HDPA (Greece) - 57/2021

HDPA (Greece) - 57/2021
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 13 GDPR Article 14 GDPR Article 11(1) Law 3471/2006
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	31.12.2021
Published:
Fine:	25,000 EUR
Parties:	anonymous PLUS REAL ADVERTISEMENT
National Case Number/Name:	57/2021
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Greek
Original Source:	HDPA (in EL)
Initial Contributor:	Heiko Hanusch

The Hellenic DPA fined a company €25,000 for making unsolicited automated marketing calls, and for not providing relevant information under Articles 13 and 14 GDPR during the calls.

English Summary

Facts

The controller – PLUS REAL ADVERTISEMENT – provides marketing calls. Following two complaints, the Hellenic DPA (HDPA) investigated the calling practices of the controller. In the complaints the data subjects brought forward that they did not consent to being called by the controller. The controller, on the other hand, argued that the data subjects consented to the calls. However, as per general company policy, the records of the consent were destroyed after the respective promotional cycle ended. Moreover, the company claimed the calls were not automated calls and, therefore, no consent was needed under Greek national law.

Holding

The HDPA found that the behaviour of the controller violated Article 11 Law 3471/2006. Article 11(1) Law No. 3471/2006 stipulates that the use of automatic calling systems (and more generally, the making of unsolicited communications by any means of electronic communication without human intervention) for any kind of advertising purposes, is only allowed if the data subject expressly consents in advance. The HDPA held that the calls were automated, taking the principle of accountability under Article 5(2) GDPR into consideration. According to this provision, the burden of proof is on the controller, and in this case, it did not prove otherwise. On the other hand, the complainants fully identified the automated nature of the calls. Furthermore, the HDPA held that the controller failed to prove that the data subjects gave their consent to being called and messaged. According to the HDPA, the deletion of subscribers' details after the end of the respective promotion cycle could not excuse this failure, and the company should have kept the data subjects' proof of consent for a reasonable period of time to ensure the proper conduction of the investigation, especially since the controller was aware of the existence of the complaints before the deletion took place.

Additionally, the HDPA stated that, when carrying out promotional phone calls, the controller should inform the data subject of its identity and its representative, the purpose of the processing, and it should not conceal or falsify its number, according to its obligations under Articles 13 and 14 GDPR.

The HDPA decided to issue a fine of €25,000. When it determined the amount of the fine, the HDPA took into consideration the fact that taking the controller had a financial aim with the processing in question (since there is a charge for users if they select the appropriate key on their phone and proceed further), that it did not have a complaints procedure and that only two complaints have been lodged with the authority.

Comment

The corresponding decision of the same date can be found here: HDPA (Greece) - 56/2021.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

