HDPA (Greece) - 56/2021
From GDPRhub
| HDPA (Greece) - 56/2021 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 13 GDPR Article 14 GDPR Article 11(1) Law 3471/2006 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 31.12.2021 |
| Published: | |
| Fine: | 30.000 EUR |
| Parties: | anonymous INFO COMMUNICATION SERVICES |
| National Case Number/Name: | 56/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Anastasia.Tsermenidou |
The Hellenic DPA fined a company €30,000 for making unsolicited automated marketing calls, and for not providing relevant information under Articles 13 and 14 GDPR during the calls.
English Summary
Facts
The Hellenic DPA (HDPA) received a great number of complaints from data subjects concerning unsolicited automated telephone calls (without human intervention) and sms messages to promote products and services. The data subjects claimed that these communications provided no information regarding who was contacting them for these purposes In their complaints, the data subjects stated that they did not consent to being contacted by the controller.
The controller was eventually identified as INFO COMMUNICATION SERVICES, a marketing company. It argued that the data subjects consented to the calls. However, as per general company policy, the records of the consent were destroyed after the respective promotional cycle ended. Moreover, the company claimed the calls were not automated calls and, therefore, no consent was needed under Greek national law.
Holding
The HDPA held that the calls were automated, taking the principle of accountability under Article 5(2) GDPR into consideration. According to this provision, the burden of proof is on the controller, and in this case, it did not prove otherwise. On the other hand, the complainants fully identified the automated nature of the calls.
The HDPA also found that the behaviour of the controller violated Article 11 Law 3471/2006. Article 11(1) Law No. 3471/2006 stipulates that the use of automatic calling systems (and more generally, the making of unsolicited communications by any means of electronic communication without human intervention) for any kind of advertising purposes, is only allowed if the data subject expressly consents in advance. Article 11(2) Law No. 3471/2006 in contrast provides for an opt-out system for such communications. Article 11(3) Law No. 3471/2006 makes an exception for e-mail and sms messaging, provided that the contact details were lawfully obtained in the context of a sale of products or services (or similar transactions) as long as the recipient is given the opportunity to object in each message.
Regarding the sms messaging, the HDPA found the requirements of Article 11(3) Law No. 3471/2006 were not fulfilled, as a result, consent was needed. Furthermore, the HDPA held that the controller failed to prove that the data subjects gave their consent to being called and messaged. According to the HDPA, the deletion of subscribers' details after the end of the respective promotion cycle could not excuse this failure, and the company should have kept the data subjects' proof of consent for a reasonable period of time to ensure the proper conduction of the investigation, especially since the controller was aware of the existence of the complaints before the deletion took place.
Additoinally, the HDPA stated that when carrying out promotional phone calls, the controller should inform the data subject of its identity and its representative, the purpose of the processing, and it should not conceal or falsify its number, according to its obligations under Articles 13 and 14 GDPR.
The HDPA decided to issue a fine of €30,000. When it determined the amount of the fine, the HDPA took into consideration the fact that taking the controller had a financial aim with the processing in question (since there is a charge for users if they select the appropriate key on their phone and proceed further), that it did not have a complaints procedure, that it had not responded to the HDPA in a timely manner, and it was not aware of the relevant legal framework.
Comment
The corresponding decision of the same date can be found here: HDPA (Greece) - 57/2021.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 31-12-2021
No. Prot..: 3035
DECISION 56/2021
The Personal Data Protection Authority met, at the invitation of its Chairman, in a
meeting by videoconference on 12-07-2021, following the meeting of 23-04-2021
and postponing the meeting of 31/3/2021, in order to examine the case referred to
in the background of this document. In attendance were Konstantinos Menoudakos,
Chairman of the Authority, regular members Spyridon Vlahopoulos, Konstantinos
Lambrinoudakis, as rapporteur, and Charalambos Anthopoulos. The meeting was
attended, without the right to vote, by the Chairperson's mandate, by the Auditors
Konstantinos Limniotis and Ioannis Lykotrafitis, IT specialists, as assistant
rapporteurs, and Irini Papageorgopoulou, employee of the Administrative Affairs
Department, as secretary.
The Authority has taken into account the following:
A number of complaints have been submitted to the Authority in recent years
regarding automated (without human intervention) telephone calls with the purpose
of promoting products or services (offers - gifts), without specifying, in these calls,
the identity of the person on whose behalf the calls are made, while all calling
telephone numbers started with the same prefix "..." (i.e. the differentiation of the
numbers existed, in these cases, in the last two digits of the calling numbers). In one
case, the complaint concerned the sending of a short text message (SMS).
