HDPA (Greece) - 5/2023: Difference between revisions

Revision as of 08:41, 4 April 2023

HDPA - 5/2023

Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6(1)(a) GDPR Article 6(4) GDPR Article 13 GDPR
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	02.02.2023
Published:	30.03.2023
Fine:	10.000 EUR
Parties:	Vodafone
National Case Number/Name:	5/2023
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	HDPA (in EL)
Initial Contributor:	Anastasia Vlachopoulou

The Greek DPA fined Vodafone for data processing for promotional purposes

English Summary

Facts

After requesting the provision of mobile telephone service, the data subject received a package with product samples sent by an advertising company that was a partner of the data controller, Vodafone. The data subject filed a complaint with the Greek DPA, arguing that they had explicitly objected the processing of their personal data for promotional purposes through an affidavit.

The data controller claimed that the package was not sent for advertising purposes, but as an additional service to the telecommunications service contract already concluded between the two parties. Acoording to the data controller, the purpose of this additional service was rewarding new subscribers, who receive the gifts irrespective of their choices regarding promotions. Moreover, the data controller alleged that customers were informed by means of a banner posted on their website.

Holding

The DPA examined the facts of the case as well as the claims of the two parties and considered that the transmission of personal data to an advertising company and the related data processing had advertising purposes. It stated that the processing in question did not serve a purpose compatible that of the time of the signature of the contract, when the data were collected for the execution of the service required by the data subject as provided for by Article 6(1)(b) GDPR. Further processing was not reasonably expected by the data subject who initially wished to receive services related only to mobile telephony. For this reason, the DPA found a violation of the principle of lawfulness, fairness and transparency established in Article 5(1)(a) GDPR. The DPA emphasized that, in the case at hand, the controller carried out the above processing in disregard of the data subject's express objection.

In adittion, the DPA found a violation of Article 13 GDPR, as the controller did not inform the data subject about the fact that the mere request for the service through the website would imply the transmission of their data to third parties and their use for advertising purposes.

As part of the exercise of its powers, the DPA imposed a fine of 10.000 euros on the data controller and ordered it to adapt its practice accordingly.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

Summary
The Authority examined a complaint from a subscriber who, after applying for a new Vodafone connection, received from an advertising company collaborating with Vodafone a parcel with samples of consumer products, despite his opposition to the use of his data for commercial promotion purposes. According to Vodafone, the sending of the parcel was not a promotional action, but an incidental provision of the telecommunications services contract already drawn up between the parties, which is sent to all, without exception, new subscribers who register through the website www.vodafonecu.gr, regardless of the their choices regarding promotional actions, while relevant information is provided via a banner posted on the website in question.

The Authority considered that the transmission to an advertising company and the related processing of the complainant's data was done for the purpose of promotion, in violation of the principle of legality, objectivity and transparency of the processing, because it was not necessary for the purpose of the contract nor was it reasonably expected for the subject, who had expressly objected to the use and transmission of his data for promotional purposes while it was not proven that the complainant had been fully informed in accordance with Article 13 GDPR about the processing in question. Vodafone was fined 10,000 euros and ordered to adapt its practice regarding the additional benefits in question in order to provide the subjects with full information and the possibility to object.

@@ Line 74: / Line 74: @@
 === Facts ===
-In this case, an individual, the data subject, following his request for a new Vodafone prepaid telephone connection, made a complaint because he received a parcel with commercial samples of consumer products from an advertising company cooperating with Vodafone, who is acting as the data controller, disregarding the already existing explicit objection of the data subject to the transmission and use of his personal data for promotional purposes, in a relevant affidavit of the data subject.
+After requesting the provision of mobile telephone service, the data subject received a package with product samples sent by an advertising company that was a partner of the data controller, Vodafone. The data subject filed a complaint with the Greek DPA, arguing that they had explicitly objected the processing of their personal data for promotional purposes through an affidavit.
-The data controller claimed that the sending of the parcel was not for advertising purposes but an additional service to the telecommunications service contract already concluded between the two parties, namely for the purpose of rewarding new subscribers who, without exception, receive the gifts in question, registered via the website www.vodafonecu.gr, irrespective of their choices regarding the promotions, and informed by means of a banner posted on that website.
+The data controller claimed that the package was not sent for advertising purposes, but as an additional service to the telecommunications service contract already concluded between the two parties. Acoording to the data controller, the purpose of this additional service was rewarding new subscribers, who receive the gifts irrespective of their choices regarding promotions. Moreover, the data controller alleged that customers were informed by means of a banner posted on their website.
 === Holding ===
-The DPA, examining the facts of the case as well as the claims of the two parties, decided that the transmission to an advertising company and the related processing of the data of the data subject had advertising purposes, in violation of the principle of legality, objectivity and transparency of the processing , because the processing in question did not serve a purpose compatible with the original purpose of its collection but was not necessary for the fulfillment of the purpose of the contract in such a way that the relevant processing falls within the legal basis of article 6 par. 1 b), and the additional services were reasonably not expected by the data subject who initially wished to receive services related to mobile telephony.
+The DPA examined the facts of the case as well as the claims of the two parties and considered that the transmission of personal data to an advertising company and the related data processing had advertising purposes. It stated that the processing in question did not serve a purpose compatible that of the time of the signature of the contract, when the data were collected for the execution of the service required by the data subject as provided for by Article 6(1)(b) GDPR. Further processing was not reasonably expected by the data subject who initially wished to receive services related only to mobile telephony. For this reason, the DPA found a violation of the principle of lawfulness, fairness and transparency established in Article 5(1)(a) GDPR. The DPA emphasized that, in the case at hand, the controller carried out the above processing in disregard of the data subject's express objection.
-In addition, the DPA found that the controller carried out the above processing in disregard of the data subject's express objection to the use and transmission of his data for the promotional purposes in question and in violation of [[Article 13 GDPR|Article 13 GDPR]], as the data subject had not received prior to the appropriate information about the fact that the requesting a new connection through the website www.vodafonecu.gr implies the
+In adittion, the DPA found a violation of [[Article 13 GDPR|Article 13 GDPR]], as the controller did not inform the data subject about the fact that the mere request for the service through the website would imply the transmission of their data to third parties and their use for  advertising purposes.
-transmission of his data to the above advertising company and use them for the purpose of advertising its own products and services.
-As part of the exercise of its powers, the DPA imposed a fine of 10,000 euros on Vodafone for the violations found and ordered it to adapt its practice accordingly with regard to the additional benefits that entail further processing of personal data in order to provide the subjects with full information and possibility of objection.
+As part of the exercise of its powers, the DPA imposed a fine of 10.000 euros on the data controller and ordered it to adapt its practice accordingly.
 == Comment ==