  Athens, 31-12-2021 Ref. No .: 3036 DECISION 57/2021 The Authority for the Protection of Personal Data, met, after the invitation of its President in a meeting by teleconference on 12-07-2021 followed by 23-04- 2021 meeting and adjourned the meeting from 31/3/2021, in order to examine the case mentioned in the history of the present. Attended by Konstantinos Menoudakos, Chairman of the Authority, the taktikameliSpyridonVlachopoulos, KonstantinosLamprinoudakis, oseisigitis, kaiCharalampos Anthopoulos.Stisynedriasi, chorisdikaiomapsifou, attended by the President ordered, auditors and John Constantine Limniotis Lykotrafitis, experts computer scientists, osvoithoieisigiti, and Irene Papageorgopoulou, employee of the Department of Administrative Affairs, as secretary. The Authority took into account the following: The complaint No. A / prot. 09-2020 document. According to this, the complainant received, at… 2020… time. A telephone call to his telephone number… from the phone number ά unknown to him…, and in response he heard the following recorded message: “You won 680 euros. Please wait for us to contact you with a representative to receive your gift ". After 20 seconds he heard a voice (with a natural speaker and not through an automated message) informing him that he had won 680 euros in gift vouchers and should contact another 1-3 Kifissias Ave., 11523 Athens T: 210 6475 600 E: contact@dpa.gr www.dpa.gr, number and give them the code they will hear in this active call, in order to declare in this way that they accept the gift. Indeed, he was given a code (…) and dictated the number… he would have to call in order for the gift to be accepted. Then the complainant, as he states, asked if a specific phone number is with a subscription or has a one-time charge, receiving the answer that he owes three (3) euros once and the call was terminated. Then, on… the complainant called the above number, where he heard a recorded message stating that he had won a huge gift, he also mentioned the call charge (6.45 euros per minute) and after waiting for about 40 seconds, he heard a message that all the lines were to call later. The complainant attempted a call again, during which, again with a delay of 56 seconds, a girl answered, the dialogue with which she quotes in her complaint, and from which it appears that she was initially informed that she had received a which were on high cost products. The complainant also mentions information he obtained from various Internet sources about these calls, which are characterized on these sites, by citizens who received such calls as fraud. The Authority sent to the companies Microbase Advanced Communication and Information Services IKE (hereinafter, Microbase) and Lexitel MEPE (hereinafter Lexitel), in whose network belonged the first telephone numbers… and…, respectively, the reference numbers G / EX / 5585- 1 / 18-08-2020 and G / EX / 5585-2 / 18-08-2020 documents respectively, requesting to provide the necessary subscriber information for the respective numbers (name or surname, address and / or other communication). Microbase answered 2 that the owner of the first number is the company PLUS REAL ADVERTISMENT ADVERTISING - PROMOTIONAL - COMMERCIAL - RESEARCH AND 1According to the website www.foritotita.gr of E.E.T.T. 2With the prot. Lexitel initially replied, in its document no. After further clarification of the Authority's auditor (by telephone) that, in any case, the details of the holder of the said number must be notified to the Authority, and after sending two reminder emails (e-mail) to the company due to non-response. Lexitel finally informed the Authority with reference number Γ / ΕΙΣ / 6297 / 16-09-2020 that for this number the holder is the company PLUS REAL. The Authority, in the context of the examination of the above complaint, sent to PLUS REAL the document no. Prot. information on the general procedures that the company follows to carry out telephone actions such as the above, ie whether it is active in the field of telephone promotions on its behalf and / or on behalf of others, how to choose the so-called numbers, what information is provided processing purposes, as well as whether all calls it makes are automated (without human intervention). PLUS REAL responded to the Authority with the document number G / EIS / 8895 / 212-2020, which states the following: A. The company with the name "PLUS REAL ADVERTISMENT The activity is, inter alia, to carry out at certain intervals, promotional actions by telephone, with clear terms of participation, which were communicated in detail to the participants. These promotions are carried out in accordance with the published written terms of participation, which are submitted to a notary and posted on the company's website for the purpose of informing the public, for the entire duration of each promotion. The terms of the promotions state by 3, rule as follows: “Participation in the Promotion is carried out by submitting valid contact details, in one of the following ways: (1) through postings / postings on the internet, on sites that promote consumer non-products, where there is a relevant posting of the Organizing Company, or (2) through the special participation forms, which bear the name of the Organizing Company and are distributed by its representatives, or (3) through the special telephone number ___, with a local charge . Specifically, the participants for the validity of their participation should respectively for each of the above mentioned ways: (1) to fill in the special Form for Participation in the respective Promotional Energy, which is available from time to time on various sites that promote consumer or non-products, indicating obligatorily and in full and true the following information: name, surname and telephone number ,, or (2) state in full and true the following information: name, surname and telephone number in the relevant registration form (coupon), which will be issued to them by a representative of the Organizing Company and will be completed by the Participant himself or by the representative of the Organizer, at the discretion of the Participant, or (3) to state obligatorily and in full and true the following details: name, surname and telephone number of the answering machine of the Organizing Company, who will answer 24 hours a day on telephone calls to a telephone number with a local charge. " (…) "The Organizer considers that each participant is the owner and has the sole control of the e-mail address he declares as well as the declared telephone number". "During the Promotion, all valid, according to the above