HDPA (Greece) - 25/2023: Difference between revisions

Revision as of 09:03, 12 July 2023

HDPA - 1510/12-06-2023

Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 5(1) GDPR Article 5(2) GDPR Article 15 GDPR Article 25(1) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	13.12.2022
Decided:	12.06.2023
Published:	27.07.2023
Fine:	100.000 EUR
Parties:	n/a
National Case Number/Name:	1510/12-06-2023
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Greek
Original Source:	HDPA (in EL)
Initial Contributor:	ANASTASIA TSERMENIDOU

The Greek DPA issued a fine of 100 000 EUR to a bank for unlawful processing of personal data and breach of right of access.

English Summary

Facts

Piraeus Bank S.A., the controller, sent the data subject a letter informing them that it had entrusted the management of loans and credits related claims to a credit management company (AFS), its wholly owned subsidiary. The letter also informed that the data subject was a party to a claim and that their personal data had been with AFS, which was managing the claim.

The data subject submitted an access request to the controller under Article 15 GDPR, asking for more detailed information such as the date, the means and the purpose of the transmission of their personal data as well as the loan contract number and any other data shared with AFS.

The controller responded that the letter was sent to the data subject by mistake and asked them to disregard it as their personal data had not been shared and remained in its servers.

Dissatisfied with the response, the data subject filed a complaint with the Hellenic DPA, claiming that the controller did not provide sufficient information. Moreover, they argued that they did not have any loan or credit related claim with the controller and, therefore, there was no legal basis for sharing their data with AFS.

The DPA opened an investigation on the controller.

In the procedure, the controller stated that it had an agreement with AFS for the management of its 'portfolio' (receivables from loan granting and/or customers' debts that had became overdue, terminated or settled). The controller admitted that, due to a technical problem with its systems, letters were mistakenly sent to customers that had zero balance and were not included in the portfolio.

Holding

After the investigation, the Hellenic DPA could not determine if the data subject's data had been transferred to AFS, but reserved itself the right to further investigate the matter.

On the other hand, the DPA found that personal data from the data subject, as well as from a large number of the controller's customers who were involved in loans with zero rest, were mistakenly included in a list of recipients of personalized letters. According to the DPA, the controller had no legal basis for this personal data processing and, therefore, violated Articles 5(1)(a) and 6 GDPR.

Furthermore, the DPA held that the controller did not implemement sufficient organizational and technical measures to ensure that the processing of personal data meets the legal requirements, in breach of Article 25(1) GDPR.

Finally, the DPA stated that the response to the access request was incomplete as the controller merely informed the data subject that their data remained in its servers, but did not clarified about further processing operations that were being carried out. Thus, it concluded that the controller also violated Article 15(1) GDPR.

For the above reasons, the DPA issued a fine of €100,000 on the controller.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

Summary
The Authority found that the complained bank processed the personal data of the complainant and a large number of its customers in violation of the principle of legality and, moreover, without having taken appropriate and effective technical and organizational measures so that only the data that they are necessary to serve a specific purpose, thus violating the principles of legality of processing and data protection by design.

With the information available to date, there has been no transmission of the data of the above persons to the Loan and Credit Receivables Management Company. The Authority expressly reserves the right to exercise its powers in relation to this particular issue in the future, given that the overall audit is ongoing and not yet complete.

Finally, the Authority established the non-satisfaction of the complainant's right of access.

@@ Line 72: / Line 72: @@
 Piraeus Bank S.A., the controller, sent the data subject a letter informing them that it had entrusted the management of loans and credits related claims to a credit management company (AFS), its wholly owned subsidiary. The letter also informed that the data subject was a party to a claim and that their personal data had been with AFS, which was managing the claim.
-The data subject submitted an access request to the controller but was not satisfied with the answer they received. Then, they filed a complaint with the Hellenic DPA, arguing that thez were not a partz to anz loan or credit related claim and, therefore, the controller had no legal basis for sharing their personal data with AFS. Moreover, they argued that the controller did not provide them with sufficient information after the acess request  under [[Article 15 GDPR]].
+The data subject submitted an access request to the controller under [[Article 15 GDPR]], asking for more detailed information such as the date, the means and the purpose of the transmission of their personal data as well as the loan contract number and any other data shared with AFS.
+The controller responded that the letter was sent to the data subject by mistake and asked them to disregard it as their personal data had not been shared and remained in its servers.
+Dissatisfied with the response, the data subject filed a complaint with the Hellenic DPA, claiming that the controller did not provide sufficient information. Moreover, they argued that they did not have any loan or credit related claim with the controller and, therefore, there was no legal basis for sharing their data with AFS.
 The DPA opened an investigation on the controller.
-On the basis of the information available to date, no transfer of the data of the above-mentioned persons to the Loan and Credit Claims Management Company has occurred (the Bank proceeded, in accordance with the provisions of Law 4354/2015 as in force, an agreement to entrust the management of its receivables from loans/credit to debtors whose debts had become fully or partially due and/or terminated or settled to the Loan and Credit Claims Management Company).
+In the procedure, the controller stated that it had an agreement with AFS for the management of its 'portfolio' (receivables from loan granting and/or customers' debts that had became overdue, terminated or settled). The controller admitted that, due to a technical problem with its systems, letters were mistakenly sent to customers that had zero balance and were not  included in the portfolio.
-The HDPA stated that she expressly reserves the right to exercise its powers in this regard in the future, given that the general audit is ongoing and has not yet been completed. Finally, the HDPA has found that the complainant's right of access has not been respected.
+=== Holding ===
+After the investigation, the Hellenic DPA could not determine if the data subject's data had been transferred to AFS, but reserved itself the right to further investigate the matter.
-=== Holding ===
+On the other hand, the DPA found that personal data from the data subject, as well as from a large number of the controller's customers who were involved in loans with zero rest, were mistakenly included in a list of recipients of personalized letters. According to the DPA, the controller had no legal basis for this personal data processing and, therefore, violated Articles 5(1)(a) and 6 GDPR.
-After the investigation, the Hellenic DPA found that the controller shared the data subject's personal data with AFS although they did not have any loan or credit related claims. In fact, the DP found that the controller, through automated means,  mistakenly shared a list containing personal data of a large number of consumers who did not have any claim related to credit or loan issues.
+Furthermore, the DPA held that the controller did not implemement sufficient organizational and technical measures to ensure that the processing of personal data meets the legal requirements, in breach of Article 25(1) GDPR.
-Therefore, the DPA concluded that the controller processed personal data of the data subject and of a large number of its customers in breach of the lawfulness principle. It also held that the controller did not put in place enough measures to ensure that only the data necessary for a specific purpose were processed, violating the principles of data protection by design.
+Finally, the DPA stated that the response to the access request was incomplete as the controller merely informed the data subject that their data remained in its servers, but did not clarified about further processing operations that were being carried out. Thus, it concluded that the controller also violated Article 15(1) GDPR.
-The HDPA held that the Bank had not taken the appropriate technical and organisational measures measures and did not have the appropriate procedures in place to ensure that the creation of the list of its customers with debts in question was drawn up in accordance with proper systemic configure. Moreover that the high degree of responsibility owns the Bank in relation to the absence of technical and organisational measures.
+For the above reasons, the DPA issued a fine of €100,000 on the controller.
 == Comment ==