Ave. 1-3 Kifissia Street, Athens, Greece11523
T: 2106475600- E: contact@dpa.gr - www.dpa.gr
1
Specifically, the complaints were the following:
α) Complaint No. C/EIS/6386/23-07-2018 by A, according to which her telephone
number ... received on ...2018 a telephone call from the number
..., in which she was informed that they were calling from a "supermarket offer/
online supermarket". She then called the above number, looking for the person in
charge, Mrs B, who was absent, as she was informed, and asking the question about
the source of her data. She received, according to the complainant, a vague reply
that her number had arrived on their lists either because she had filled in a form
herself or because she had given it to one of their employees. She also states that
when she called the company back, she "pressed" option 2 to remove her number
from their lists, however, she notes that they continue to harass her. The
complainant names the name of the company (INCOSER) on her complaint form.
b) Complaint of C under file No. C/EIS/1342/19-01-2019, as completed by document
No. C/EIS/2184/21-03-2019, according to which his telephone number ... received on
...2019 at ...2019 and time ... an automated telephone call from the number ..., to
which he answered and heard an audio message that he had won 850 Euros and that
he should proceed with the procedure by typing "1" on his telephone.
c) Complaint No. C/EIS/1552/27-02-2019 by D, according to which her telephone
number ... received on ...2019 at ...2019 and time ... an automated telephone call
from the number ..., advertising purchases from a supermarket as a gift.
d) Complaint No. C/EIS/2332/27-03-2019 by E, according to which his telephone
number ... received on ...2019 at ... ... ... ... an automated telephone call from the
number ..., without specifying the content of the promotional action. The
complainant states that his telephone number was registered in the register under
Article 11 of Law No. 3471/2006 (opt-out register) of his provider.
2
ε) Complaint No. C/EIS/3218/06-05-2019 by Z, according to which her telephone
number ... received on ...2019 at the hours of ..., ... and ... automated telephone calls
from the number ..., advertising, as she states, money.
f) Complaint No. G/EIS/3367/10-05-2019 by H, according to which his telephone
number ... received on ...2019 at ... time ... an automated telephone call from the
number ..., which advertised, as he states, a monetary benefit of Euro.850
g) Complaint No. C/EIS/3906/31-05-2019 by I, according to which on his telephone
number ... he received on ...2019 at ...2019 and time ... a short text message (SMS)
from the number ..., which stated "Thank you for participating! You are the big
winner! To receive your gifts for free, call INCOSER9019015906. Charge 3.5€/1'+VAT.
G.PAR. 2120001516".
According to the complainant, the telephone number given as a complaint line does
not seem to correspond to a real number (it does not call).
η) Complaint of I. under reference C/EIS/4417/24-06-2019, as supplemented by
document C/EIS/4653/02-07-2019, according to which his telephone number
...received on ...2019 at ...2019 and time ... a call from the number .... He did not
have time to answer and called that number, where he was informed that he had
been called by Super Market Offers because he had won an 800 euro gift voucher,
which he would have to call another number to receive. As the complainant also
states, his telephone number was registered in the opt-out register of his provider.
(i) Complaint No 31475-19/03/2020 from K, forwarded to the Authority by means of
letter No. ... (ref. no.: G/EIS/3590/26-05-2020) from the General Secretariat of
Commerce and Consumer Protection. According to this complaint, on ...2020 at ...,
the complainant received a call from ..., during which, after listening to a recorded
message, which stated that she had won 600 euros for purchases from a super
market, she was invited to press 1, which she did, whereupon she spoke to a lady,
who told her that
3
won the amount of 640 euros for purchases from a super market. Subsequently,
according to the complainant, when she asked which super market the offer was
from, the caller hung up the phone, and then by calling the above number again, she
was informed that it was from Super Market Offers. The complainant also stated that
on that day she had tried to place orders in various super markets by entering her
mobile phone number in the relevant websites.
ι) Complaint No. G/EIS/4560/01-07-2020 by L, according to which his telephone
number ... received on ...2020 at ... an automated telephone call from the number ...,
advertising, as he states, gift vouchers. As the complainant also states, his telephone
number was registered in the opt-out register of his provider.
For the first of the above complaints (complaint under point (a)), the Authority sent
INFO COMMUNICATION SERVICES (INCOSER), in the context of its investigation, the
letter No. C/EΞ/6386-1/02-08-2018, requesting the company's views on the
complaints, and in particular on the issue of failure to satisfy the right of access,
failure to adequately satisfy the right of the subscriber natural person to be informed
of the data controller, and failure to provide information on the exercise of the rights
of access and objection. The complainant company replied by letter C/EIS/9369/26-
11-2018. In it, it states, inter alia, the following:
i)
ii)
iii)
The company occasionally undertakes promotions of various products
and services by telephone with clear terms of participation which are
communicated in detail in advance to the participants.
Participants register either online or on forms by consenting to be
contacted.
Subscribers who are registered in the register referred to in Article 11.
4
iv)
When a call is made to a participant, in the initial menu of the service two
options are given: a. to contact a representative by selecting the number
and 1,b. to be removed from the company's lists by selecting the number
2.
v)
For the above complaint, the following information is provided in
particular: a) For the sake of brevity, the company is referred to as
INCOSER, instead of the full name INFO COMMUNICATION SERVICES, and
it
owns
the
online
supermarket
of
offers
https://www.websupermarketdeal.gr/, b) the complainant was given all
the information about the identity of the company and its activity, i.e.
that it is a promotional company for products and services, c) only one
call was made to the complainant, so there is no evidence of systematic
harassment, as she states, d) the remaining calls/contacts with the
company were made on her own initiative, (e) she was made aware of the
nature and purpose of the communication and collection of her data
(right to be informed), as well as her right to object (which, according to
the company, was exercised by the complainant since, according to the
complainant herself, she chose the number not 2to be called again). She
did not choose to call back in order to request more information; f) There
is a possibility, which has unfortunately happened sometimes, that the
telephone number provided by the participant may have been incorrectly
indicated or even deliberately by a third party that someone else's
telephone number was indicated; g) The complainant has appealed to the
Authority without having previously exercised her rights vis-à-vis the
controller.