mentioned, Participation Statements, will be collected in a special file (Excel) of the Organizing Company and will receive a serial number, followed by informing the Beneficiaries about the next stages of the Promotion energy. This file will be destroyed after the completion of the Promotion. " 4, "Each Beneficiary will be informed free of charge, by calling from the call center of the Organizing Company on the mobile or landline number he has declared during his participation under Article 4, that he is the Beneficiary of the Promotional discount gift vouchers and must confirm that he wishes and accepts any gifts he is entitled to. If he accepts his participation, he will be informed during the same communication about the number he will call to be informed about the way of receipt (…) ". "All participants acknowledge, declare and accept explicitly and unconditionally that: (a) Their personal information in this promotion may not belong to a natural or legal person, but to themselves; , (c) their personality is not compromised or diminished in any way by their participation in such promotional activity of the Organizer, in (d) do not infringe on the personal data or privacy of any third party, (e) do not infringe the intellectual property rights of any third party, (f) expressly consent to the Organizer use and process their personal (name, telephone, e-mail address) solely for the purpose of serving the Promotional energy, (g) provide their consent and authorization to the Organizer for the promotion of the Promotional energy and its results through the printed and electronic press and the internet (internet ) throughout its duration.  The Organizing Company reserves the right to use and publish any news item related to the conduct of the Promotion. " "Privacy. By participating in the Promotional Action, each participant expressly declares and accepts that his / her personal data is collected and used by the Organizer for their processing through automated or non-automated means, either by himself or through any other person appointed by it for its implementation. the above processing by order and on its behalf under this. The 5, personal data of the winners in the Promotional Energy, in their capacity, will be kept by the Organizer and will be used exclusively for the purposes of the Promotional Energy. In any case, the personal data of the participants will be kept in accordance with the current Greek legislation, Law 4624/2019 on the Personal Data Protection Authority and the General Regulation on Personal Data Protection - Regulation (EU) 2016/679 of the European Parliament. The participants will have the right to proceed at any time and without charge to the confirmation, modification or correction, restriction or deletion of all their personal data kept in the file according to the terms of current Greek legislation, Law 4624/2019 on the Data Protection Authority. And the General Regulation on the Protection of Personal Data - Regulation (EU) 2016/679 of the European Parliament (GDPR) as applicable by contacting the Organizer's manager, email plusrealadvertisement@gmail.com or contact us at energy. The exercise of the rights of restriction, objection and / or the right of deletion, if they concern data that are necessary for the implementation and / or continuation of this promotional action, implies either the inability to participate, if they are exercised before the implementation of the Promotional Energy or the automatic cancellation of participation in it if they are exercised at any stage of Promotional Energy. The Organizer expressly and undertakes to follow the principle of processing of the minimum personal data and the above data collected, processed exclusively for certain purposes above here. Furthermore, it states that it has taken all the necessary measures, technically, organizationally, legally in order to ensure the protection of this data (…) »As PLUS REAL states, from the above basic terms, the following are briefly stated, : 6,1. Participation in the promotion was done on the initiative of the participant, in one of the ways explicitly provided. Therefore, the participant voluntarily stated his / her details, filling in a relevant form, in which, among other things, he / she also mentioned the desired communication telephone. 2. In order for a participation to be considered valid, all the minimum required information, ie name, surname and telephone number, must be mentioned, so that, if necessary, the holder can be identified. 3. The valid entries were collected in an electronic file, so that the communication could take place, with which the participants were informed about the next stages of the promotional action. 4. The above records are kept only for as long as the respective promotion in the participation in which the participant has consented lasted. They are then destroyed. 5. The communication is made to the number that the participant himself had stated, giving his consent to the said communication for the purpose of the promotional action. 6. A special telephone number is defined in each promotional action, in order to give the possibility of expressing complaints. 7. Each participant declares that he / she processes his / her personal data, including the telephone, for the purpose of serving the promotional energy. 8. A special telephone number with a civil charge is defined for the purpose of serving the exercise of the right of objection. Participants could at any time and without charge to confirm, modify or correct, limit or delete all their personal data by contacting the Organizer's editor, to a specific e-mail or phone number. 