HDPA (Greece) - 57/2021

HDPA (Greece) - 57/2021
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 13 GDPR Article 14 GDPR N.3471/2006 Article 11
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	12.07.2021
Published:	31.12.2021
Fine:	25,000 EUR
Parties:	PLUS REAL ADVERTISMENT
National Case Number/Name:	57/2021
European Case Law Identifier:	n/a
Appeal:	Not appealed
Original Language(s):	Greek
Original Source:	HDPO (in EL)
Initial Contributor:	eleni.papadopoulou

The Hellenic DPA fined a controller €25,000 for failing to provide information concerning their personal data to data subjects under Article 13 GDPR and Article 14 GDPR when making automated marketing phone calls.

English Summary

Facts

Two individuals submitted complaints before the Hellenic DPA (HDPA) against advertising company PLUS REAL ADVERTISMENT (henceforth: PLUS REAL) for unlawful processing of personal data for purely marketing purposes. PLUS REAL used an automated mechanism making telephone calls in order to contact individuals for advertising and marketing purposes.

As regards the first complaint, the individual received a phone call from an unknown number with a recorded message informing them they won a prize of €680,00. After some seconds a human person was on the line telling the individual they had to make an extra call and give a special code in order to win their prize, without giving him more details regarding accurate call charges. The individual made that second call and heard from recorded message that the call charges were higher than the ones mentioned on the first call, and that the line was busy, so they had to call again. After their third attempt, the individual spoke to an operator and realised that the prize was actually vouchers offered only in case the individual made high cost purchases.

As for the second complaint, the individual mentioned that they received a telephone call from an unknown number with a recorded message telling them they won money as prize for a competition, but the individual did not manage to hear the name of the company referred.

The Hellenic DPA asked integrated communication solutions companies MICROBASE and LEXITEL to whom the unknown numbers belong to, and was informed that the owner was PLUS REAL.

Holding

After reviewing the facts of the case, the HDPA first stated that PLUS REAL is a controller under Article 4(7) GDPR because it processed personal data of individuals for conducting automated phone calls to them with recorded messages.

Moreover, the HDPA held that PLUS REAL was in breach of Article 11 of the Greek Law on Unsolicited Communications (Law 3471/2006) and GDPR because it made these calls for advertising and marketing purposes without previously obtaining consent from the data subjects .

In addition, the HDPA held that PLUS REAL failed to comply with the principle of accountability under Article 5(2) GDPR according to which the controller bears the responsibility to demonstrate compliance with the principles of lawful processing of personal data.

Furthermore, PLUS REAL did not reveal to data subjects its identity as controller, and did not have a mechanism to respond to data subjects requests for information concerning their personal data.

Therefor, the HDPA fined the controller, PLUS REAL, €25,000 under Article 58(2) GDPR and Article 83(5) GDPR for the breach of Article 13 GDPR and Article 14 GDPR for failing to provide adequate information to the data subjects when making the marketing phone calls, as well as violating Article 11 of the Greek Law on Unsolicited Communications (Law 3471/2006) for not obtaining consent for the processing of personal data to make these calls.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

  
    

  
  
    
  
    Category
              Decision
          

  
    Date
              08/12/2021

          

  
    Transaction number
              52
          

  
    Thematic unit
          
              09. Promotion of products and services
              
      

  
    Applicable provisions
          
              Article 28: Perform the processing (arrangements)
          Article 32: Processing security
          Article 11.1: Unsolicited electronic communication
              
      

  
    Summary
              The Authority received 17 complaints regarding illegal telephone calls aimed at promoting products or services of the company ZENITH - Gas Supply Company of Thessaloniki, Thessaly SA. For this specific processing ZENITH has the position of controller, and One Way Private Company has the position of executor. The examination of the case revealed that due to an error in the implementation of the processor, telephone calls were made to subscribers who had been registered in register 11, in violation of article 11 of Law 3471/2006. The Authority imposed on the processing One Way Private Company a fine of 30,000 euros for violation of article 32 par. 2 and 4 of the GCP in combination with article 28 par. 3, c. He also imposed on the person in charge of processing ZENITH, the sanction of the reprimand for violation of article 28 par. 3 case c of GKPD.

          

  
    PDF Decision
              52_2021anonym.pdf272.69 KB
          

  


    
  
    Category
              Decision
          

  
    Date
              08/12/2021

          

  
    Transaction number
              52
          

  
    Thematic unit
          
              09. Promotion of products and services
              
      

  
    Applicable provisions
          
              Article 28: Perform the processing (arrangements)
          Article 32: Processing security
          Article 11.1: Unsolicited electronic communication
              
      

  
    Summary
              The Authority received 17 complaints regarding illegal telephone calls aimed at promoting products or services of the company ZENITH - Gas Supply Company of Thessaloniki, Thessaly SA. For this specific processing ZENITH has the position of controller, and One Way Private Company has the position of executor. The examination of the case revealed that due to an error in the implementation of the processor, telephone calls were made to subscribers who had been registered in register 11, in violation of article 11 of Law 3471/2006. The Authority imposed on the processing One Way Private Company a fine of 30,000 euros for violation of article 32 par. 2 and 4 of the GCP in combination with article 28 par. 3, c. He also imposed on the person in charge of processing ZENITH, the sanction of the reprimand for violation of article 28 par. 3 case c of GKPD.

          

  
    PDF Decision
              52_2021anonym.pdf272.69 KB