For the remaining complaints, for which the complainants did not mention the name
of the complainant company because it had not been disclosed to them during the
calls they received, the Authority, in the cases of the complaints under (b) and (c)
above, sent a letter to Microbase Advanced Services of Communications and
Informatics IKE (hereinafter referred to as Microbase), whose network included the
telephone exchanges
5
numbers mentioned as callers in these complaints, the documents No. C/EX/1342-
1/19-03-2019, C/EX/1552-1/05-04-2019 respectively, requesting to provide the
necessary subscriber information for the respective numbers (name or surname,
address and/or other contact details). In both cases, Microbase replied that the
owner of the numbers in question is INFO COMMUNICATION SERVICES ADVERTISING
- PROMOTIONAL - COMMERCIAL - RESEARCH AND PUBLICATIONS MONOPROSOOPI
IKE (hereinafter, INCOSER
or controller). Therefore, due to the common characteristics of all complaints and
the respective complainant telephone numbers, the Authority did not re-contact
Microbase for the following (d) - j) complaints - for which, as it follows from the
following, the complainant is indeed INCOSER.
Subsequently, the Authority, in the context of the examination of the above
complaints, sent to INCOSER the documents C/EX/1342-2/10-04-2019 (for the
complaints under (b) and (c)), C/EX/2332-1/14-05-2019 (for the complaint under (b)
and (c)) and C/EX/2332-1/14-05-2019 (for the complaint under (d)). d'), C/EX/3218-
1/06-06-2019 (for complaints under (e) and (f)), C/EX/3906-1/11-07-2019 (for
complaints under (g) and (h)) and C/EX/4560-1/27-07-2020 (for complaints under (g)
and (h))). i' and j' complaints), requesting its views on the complainants, while also
requesting information on the general procedures followed by the company for
carrying out telephone promotions, namely how the selection of the called numbers
is made, whether all calls made are automated without human intervention, as well
as the procedures followed to examine whether the subscribers/holders of the called
numbers have indicated that they do not wish to receive calls from the company, and
the procedures followed to examine whether the subscribers/holders of the called
numbers have indicated that they do not wish to receive calls from the company. It
should be noted that because the company did not reply to the above Authority
documents, each new Authority document was accompanied by a reminder of the
relevant previous ones. INCOSER finally responded in total, for all the above
mentioned complaints, by letter no. C/EIS/6506/25-09-2020. In the said document it
states the following:
Α. The company with the name "INFO COMMUNICATION SERVICES ADVERTISING -
6
PROMOTIONAL-COMMERCIAL - RESEARCH AND POLLING ONE-MAN-AGENCY IKE"
7
has as its statutory purpose, inter alia, the carrying out of promotional activities by
telephone, with clear conditions of participation, which were communicated in detail
to the participants. Within the framework of the above statutory purpose, the
company carried out promotional activities until the end of 2019 on the basis of
published written terms of participation for each promotional activity, deposited
with a notary and posted on the company's website for the purpose of informing the
public for the duration of each promotional activity. The terms of the promotions
generally stated, inter alia, the following: "Participation in the Promotion shall be
made by submitting valid contact information in one of the following ways:
(1) through internet postings/postings, in particular either on the website
or
on
other sites, where there is a relevant posting by the Organising Company, or (2)
through the special entry forms, bearing the name of the Organising Company and
distributed by its representatives, or
(3) via the special telephone number , with a civil charge. Specifically, to ensure the
validity of their participation, participants must, for each of the above-mentioned
methods, respectively: (1) fill in the special Participation Form for the Promotion ". ",
which is available on the site
,
indicating
obligatorily and in a complete and true manner the following data: name, surname
and telephone number, or (2) state in a complete and true manner the following
data: name, surname and telephone number on the relevant entry form, which will
be provided by a representative of the Promoter and will be completed by the Entrant
or by the Promoter's representative, at the Entrant's discretion; or (3) state the
following information obligatorily and in a complete and true manner: Their first
name, last name and telephone number to the Promoter's answering machine, which
will answer 24 hours a day to telephone calls to the dedicated telephone number
, with a civil charge." (...) "The Promoter considers that each participant is the owner
and has exclusive control of the e-mail address he/she declares". "During the
Promotional Action, all valid, according to the above mentioned, Participation
Statements will be collected in a special
8
file (Excel) of the Promoter and will receive a serial number, followed by a notification
to the Beneficiaries for the next stages of the Promotion. This file will be destroyed
after the completion of the Promotion."
"Each Beneficiary will be informed free of charge, through a call from the call center
of the Organizing Company to the mobile or fixed telephone number that he/she has
declared during his/her participation under article 4, that he/she is a Beneficiary of
the Promotion's prizes and must confirm that he/she wishes and accepts the prizes
he/she is entitled to. If he/she accepts the gifts, he/she will be informed during the
same communication of the number to which he/she will call in order to be informed
of how to receive them (...)'. "All participants acknowledge, declare and accept
expressly and unconditionally that: (a) their personal data in this promotion may not
belong to a third party natural or legal person, but to themselves; (b) they are over
the age of majority 18and have legal capacity; (c) their personality is not infringed or
diminished in any way by their participation in this promotion of the Promoter, in
which they will participate with their personal data; (d) they do not infringe the
personal data or the right of personality of any third party, (e) do not infringe the
intellectual property rights of any third party; (f) expressly consent to the Promoter's
use and processing of their personal data (name, telephone number, e-mail address)
for the sole purpose of serving the Promotion; (g) give their consent and
authorization to the Promoter for the promotion of the Promotion and its results
through the printed and electronic press and the internet throughout its duration.