9. Each participant becomes aware of the terms before submitting his / her participation, in which case he / she declares that he / she voluntarily participates in the promotional 7 action and unconditionally accepts the conditions under which it is carried out, ie the telephone communication. B. On the above complaint, PLUS REAL states that the complainant admitted that he had wrongly complained to the company and withdrew his complaint in writing and informed the Authority accordingly. In particular, the complainant in question contacted an employee of the company at the end of… 2020 and then the company contacted him in which after hearing his lengthy protests he kept his contact details. An investigation revealed that the complainant had filled in a participation form in the competition in which he stated his personal details and contact details. He then called him and informed him about it, where he admitted his mistake and attributed the misunderstanding to the fact that during that time he had repeatedly received calls from various numbers, which caused him irritation and inconvenience, so he made the complaint by forgetting. However, in the case of the company in question, the summons was made with the express consent of the company. This statement of the complainant, however, has not been submitted to the Authority by him. Regarding the content of the complaint, PLUS REAL points out that the complainant, being registered in the file of the participants, was called by an employee of the civil service, who has no charge for the summoned. This call is always made in order to confirm the participation of the called party. The complainant did not answer this call and he himself, calling back, listened to the recorded message of our call center (welcome message), which informs the participant that he will be connected with a representative of a company. Then, after talking to a representative, she was informed that she had won an amount which corresponds to discount gift vouchers which correspond to specific products. The complainant was informed that if he wished to receive the discount gift vouchers, he would have to call a toll-free telephone number to have the gift vouchers accepted and state where the gift vouchers would be sent to him. The claim of the complainant that he was not informed of the exact amount of the cost of the telephone number and the charge is, according to the company's allegations, untrue and inaccurate, since all those who choose to call are informed of the exact amount of the cost of the call. In addition, in addition to the above information made by the company employee, when interested parties called the phone number where the charge was, to receive the discount gift vouchers, before their charging began, a free audio message stating their name preceded them. of the service provider and reminded them of the charge for the call that would follow, so that even at this stage anyone who did not wish to be charged for the phone would interrupt the call, without being charged. According to the company, the complainant confirms this fact in the continuation of his complaint where he states that when he called he heard a recorded message informing him about the charge of the upcoming call. The company also states that for these promotions it is subject to administrative and operating expenses, which it covers from the aforementioned telephone charges for which it repeatedly informs and intermediaries the participants. that he won 680.00 euros in gift vouchers then, completely contradictory according to the company, he states: "they did not tell me what I earned beyond the amount, that is, I was not clarified that they are discount vouchers, they clearly gave me a voucher". This, according to the company's claims, is completely false as it is made clear to the participants from the beginning that the gifts consist of discount gift vouchers which relate to specific products and not to a monetary amount or check. Also his report The complainant that he did an internet search for the company is vague, vague, unproven and not substantiated as no 9 is presented, evidence from which it appears that what the complainant mentions concerns our company. Finally, PLUS REAL, on the more specific questions posed by the Authority in its letter, states the following: a) Telephone calls are made on behalf of the company "PLUS REAL ADVERTISMENT - ADVERTISING - RESEARCH AND MUNICIPALITY" in the context of business activity.  b) The telephone numbers called by the company come from the entries made by the holders of these telephone numbers themselves, declaring participation in each promotion, based on the relevant terms, mentioned above under A. according to article 11 par. 1 of law 3471/2006 his explicit written consent for communication with him. With this consent, the company communicates with you exclusively for the purpose for which it was provided. c) The call that is made to the number that has declared participation is not automated (robocall) but is made by employees of the company. The caller can either state to the employee that he will leave the call or that he wishes to proceed, ie he states that he now explicitly wishes and consents to the communication and then, after being informed orally and with a recorded message about the cost of the call, connects if he chooses (the company notes that no charge is imposed on the participant in the promotion up to this point) knows having accepted the terms of the promotion. d) Communications are made exclusively to persons who have explicitly consented, participating and stating their details in the relevant form, based on the terms of each promotion. Consequently, no violation 10, of article 11 of law 3471/2006, occurs, according to the company, as article 11 par. 1 of the law requires "the subscriber has not explicitly consented in advance", an element that does not exist in the case of the company. On the contrary, the consent of the appellant as the participant declares his phone number in the special participation form, free as it is a voluntary action, and special as, as it appears from the terms he accepts, he has been previously informed that his telephone number for that purpose. It is therefore ensured in many ways, according to the company, that the participant acts with full awareness and awareness of the consequences of his statement. e) All participants are given the opportunity to object in a clear and definite manner, both on the terms of the promotion and at the beginning of the conversation with the representative of the company. If the called party declares that he does not want to receive communications, despite his initial explicit consent to them, he is automatically deleted from the relevant list. f) The records of the participants and the so-called outgoing call records are kept for the duration of the promotion, ie until the receipt of the gifts, and then deleted, once the purpose of keeping the record has been fulfilled. No use other than that covered by the purpose of the promotion is made. g) Since the calls from the employees are made mechanically, after entering the number of the participant in an electronic database, it is possible that among the numerous registered calls there is an error in the number, due to an incorrect entry of the number in the electronic database, that is, in human error. Subsequently, a newer complaint was submitted to the Authority with no. prot. 11,3471 / 2006, from the number…. The complainant states that he was informed by an automated message about his alleged victory in a competition with