom the unknown numbers belonged and was informed that the owner was PLUS REAL.

Holding

After reviewing the facts of the case, the HDPA first stated that PLUS REAL is "controller" under Article 4(2)(7) GDPR because it processed personal data of individuals for conducting automated phone calls to them with recorded messages. Moreover, the HDPA held that PLUS REAL was in breach of GDPR provisions because it made these calls for advertising and marketing purposes and without previously granting the specific consent of data subjects . In addition, PLUS REAL failed to comply with Article 5(2) GDPR since it failed to prove that these calls never happened or that even though they happened, they were in compliance with law. Furthermore, PLUS REAL did not reveal to data subjects its identity as controller, and did not have a mechanism to respond to data subjects requests for information concerning their personal data. Therefor, the HDPA fined the controller, PLUS REAL, €25,000 under Article 58(2) GDPR and Article 83(5) GDPR for the breach of Article 13 GDPR and Article 14 GDPR.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

  
    

  
  
    
  
    Category
              Decision
          

  
    Date
              08/12/2021

          

  
    Transaction number
              52
          

  
    Thematic unit
          
              09. Promotion of products and services
              
      

  
    Applicable provisions
          
              Article 28: Perform the processing (arrangements)
          Article 32: Processing security
          Article 11.1: Unsolicited electronic communication
              
      

  
    Summary
              The Authority received 17 complaints regarding illegal telephone calls aimed at promoting products or services of the company ZENITH - Gas Supply Company of Thessaloniki, Thessaly SA. For this specific processing ZENITH has the position of controller, and One Way Private Company has the position of executor. The examination of the case revealed that due to an error in the implementation of the processor, telephone calls were made to subscribers who had been registered in register 11, in violation of article 11 of Law 3471/2006. The Authority imposed on the processing One Way Private Company a fine of 30,000 euros for violation of article 32 par. 2 and 4 of the GCP in combination with article 28 par. 3, c. He also imposed on the person in charge of processing ZENITH, the sanction of the reprimand for violation of article 28 par. 3 case c of GKPD.

          

  
    PDF Decision
              52_2021anonym.pdf272.69 KB
          

  


    
  
    Category
              Decision
          

  
    Date
              08/12/2021

          

  
    Transaction number
              52
          

  
    Thematic unit
          
              09. Promotion of products and services
              
      

  
    Applicable provisions
          
              Article 28: Perform the processing (arrangements)
          Article 32: Processing security
          Article 11.1: Unsolicited electronic communication
              
      

  
    Summary
              The Authority received 17 complaints regarding illegal telephone calls aimed at promoting products or services of the company ZENITH - Gas Supply Company of Thessaloniki, Thessaly SA. For this specific processing ZENITH has the position of controller, and One Way Private Company has the position of executor. The examination of the case revealed that due to an error in the implementation of the processor, telephone calls were made to subscribers who had been registered in register 11, in violation of article 11 of Law 3471/2006. The Authority imposed on the processing One Way Private Company a fine of 30,000 euros for violation of article 32 par. 2 and 4 of the GCP in combination with article 28 par. 3, c. He also imposed on the person in charge of processing ZENITH, the sanction of the reprimand for violation of article 28 par. 3 case c of GKPD.

          

  
    PDF Decision
              52_2021anonym.pdf272.69 KB