The Promoter reserves the right to use and publish any news item relating to the
conduct of the Promotion."
"Personal Data. By participating in the Promotion, each participant expressly declares
and accepts that his/her personal data will be collected and used by the Promoter for
processing.
9
by automated or non-automated means, either by itself or through any other person
appointed by it to carry out the aforementioned processing on its behalf and on its
behalf hereunder. The personal data of the winners in the Promotion, in this capacity,
will be retained by the Promoter and will be used solely for the purposes of the
Promotion. In any case, the personal data of the participants will be kept in
accordance with the current Greek legislation, Law 4624/2019 on the Personal Data
Protection Authority and the General Regulation for the Protection of Personal Data -
Regulation (EU) 2016/679 of the European Parliament (GDPR). Participants will have
the right at any time and without charge to confirm, modify or correct, limit or delete
all their personal data held on file in accordance with the terms of the applicable
Greek legislation, the Law. 4624/2019 on the Personal Data Protection Authority and
the General Regulation for the Protection of Personal Data - Regulation (EU)
2016/679 of the European Parliament (GDPR) as in force by contacting the
Organizer's data controller, at WebSuperMarketDeal@gmail.com or at the contact
telephone number with civil charge. The exercise of the rights of restriction,
opposition and/or the right of erasure, if they concern data necessary for the
implementation and/or continuation of this Promotion, entails either the inability to
participate, if exercised before the implementation of the Promotion, or the
automatic cancellation of participation in it if exercised at any stage of the
Promotion.
The Promoter expressly declares and undertakes that it follows the principle of
minimum processing of personal data and the above data collected are processed
exclusively and only for certain purposes as set out above. Furthermore, it declares
that it has taken all necessary measures, technical, organizational, legal, in order to
ensure the protection of such data (...)"
10
As stated by INCOSER in its above-mentioned document, the following briefly follows
from the above basic terms, according to INCOSER:
1.
Participation in the promotion was at the initiative of the participant, in one
of the ways expressly provided for. Therefore, the participant voluntarily provided
his or her own details by filling in a form in which, among other things, he or she
indicated the desired contact telephone number.
2.
In order for a participation to be considered valid, all the minimum required
information, namely name, surname and telephone number, should be provided, so
that the holder can be identified if necessary.
3.
Valid entries were collected in an electronic file in order for communication
to take place, informing participants of the next steps of the promotion.
4.
The above records were kept only for the duration of the promotion. They
were then destroyed. The same applied to the registration forms.
5.
The communication was made to the number that the participant himself had
indicated, giving his consent to this communication for the purpose of the
promotion.
6.
A special telephone number was assigned to each promotion to allow for
complaints.
7.
Each participant declared that they consented to the processing of their
personal data, including their telephone number, for the purpose of serving the
promotion.
8.
A special telephone number was designated for the purpose of facilitating the
exercise of the right to object. Participants could at any time and free of charge
confirm, modify or correct, limit or delete all their personal data by contacting the
Organizer's data controller at a designated e-mail or telephone number.
11
9.
Each participant was aware of the terms and conditions before submitting
his/her participation, when he/she declared that he/she was aware that if he/she
participated, he/she did so voluntarily and that he/she also accepted unconditionally
the terms and conditions under which it was carried out, i.e. telephone
communication.
Β. With regard to the above complaints, INCOSER states, in all cases (except for the
complaint under point f), that they are not substantiated and should not be admitted
because the complainants do not provide evidence of the calls, and in no case was
the right to object exercised. For some specific cases in some complaints, the
company provides some additional clarifications as follows:
i) For the complaint under (b), it states that the date of the call shown on the
screenshot attached to the complaint (i.e. 2019) is different from the date shown in
the complaint (and states that "it is therefore not clear exactly which complaint we
are called upon to answer").
ii) For the complaint under point (e), the company considers that the truth of the
statements made is not verified because the signature of the complainant is missing,
and it is also technically and practically impossible, taking into account the way in
which the calls are made, i.e. successively through an automated system, to make
three calls within a period of minutes.90
iii) For the complaint under point (f), which is the only one for which the company
does not indicate that there is no evidence missing from the complainant, it states
that it assumes that a technical error was made.
iv) With regard to complaint (g), the company states, in addition to the general
questioning of the content of the complaint by analogy with its allegations for the
other complaints - apart from (f) - that the complainant's reference to the fact that
the company's complaints line was not in operation ('does not call') is an arbitrary
conclusion because some
12
his call was not forwarded for technical reasons. Further, the company states that an
internet search on its11888 service - OTE Information (https://www.11888.) shows
that the number in question belongs to M and not to I, who is listed as the
complainant, and therefore the complainant has no legal interest in making the
complaint, as he is not the owner of the telephone line.
v) For the complaint under point (h), the company states, in addition to the general
questioning of the content of the complaint by analogy with its allegations and for
the other complaints - apart from the one under point (f) - that the complainant's
answer NO to the question under point8 (b) of the complaint form regarding the
question of whether it is a recorded call is not true, as the communication is
automated and recorded.
vi) For the complaint under (i), the company states that since the complainant
herself states that she listed her phone number on multiple online supermarket
pages, including her own, she confesses that she declared her participation in the
promotion and therefore requested the communication and therefore everything
she complains about is contrary to her actions.