a cash prize, without retaining the name of the company. The Authority sent to the company Microbase, in whose network the 3rd above telephone number belongs, the document number C / EXE / 871 / 18-03-2021, requesting to provide the necessary subscriber information (name or surname, address and / or other communication). Microbase answered 4 that the owner of the first number is the company PLUS REAL ADVERTISMENT ADVERTISING - PROMOTIONAL - COMMERCIAL - RESEARCH AND POLLINGS SOLE SHAREHOLDER IKE (hereinafter, PLUS REAL). Then, the Authority invited to a hearing the PLUS REAL ADVERTISMENT - ADVERTISING - PROMOTION - RESEARCH AND POLLINGS SINGLE PERSON IK. 2021). As the above response of Microbase regarding the number… holder was not yet known to the Authority at the time of sending this call, the Authority sent a few days later the reference number C / EXE / 888 / 19- 03-2021 a letter to the controller, by which he forwarded the above complaint no. Prot. or, at the very least, be in a position to state his views on it and on it at the hearing. The controller did not submit any comments on the complaint until the date of the hearing. During the meeting of 31-03-2021, Mr. Nikos Petropoulos, lawyer (AMDSA…) was present as a representative of the person in charge of processing, who submitted a request for postponement of the discussion, which was accepted, setting a new date for the discussion of the case on 23-4-2021. The meeting of 23-4-2021 was attended by Ms. Ioanna Kamarinopoulou, lawyer (AMDSA…), as a representative of the responsible 3According to the website www.foritotita.gr of E.E.T.T. 4With document no. G / EIS / 1942 / 18-03-2021 document 12, processing. After the meeting, the person in charge of processing received a deadline for submitting a memorandum, which he submitted, within the set deadline, with the document number G / EIS / 3393 / 24-05-2021. Already before the expiration of the deadline for submitting the memorandum, and three days after the hearing of the controller where it was said that the complainant Mr. A has not submitted his revocation of the complaint, the complainant submitted to the Authority no. that he withdraws his complaint because his partner had given his own details, declaring participation in a specific promotion. The memorandum submitted by the controller after hearing him states the following: a) The controller started the activity in the summer of 2019, which consists, among other things, of These promotions are carried out in accordance with the published written terms of participation, which are submitted to a notary and are posted online for the purpose of informing the public about the entire duration of each promotion. The memorandum provides the terms of the two most recent actions, as submitted before a Notary. b) During the hearing the controller was asked the question of his relationship with the company INFO COMMUNICATION SERVICES, given that according to a search in the General Commercial Register (GEMI), the two companies show the same natural person as Management, have similar activities, The representative of the controller at the hearing before the Authority also represented INFOCOMMUNICATIONSERVICES at the same meeting and in the other case. different facilities, numbers and infrastructures, and regarding the specific activity that each carries out independently, each of them was presented with the 13, VAT declarations of both companies for September 2019, from which it results that they operated in parallel and not sequentially. c) The controller reiterates in his memorandum that he carries out the promotional actions exclusively to persons who have previously registered their participation, having recorded in a special form or coupon the telephone and other contact details, thus consenting to the communication with them. After the end of the respective promotion, the details of the participants - which were not disclosed to any third party - are deleted. Furthermore, the controller states that in the calls to each participant there are two options, either to contact a representative by selecting the key number "1" or to look for his deleted items from the lists by selecting the key with the number "2". The controller also refers to the link https://tagnews.gr/συμμετέχω-και-κερδίζω, where the terms of the most recent, now completed, promotional actions are posted, together with the participation form. From the examination of the Authority on the above internet link, it appears that the conditions of participation are generally corresponding to those described in the original document no. documents in the note of the controller. Specifically, 5 in the above internet link, the visitor enters, in appropriate forms, name, surname and telephone, while he is asked to select the checkbox that accepts the terms of participation. The terms state, among other things, that " The beneficiary of the Promotion, who will call the Service number, Multimedia Information of increased charge, is the holder of the SIM card, which corresponds to the mobile number of the mobile or respectively the subscriber of the landline from which he called (…) ".  5 Date of last access: 2/7/2021 14, d) Regarding the individual complaints, for the first complaint. A states again that the complaint has been explicitly withdrawn by him. The controller states that the complainant informed him that he had not withdrawn his complaint to the Authority because he had lodged another complaint with the Authority against another controller and - as stated in the controller's memorandum - "the complaint could not be withdrawn. partly". Regarding the second complaint, the controller states only the following: '(…) it is most likely due to either incorrect typing or incorrect telephone entry in the entry form. "We have nothing to declare." The Authority, after examining all the elements of the file and those shared at the meeting of 23-04-2021, after hearing the rapporteur and the clarifications of the assistant rapporteurs, who (assistants) left after the discussion and before the conference and the decision-making, and after a thorough discussion, THOUGHT IN ACCORDANCE WITH LAW 1. From the provisions of articles 51 and 55 of the General Regulation of Data Protection (Regulation (EU) 2016/679-hereinafter, GCC) and article 9 of tonus 4624/2019 (ΦΕ) ) it appears that the Authority has the power to supervise the implementation of the provisions of the GCC, this law and other regulations concerning the protection of the individual from the processing of personal data. 2. According to article 4 lit. 7 of the IGC, which is effective from 25 May 2018, the controller is defined as "the natural or legal person, public authority, service or other body that, alone or jointly with others, determines the purposes and manner the processing of personal data ". 