HDPA (Greece) - 24/2020

HDPA - 24/2020
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 4(2) GDPR Article 6 GDPR Article 12 GDPR Article 15 GDPR Article 21 GDPR Article 51 GDPR Article 55 GDPR Article 58(2)(i) GDPR Article 83(5) GDPR Directive 2002/58 Article 9 Law 4624/2019 Article 11 Law 3471/2006 HDPA Directive 1/2010 Article 13 Law 3471/2006 Article 21(1)(β) Law 2472/1997
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	03.08.2020
Published:
Fine:	3000 EUR
Parties:	n/a
National Case Number/Name:	24/2020
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Greek
Original Source:	HDPA (GR) (in EL)
Initial Contributor:	Zarogianni Fotini

The HPDA of Greece imposed a fine of EUR 3,000 on a candidate of the June 2019 Greek parliamentary elections due to the violation - via the candidate's pre-election manually operated phone calls-made campaign - of the data subject's right to access their data (Article 15 GDPR) and the violation of Article 11(2) Law 3471/2006 that concerns the protection of personal data in the sector of electronic communications and, more especially, the "opt-out" system regarding manually operated phone calls for promotional purposes.

English Summary

Facts

The data subject received two phone calls on their mobile phone, with the caller not defining their identity, not informing them about any possibility of exercising their right to access (Article 15 GDPR), not mentioning any of the elements of Article 14 GDPR regarding the processing of data, but only mentioning the purpose of the call, meaning the promotion of the said parliamentary elections candidacy. The data subject clarified through their complaint that, already from 15/09/2017, they had made use of the "opt-out" system of Article 11(2) Law 3471/2006, thus rendering any manually operated phone calls for promotional purposes to their phone prohibited. Furthermore, the data subject mentioned in their complaint that they did not receive any answer from the respondent regarding the letter of complaint and exercise of their rights that the data subject submitted to the respondent. On the other hand, the respondent claimed that the name or phone number or potential capacity or potential (political) party identity of the complainant did not exist on their database and that any such call was made by mistake. The respondent informed the HDPA that their election-related promotional phone calls were operated by a group of volunteers who, on a first basis, called their friends, but, in some cases, these people could indicate the phone numbers of other friends. The respondent also informed the HDPA that they did not secure the "opt-out" records of Article 11(2) Law 3471/2006 from any telecommunications provider before proceeding with the calls.

Dispute

The HDPA considered the following legal issues: Did the respondent had the obligation to fulfil the data subject's right to access their data under Article 15 GDPR? What is the meaning of the inclusion of a data subject's phone number in the "opt-out" record of Article 11(2) Law 3471/2006 and is there an even larger meaning regarding the sector of political communication through manually operated phone calls?

Holding

The HDPA held that regarding manually operated phone calls for promotional purposes there is an "opt-out" system that renders these calls completely allowed, unless the recipient of the call had clarified that they do not wish to receive such calls. According to this system, natural or legal persons can express their objections either specifically to the data processor (meaning the one promoting themselves through such calls) based on the right to object of Article 21 GDPR (and thus create the data processor's responsibility to make sure that the phone number of the data subject that objected will be excluded from all phone calls operated by this specific data processor in the future) or generally through their inclusion in the "opt-out" records of Article 11(2) Law 3471/2006 of their telecommunications provider. All advertisers need to be equipped with up-to-date copies of all "opt-out" records of all telecommunications providers, while they also need to be equipped with all the statements of their subscribers that have been made within thirty days prior to the phone call in question. The HDPA also highlighted that political communication for promotional purposes renders someone a data processor and, thus, all the above regarding the "opt-out" system are equally applied. Therefore, apart from being equipped with the records and the statements, the caller must inform the recipient of the call of the identity of the person responsible for the call and of the person executing the call, must not disclose or distort the phone number of the caller, and must at least inform the recipient of the call of their ability to exercise their right to access. Taking all the above into consideration, the HDPA held that the respondent, as the data processor, proceeded with political communication through manually operated phone calls. For the purposes of this communication, though, the respondent did not secure any "opt-out" records of Article 11(2) Law 3471/2006 from any telecommunications provider, so as to be able to exclude these numbers from the aforementioned phone calls due to the lack of their necessary special consent for accepting such calls. The HDPA also held that the respondent did not provide the recipient of the call with information regarding their ability to exercise their rights, that it did not fulfil the complainant's request to access their data and that it did not provide any justification for doing so (Article 15 GDPR). Thus, the HDPA held that all the necessary prerequisites for imposing a fine were fulfilled and, in doing so, it imposed on the respondent an effective, proportionate and dissuasive fine of EUR 3,000.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.