The company further submits, as an additional allegation, that the relevant Authority
complaint form completed by the complainants states that
"in order for the complaint to be substantiated, you must either be registered in the
register under Art. 11 with your provider (in which case 30 days must have passed)
or you must have exercised the right to object specifically to the controller
(advertiser)." On this basis, the company comments in this context on the cases of
complaints where complainants indicate that their telephone numbers were
registered in the opt-out register of their provider, noting that either the date of
registration of this in the register is not indicated in the complaint (under para. e'
complaint), or that thirty days had not elapsed since the date of registration of the
number in the register (complaint under point d'), or finally that the time elapsed
between registration (.../2020) and the making of the call (/2020) was short and
13
there is a possibility that the relevant file (under point (j) of the complaint) may not
have been updated.
Γ. Finally, INCOSER states that the calls were made on its behalf in the context of its
business activity, while the telephone numbers were derived from the entries made
by the holders of the
telephone numbers
themselves
,declaring their participation
in the respective promotional activities, on the basis of the relevant terms mentioned
above. Consequently, according to INCOSER, the holder of the number also granted
the right under Art111. 3471/2006 express written consent to communicate with
him. The call made to the number registered at the time of submission was initially
automated so that the participant was informed that he could participate in the
promotion for which he had registered by pressing the button to1 obtain further
information, free of charge. The caller could then either press the button and1 be
connected to a company representative, who in real time would provide the
necessary and/or additional information requested, or leave the call. If, therefore, he
proceeded by pressing the button, 1,which of course indicates again that he
expressly wishes and consents to the communication, he would be connected and
the representative would remind him of the necessary information, such as the
name of the company, the purpose of the call, the possibility of expressing
objections/complaints,how to exercise the
right of access and theright to object, how to receive the gift, which the caller
already knows, having accepted the terms of the promotion. According to the
company, no charge is imposed on the participant in the promotion at this stage. All
participants were given the opportunity to withdraw their participation and object at
any time in a clear and definite manner, both in the terms of the promotion and at
the beginning of the conversation with the company's representative. As long as the
caller indicated to the representative that they did not wish to receive
communications, despite their initial explicit consent to them, they were
automatically removed from the relevant list. The registration forms, the files
containing the details of the participants and the
14
callers - outgoing calls record was kept for the duration of the promotion, i.e. until
the receipt of the gifts, and then deleted, as the purpose of keeping the record had
been fulfilled. No use beyond that covered by the purpose of the promotion was
made. Given that the calls were made mechanically, following the entry of the
participants' number in an electronic database, it is likely that among the numerous
calls registered there was an error in the number, due either to a wrong entry of the
number in the database, i.e. human error, or to a technical problem in the system
carrying out the automated calls. As a measure of extra due diligence, staff were
trained at regular intervals to ensure that they were aware of current legislation and
company procedures. The process was supervised by an experienced supervisor on a
daily basis. Finally, as the company states, numerous calls were made in the context
of each promotion, so that only nine (9) complaints, which the company claims are
not substantiated, demonstrate the company's adherence to due process.
D. In its above reply INCOSER also attaches the company's VAT returns for the
months of January to2020 June. 2020.
The Authority subsequently invited INFO COMMUNICATION SERVICES to a hearing -
ADVERTISING - PROMOTIONAL - COMMERCIAL - RESEARCH AND SURVEYS
SINGLE-PARTY JV to the meeting, via videoconference, of the Plenary Session of 31-
03-2021 (see the invitation with the reference number C/EXE/850/16-03-2021). At
the meeting of 31-03-2021, Mr. Nikos Petropoulos, lawyer (AMDSA ...) attended the
meeting as representative of the controller, who submitted a request for
postponement of the discussion, which was granted, setting a new date for the
discussion of the case on 23-4-2021. Ms Ioanna Kamarinopoulou, lawyer (DPA ...),
representing the controller, attended the hearing on 23-4-2021. After the meeting,
the controller was given a deadline for submitting a statement, which it submitted,
within the time limit, by
15
document No C/EIS/3392/24-05-2021. This memorandum states the following:
α) The controller occasionally engaged in promotions of various products and
services by telephone, with clear conditions of participation communicated in
advance to participants. It has discontinued that activity since the end of 2019, while
providing, in its memorandum, indicative VAT returns of the company for the
months of November and December The 2019.company, as mentioned during the
hearing of the controller before the Authority, has since then been inactive and
remains active with a view to activating one of those activities in the future.
It should be noted that during the hearing of the controller the question was raised
regarding the complaint under point (j), which concerns a call made during the
period in which the company is allegedly inactive, and the representative of the
controller replied that this was an error, without further clarification either at the
hearing or in his subsequent written submission.
(b) The controller, at the start of its activities, had notified its processing operations
to the Authority. It reiterates in its memorandum that the promotional activities
were carried out only to persons who had registered for participation, having
recorded their details on a special form or voucher, thus consenting to be contacted.
He also states that this allegation is confirmed - according to the data controller - by
the complaint referred to in point (i), since the complainant states that she
registered via the internet. At the end of each promotion, the data of the
participants are deleted. Further, the controller states that in the calls to each
participant, two options are given, either to contact a representative by selecting the
key number '1' or to request the deletion of their details from the lists by selecting
the key number '2'.