3. The controller, in the context of the observance of the principle of fair and lawful processing of personal data (Article 5 par. Articles 13 and 14 of the GIP, in order to inform the data subject that he is going to process his data in a lawful and transparent manner, and in addition must be able at all times to accountability under Article 5 (2) of the GIP). The information obligation entrusted to the controller is set out in Articles 13 (concerning information provided if personal data are collected by the data subject) and 14 (concerning information provided if personal data are not collected from the data subject) of the GCP. 4. The issue of telephone calls, for the purposes of direct promotion of products or services and for any kind of advertising purposes, is regulated in Article 11 of Law 3471/2006, which defines the relevant unsolicited communications (see paragraphs 1 and 2). ). It is noted that, for this issue, the rule of prior consent was initially chosen (see the pre-existing form of Article 11 of Law 3471/2006). However, with the provisions of article 16 par. 1 and 2 of law 3917/2011, par. 1 and 2 of article 11 of law 3471/2006 were amended, so that with article 11 par. 1 of law 3471/2006 "The use of automated calling systems, in particular the use of fax or e-mail devices, and in general the making of unsolicited communications by any means of electronic communications, without any kind of advertising purposes, is allowed only if the subscriber consents with prior consent ", while paragraph 2 of the same article stipulates that:" Unsolicited communications with human intervention (calls) are not allowed for the above purposes, if the subscriber has the publicly available service, that it generally does not wish to accept such calls. The institution is obliged to register these statements free of charge in a special list of subscribers, which is at the disposal of every interested party ". Consequently, after 01-09-2011, when the amended provision - to 16, more favorable for controllers - entered into force, telephone calls with human intervention, in view of the above purposes, are allowed, unless the called party has stated that he does not want them ("opt-out" system). The advertisers, if they carry out telephone promotions with human intervention, must receive from all providers updated copies of the Registers of article 11 of law 3471/2006 and ensure that they have available the statements of the subscribers that have been made up to thirty days before the making of the telephone call (see also the Authority No. 62-67 / 2016 Decisions). Moreover, according to article 13 of the above law 3471/2006, the control of the observance of the provisions of this law belongs to the Authority. 5. In any case, it is noted that for calls without human intervention (automated calls) is required, as explicitly required by Article 11 par. 1 of Law 3471/2006, the prior consent of subscribers - even if these numbers do not have entered in the "opt-out" register of their provider. It should be noted that the provision on automated calls, pursuant to Directive 2002/58 / EC, has been in force since its entry into force. 3471/2006 but also of the previous law 2774/1999, that is, it was not affected by the subsequent amendment of law 3471/2006. After all, automated calls are a very invasive means of promoting products and services, as by nature, the recipient of the communication does not easily have the opportunity to be informed and to exercise his rights, as in the case of communication through human intervention. 6. Furthermore, the controller must satisfy the other rights of the data subjects, in particular the rights of information (Article 13 of the GIP regarding information provided if personal data is collected from the data subject and Article 14 of the GGP have not been collected by the data subject), access (Article 15 of the GIP) and opposition (Article 21 of the GIP). This means, in relation to the obligation to inform, that when making a telephone call, the controller should inform of his / her identity and the identity of his / her representative, not to conceal or falsify the caller's number and to inform the rights. Also, with regard to the right of objection provided for in Article 21 of the GIP, the controller must, in order to comply with the obligation arising from this provision, take care, if a called subscriber objects to receiving calls by the specific controller (and / or his representative), to follow a clearly defined procedure that ensures that this number will be excluded from any telephone promotional / advertising action of the controller in the future (see Nos. 67 / 2016Decisions of the Authority, but also the Decision of the Authority No. 127/2017). 7. In the specific cases, based on the above, it appears that the complained company, as the person in charge of processing, carried out automated telephone promotional actions. Therefore, the legitimacy of these promotions is ensured if the above considerations are met. 8. Examination of the data in the case file shows, in particular, that the controller makes automated calls for the promotion of products and services without the prior specific consent of the data subjects. This is because the main claim of the controller that the calls are made only to those who have given their explicit prior consent, as well as that the calls are not automated, is unfounded because it is not confirmed by the data he cites, for the following Reasons: a) For none of the complaints did the controller provide evidence proving that he had obtained the prior consent of the called subscriber. Even in the case of the first complaint for which he submits a document of the complainant to the company with which he allegedly withdraws his complaint (and which he himself submitted to the Authority after 18, the hearing of the controller, although he did not respond to e-mail to confirm the withdrawal of his complaint relied on by the controller) does not provide evidence that he had in fact obtained his prior consent (which he should have based on these identified this prior consent of the complainant). For the second complaint, he did not substantially investigate whether he had obtained the complainant's consent, as he considers it equally possible that either a typing error occurred during the call or that the complainant had entered the wrong telephone number.