(c) With regard to the individual complaints, nothing additional is mentioned in the
memorandum, in relation to what the controller had originally stated in its original
document.
16
d) During the hearing of the controller, the question of any relationship with PLUS
REAL Advertisement was raised, given that according to a search in the General
Commercial Register (GEMI), the two companies show the same natural person as
Management, have similar activities, while the representative of the controller
during his hearing before the Authority also represented, in the same meeting and
for another case, PLUS REAL Advertisement. Both at the hearing, and in the
subsequent memorandum of the Controller, it was indicated that the two companies
in question have different registered offices, different premises, numbers and
infrastructure, and with regard to the specific activity that each of them carries out
independently, VAT returns of both companies for September 2019 were submitted
with the memorandum, showing that they operated in parallel and not in succession.
The Authority, having considered all the elements of the file and the arguments
presented at the meeting of 23-04-2021, having heard the Rapporteur and the
clarifications of the Assistant Rapporteurs, who (assistants) withdrew after the
discussion and before the deliberation and decision, and after a thorough discussion,
THOUGHT IN ACCORDANCE WITH
THE LAW
1.2.It follows from the provisions of Articles 51 and 55 of the General Data Protection
Regulation (Regulation (EU) 2016/679 - hereinafter referred to as the GDPR) and
the article of 9Law 4624/2019 (Government Gazette A' 137) that the Authority is
competent to supervise the application of the provisions of the GDPR, this law and
other regulations concerning the protection of the individual from the processing of
personal data.
In accordance with Article 4(4). 7 of the GDPR, which has been in force since 25
May 2018, a controller is defined as "the natural or legal person, public authority,
agency or other body which, alone or jointly with others, determines the purposes
and means of the processing of personal data".
17
3. The controller, in the context of its compliance with the principle of fair and lawful
processing of personal data (Article 5(1) of the GDPR), must, in accordance with
Article 12(1) of the GDPR. 1 of the GDPR, must take appropriate measures to
provide the data subject with all the information referred to in Articles 13 and 14 of
the GDPR in order to inform the data subject that his or her data are to be
processed in a lawful and transparent manner, and in addition must be able to
demonstrate at any time that he or she complies with these principles (principle of
accountability under Article 5(51) of2 the GDPR). The information obligation
incumbent on the controller is detailed in Articles 13 (regarding the information to
be provided if the personal data are collected from the data subject) and
(14regarding the information to be provided if the personal data have not been
collected from the data subject) of the GDPR.
4. The issue of telephone calls, for the purpose of direct promotion of products or
services and for all kinds of advertising purposes, is regulated in article 11 of Law
no. 3471/2006, which sets out the relevant provisions on unsolicited
communications (see paragraphs 1 and 12). It should be noted that, for this issue,
the prior consent rule was originally chosen (see previous version of Article 11 of
Law 3471/2006). However, with the provisions of Article 16 par. 1 and 2 of Law No.
3917/2011 amended paras. 1 and 2 of Article 11 of Law No. 3471/2006, so that
Article 11 par. 1 of Law No. 3471/2006 now stipulates that: "The use of automatic
calling systems, in particular using fax or e-mail devices, and more generally the
making of unsolicited communications by any means of electronic communication,
without human intervention, for the purpose of direct marketing of products or
services and for any kind of advertising purposes, is only allowed if the subscriber
expressly consents in advance", while the paragraph of the 2same article stipulates
that: "Unrequested communications with human intervention (calls) for the above
purposes shall not be allowed, if the subscriber has declared to the provider of the
service available at
18
public service, that it does not generally wish to receive such calls. The operator
shall be obliged to enter such declarations free of charge in a special subscriber list
which shall be available to any interested party. Consequently, after 01-09-2011,
when the amended provision - which is more favourable to data controllers - came
into force, telephone calls with human intervention, in view of the above purposes,
are allowed, unless the called party has indicated that he does not wish to receive
them (opt-out system). Advertisers, if they carry out telephone promotions with
human intervention, must receive from all providers updated copies of the
Registers of Article 11 of Law no. 3471/2006 and ensure that they have available
the subscribers' declarations made up to thirty days before the telephone call is
made (see also the Authority's Decisions No. 62-67/2016). Moreover, pursuant to
Article 13 of the above mentioned Law. 3471/2006, the control of the compliance
with the provisions of this law is the responsibility of the Authority.
5. In any case, calls without human intervention (automated calls) require, as
expressly required by Article 11 par. 1 of the law. 3471/2006, the prior consent of
the subscribers is required - even if these numbers are not registered in the opt-out
register of their provider. It should be noted that the provision on automated
calling, pursuant to Directive 2002/58/EC, has been in force since the entry into
force of Law No. 3471/2006 and the previous law. 2774/1999, i.e. it was not
affected by the subsequent amendment of Law no. 3471/2006. Besides, automated
calls are a quite invasive means of promoting products and services, since by their
nature, the recipient of the communication does not easily have the possibility to
be informed and exercise his/her rights, as in the case of communication by human
intervention.
6. Exceptionally, in accordance with Article 11 par. 3 of Law No. 3471/2006, e-mail
contact details lawfully obtained in the context of the sale of products or services
or other transaction may be used for the direct marketing of similar products or
services.
19
services of the supplier or for similar purposes, even when the recipient of the
message has not given his/her prior consent, provided that he/she is given the
opportunity to object, in a clear and distinct manner, in an easy and free of charge
way, to the collection and use of his/her electronic data, and this during the
collection of contact details, as well as in each message, in case the user did not
initially object to this use. Furthermore, it is noted that short text messages (SMS)
are also e-mail messages according to the definitions of Law no. 3471/2006 and
Directive 2002/58/EC.
7. Furthermore, the controller must also satisfy the other rights of data subjects, in
particular the rights to information (Article 13 of the GDPR regarding information
provided if personal data are collected from the data subject and Article
14 of the GDPR with regard to information provided if the personal data have not
been collected by the data subject), access (Article of the 15GDPR) and opposition
(Article of the 21GDPR). This means, with regard to the obligation to inform, that
when making a telephone call, the controller should inform about his identity and
the identity of his representative, not to conceal or falsify the caller's number and
to inform about the purpose of the processing and the possibility to exercise the
above rights. Furthermore, as regards the right to object provided for in Article 21
of the GDPR, the controller must, in order to comply with the obligation under that
provision, ensure that, where a called subscriber objects to receiving calls from that
controller (and/or its representative), a clearly defined procedure is followed to
ensure that the number is excluded from any telephone marketing/advertising by
the controller on the medium of the caller.
8. In the specific cases, on the basis of the above, it appears that the complainant
company, as controller, has carried out,
20
automated telephone promotions, as well as promotions via short text messages
(SMS). Therefore, the lawfulness of such promotions is ensured if the above
considerations are respected.
9. Examination of the facts of the case file shows in particular that the controller
makes automated calls to promote products and services without the prior specific
consent of the data subjects. That is because the data controller's basic claim that
automated calls are made only to those who have given express prior consent is
unfounded because it is not borne out by the evidence relied on, for the following
reasons:
α. For none of the complaints the controller did not provide evidence showing
that it had obtained the prior consent of the called subscriber. On the
contrary, the controller stated that it considered the complaints inadmissible,
without in substance examining them. However, in all complaints detailed
information (at least the called and calling numbers, but also the date and
time of the calls) is provided by the complainants. As the Authority has
already held, and indeed before the entry into force of the GDPR (see, for
example, the Authority's judgment in Case No. 66/2016 Decision of the
Authority), when the called subscriber is the recipient of an unsolicited
nuisance, the only thing he can do to prove it in case he wants to make a
complaint is to limit himself to external details of the call and a report of its
content (caller's telephone number, time and day of calls, advertiser and, in
addition, person with whom he spoke, if declared to him, or other details of
the oral conversation). Where the complainant provides full details, the
advertiser (data controller) should be able to prove that it did not make the
call or that it was made in accordance with the conditions of lawful
processing, i.e., in this case, to prove that it had obtained prior consents.
21
This is also fully in line with the principle of accountability (Article 5(2) of the
GDPR), according to which the controller bears the responsibility to be able to
demonstrate compliance with the principles of lawful processing of personal
data. In the cases of the complaints, the controller did not carry out a
substantive check on the complainants, since it did not verify whether the
contested calls were actually made and, if so, whether prior consent had
been obtained. Indeed, it is noteworthy that for the complaint under point
(g), the controller carried out a check of the public electronic telephone
directory in order11888 to verify the complainant's subscriber details, instead
of checking its internal consent records.
It should also be noted that, as the Authority has already specified in
this regard (see, for example, the already mentioned Decision No 66/2016), in
order for the controller to be able to investigate any complaints by data
subjects, it should ensure that it keeps the information necessary for the
investigation of each complaint. In this particular case, the data subjects'
consents should be kept for a reasonable period of time to serve the above
purpose - all the more so in the present case, where the data controller was
aware, from the Authority's documents, of the existence of complaints
submitted to the Authority. Therefore, the deletion of the data of the
participants which the controller claims to carry out after the end of the
promotion in question cannot justify its inability to prove that the promotions
were indeed made to users for whom it had obtained specific consent.
β. The very procedure described by the controller regarding the general way of
obtaining the consent of data subjects does not ensure that the consents
obtained are
22
valid. This is because there is no check as to whether the person who enters
his/her data in a consent form is indeed who he/she claims to be, both when
filling in paper forms and when filling in electronic forms (see also in this
regard the Authority's Directive 2/2011 on electronic consent, which sets out
the requirements for obtaining valid electronic consent). Moreover, the risk
of personal data being filled in by another third party and not by the data
subject is also acknowledged by the data controller itself in its initial response
to the Authority in the context of the examination of the complaint under
point (a) (see the above mentioned in relation to its letter2018
C/EIS/9369/26-11), while the information text on the processing of personal
data that takes place explicitly states that the company considers that each
participant is the owner and has exclusive control over the electronic data
processing, and that the data controller has no control over the processing of
personal data. It follows from this that the company does not carry out any
checks on the accuracy of the data provided. Therefore, even if it is accepted
that it obtains consents in accordance with the procedure described (for
which it has however not provided any evidence), these consents cannot be
valid as described above.
10. The controller did not properly inform the data subjects of its identity, since - as is
clear from the complaints - none of the complainants was able to name the company
because no such information was available (with the exception of the case referred
to in point (b)). g' complaint, which however concerns the sending of SMS, and the
complaint under point (a), where - despite the fact that the company is named as the
complainant - it does not appear that information on the identity of the controller
was provided during the relevant telephone promotion).