       It should also be noted that, as already specified
the Authority in this regard (see, for example, Decision No. 66/2016),

in order for the controller to be able to investigate any

Complaints of the data subjects, should be taken care of

information necessary to investigate any complaint. In

in this case, the consent of their subjects
data should be kept for a reasonable period of time to

service of the above purpose - much more likely in the present case,

of which the controller knew, from her documents

Authority, for the existence of complaints submitted to the Authority. As a million

therefore, the deletion of the details of the participants which the

the controller claims that it performs after its expiration
promotional action, can not justify not

its ability to prove that the calls were indeed made

to users for whom he had obtained special consent.


       Further, despite the claims of the controller that
the calls were not automated, both complainants

(including the first complainant who recalled it

as to the part of his consent) describe in detail that


                                                                   19, calls were made automatically - while making

automated dialing is also described in the general text

information provided by the controller
processing. As the Authority has already judged, and even before the start

validity of the GCP (see, for example, the already mentioned, no.

66/2016 Decision of the Authority), when the so-called subscriber is

The recipient of the harassment does not ask for it, only he can do it for her

proof of this in case he wants to make a complaint, is to

limited to external elements of the call and its reference
(phone number of the call, time and day of the call,

advertiser and additionally, a person with whom he talked, if his

has been stated, or other elements of the oral conversation). When the

complainants provide complete information, as in

specific cases, among which the

automated character of the call, the advertiser should
(controller) to be able to prove that he does not

made the call or what was done according to the conditions

legal processing (ie, in this case, to prove that

had obtained prior consent). This, after all, is in full swing

relevance to the principle of accountability (article 5 par. 2 of the GCP), according to
with which the controller is responsible and able

demonstrate compliance with the principles of legal processing

personal data. In the present case the controller

he did not submit any evidence to substantiate his allegations.

       b) The process itself described by the person in charge

regarding the general way of obtaining their consent

data subjects does not guarantee that the consents that

taken are valid. And this is because no control is done as

to the person entering his details in the form

consent is indeed what it claims, both at
filling in printed forms as well as when filling in electronic ones



                                                                   20, forms (see also the Guide 2/2011 of the Principle of Electronics

       consent, which specifies the conditions for obtaining

       valid electronic consent). Moreover, in the update text for
       the processing of personal data which takes place

       it is explicitly stated that the company considers that each participant is a holder

       and has sole control of the email address it declares

       (that is, in other words, it does not carry out any check of their accuracy

       declared). This is confirmed by everything

       informative texts on recent competitions which
       quote the person in charge of editing the memorandum, as described

       in the history of the present, but also in the case of which

       the complainant withdrew his complaint, as he himself states that

       another person close to him filled in the form with his details

       complainant - at which point the controller called him

       complainant, without having given his consent (the said
       fact does not change from the fact that the complainant

       withdrew his complaint). Therefore, even if it is accepted that the

       the controller obtains consents in accordance with

       process that he describes (for which, however, he did not provide any

       evidence), these consents may not be valid
       according to what is described above.

 9. The controller did not properly inform their subjects

   data on his identity, since - as is apparent from the complaints -

   none of the complainants was able to name the company that

   called because there was no such information.

10. In addition to the lack of fulfillment of the conditions of legal processing as
   to carry out promotions, the controller

   does not have, as the case may be, details of the case file, and

   grievance redressal procedures, since it did not proceed - as mentioned above - to

   substantive examination of complaints. Specifically, he did not perform

   no control for the second complaint, while for the first he did contact

   with the complainant, but did not provide the Authority with any evidence as to

                                                                           21, that he had indeed received - even with the incorrect procedure that follows

   - his consent.

11. The controller reports that the number of complaints is small.
   However, it should be borne in mind that in common experience no

   all those who receive such calls shall lodge a complaint with the Authority

   violation of the provisions of article 11 of law 3471/2006. In any case, the

   number of complaints may not in itself constitute for that

   case, a criterion for assessing the extent of the infringement after, as

   mentioned above, the controller in no case receives
   valid consents in the context of its activities.

12. The controller clearly intended a financial benefit from

   such processing.

13. The Authority, taking into account the above violations

   Articles 13 and 14 of the GCP and Article 11 of Law 3471/2006, and

   taking into account on the one hand that: the controller i) intends to
   financial benefit from such processing as there is a charge for them

   users if they make the appropriate key selection to proceed

   further, ii) does not have a grievance / satisfaction procedure

   data subjects and, on the other hand, the fact that two have been submitted

   complaints to the Authority by the date of the hearing of the person in charge
   deems that the conditions for enforcement against him are met by

   based on article 58 par. 2 i of the GCP of administrative sanction, as well as article

   21 par. 1 item b΄ of law 2472/1997 (which remains in force according to

   article 84toun.4624 / 2019) the administrative sanction of a fine referred to in

   operative part of the present, which in any case is judged - by virtue of

   Article 83 of the GPA - effective, proportionate and dissuasive.


                            FOR THOSE REASONS




 The beginning,




                                                                             22, Imposes on PLUS REAL ADVERTISMENT - ADVERTISING - PROMOTIONAL -

RESEARCH AND POLLINGS SOLE SHAREHOLDER IKE, as responsible for processing,

the effective, proportionate and dissuasive administrative fine imposed
appropriate in this case according to the more specific circumstances

of this, amounting to twenty-five thousand euros (25,000.00) euros, for the above

Violations of Articles 13 and 14 of Regulation (EU) 2016/679

and article 11toun.3471 / 2006, according to article 58par.2 of the GCP in

in combination with article 83 par. 5 of the GCC, and with article 21 par. 1 lit. b 'of

Law 2472/1997, in combination with article 13 par. 4 of law 3471/2006 and article
84 of law 4624/2019.









             The President The Secretary


      Konstantinos Menoudakos Irini Papageorgopoulou





























                                                                          23