11. In addition to automated telephone calls, it appears - on the basis of the complaint
under point (g) - that the company also sends short text messages (SMS) of a
promotional nature. In this case too,
23
as in the case of automated telephone calls, it does not appear that it had obtained
the prior consent of the recipient of the message, nor that the exception of Article 11
para. 3 of Law No. 3471/2006 for the sending of such messages without prior
consent.
12. Apart from the lack of the conditions for lawful processing in terms of carrying out
promotional activities, as described above, the controller does not have, as is clear
from the information in the case file, procedures for examining complaints, since it
did not - as stated above - carry out a substantive examination of the complaints.
Furthermore, in support of this, it is worth mentioning that, in the case of the
complaint referred to in point (a) above, the Commission did not take any action
against the complainant. i' complaint, the controller interprets the complainant's
reference to the fact that she attempted to make online purchases from various
supermarkets as a statement that she also attempted to make a purchase from the
controller, even though no such statement can be inferred from the complaint, but
instead the complainant stated that she was unaware of the supermarket allegedly
advertised by the controller.
13. The data controller appears not to have - as it should - a clear knowledge of the legal
framework, since it claims that the complainant subscribers had either not registered
their number in the opt-out register of their provider or that this registration had
been made either in a short period of time before the call was made or in an
unspecified period of time. However, as stated above, it is not permissible to carry
out automated telephone promotions without prior consent even if the called
number is not registered in the opt-out register of its provider. Moreover, even if it
were permissible to make such calls to numbers that were not registered in the opt-
out register, the controller would have had to obtain the registers from all providers
on a monthly basis - which it does not appear that it did, since it makes no mention
of it. And the controller's claims of due diligence by training staff at regular intervals
to be aware of the applicable legislation and company procedures, for which no
documentation is provided, are in any event unproven.
24
14. The controller reports that the number of complaints is low. However, it should be
taken into account that, in common experience, not all those who receive
summonses in violation of the provisions of Article 11 of Law No. 3471/2006, while
indicatively it is noted that for the company's telephone numbers there are web
pages on the Internet where subscribers report receiving such unwanted calls, with
content similar to that reported by the complainants1. Moreover, given that the
company has been inactive (see VAT returns for months of 2019 and 2020 submitted
with its memos), it would not be possible that there has been an increase in
complaints in recent months (although, as mentioned above, there was one
complaint also during the period of inactivity of the controller's activities, for which
no clear explanation was given). In any event, the number of complaints cannot in
itself, in this case, be a criterion for assessing the extent of the infringement since, as
stated above, the controller was in any case not receiving valid consents in the
context of its activities.
15. The controller clearly intended to obtain an economic benefit from that processing.
16. Furthermore, the controller did not always respond in a timely manner to the
Authority's documents transmitting complaints and requesting its views (see in
particular, the documents referred to in points (a) and (b) above). b' - j' complaints,
for which the controller sent its replies cumulatively after the Authority's letter No
C/EX/4560-1/27-07-2020 - i.e. more than one year after the first relevant letter of
the Authority, No C/EX/1342-2/10-04-2019, by which the initial complaints had been
transmitted to it). Moreover, despite the Authority's documents, the same activity
was still being carried out by the controller, without complying with the conditions
for lawful processing of personal data.
1
See for example https://www.white-pages.gr/ and https://www.white-pages.gr/ (last
accessed: 2021)
25
17. The Authority, taking into account the above established infringements of Articles 13
and 14 of the GDPR and Article 11 of Law No. 3471/2006 and taking into account on
the one hand that the data controller: i) aimed at financial gain from such processing
for as long as the company was active (since there was a charge for users if they
made the appropriate key selection to proceed further); ii) did not have a procedure
for examining/meeting data subjects' complaints; iii) did not respond in a timely
manner to the Authority's documents by continuing processing without taking into
account the Authority's observations; and iv) was not aware of the relevant legal
framework, since582 the data controller was not aware of the relevant legal
framework. 1(b) of Act No. 2472/1997 (which remains in force pursuant to Article of
84Law 4624/2019), the administrative penalty of a fine, referred to in the operative
part of the present decision, which in any case is deemed - by virtue of the article of
the 83GDPR - effective, proportionate and dissuasive.
FOR THESE REASONS
The Authority
Impose on INFO COMMUNICATION SERVICES ADVERTISING - PROMOTIONAL -
COMMERCIAL - RESEARCH AND PUBLICATIONS COMPANY, as the responsible person
processing, the effective, proportionate and dissuasive administrative fine
appropriate to the specific case in accordance with the specific circumstances of this
case, amounting to thirty thousand euros (30,000.00) euros, for the above violations
of Articles 13 and 14 of Regulation (EU) 2016/679 and Article of 11Law No.
3471/2006, in accordance with Article 13(58i2) of the GDPR in conjunction with
Article 83(1)(a) of the GDPR. 5 of the GDPR, and with Article 21(5) of the GDPR, and
with Article 21(2)(a) of the GDPR. 1(b) of Law No. 2472/1997, in conjunction with
Article 13 par. 4 of Law No. 3471/2006 and Article 84 of Law 4624/2019.
26
The President
Konstantinos Menoudakos
IriniThe Secretary
Papageorgopoulou
27
