HDPA (Greece) - 20/2023

HDPA - 20/29-05-2023
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 12(2) GDPR Article 12(3) GDPR Article 12(4) GDPR Article 15 GDPR Article 21 GDPR Article 25(1) GDPR
Type:	Complaint
Outcome:	Upheld
Started:	14.06.2022
Decided:	29.05.2023
Published:	29.05.2023
Fine:	150.000 EUR
Parties:	n/a
National Case Number/Name:	20/29-05-2023
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Greek
Original Source:	HDPA (in EL)
Initial Contributor:	eirini.saranti

The HDPA issued a compliance order and imposed a fine on a telecommunications provider for the violation of the rights of access and objection.

English Summary

Facts

The HDPA examined complaints from a subscriber of a telecommunications provider, in which he described that he received repeatedly electronic messages for promotional services, even though he opposed and protested to that. His request to exercise his right of access was also not satisfied. In particular, the telecommunications provider sent five promotional electronic messages to the complainant, even though he had previously exercised his right to object to the promotional communications with his inclusion to the Register of Article 11 Law 3471/2004. The HDPA also concluded that the fact that the complainant did not use the procedure that was described in the company policy when exercising his right to access, was not a legitimate reason to not satisfy his request. Also, the telecommunications provider made it difficult to exercise the right of access, pretextually citing the inability to correctly identify the complainant in other ways than physical presence in the store or through by registered letter. They also did not have the appropriate procedures and measures to ensure the exercise of the right to object and the right to restriction of processing of personal data for promotional purposes, in order to meet the requirements of the GDPR and to protect the rights of their subjects data.

Holding

The HDPA ordered the telecommunications provider to satisfy the complainant's right to access. Also, the HDPA imposed a fine of a) €60,000 for violating Article 21 (3) GDPR because the telecommunications provider sent five promotional messages, even though the complainant opposed to that and his phone number was removed from the Register of Article 11 Law 3471/2004 for a period of three months without him having requested that, b) €60,000 because the telecommunications provider didn't respond to the complainant's right of access and made it difficult for him to exercise it and c) €30,000 for violation of Article 25 (1) GDPR because the telecommunications provider did not in practice have the necessary procedures for the complainant to exercise the right to object and for them to stop the processing of the personal data for promotional purposes.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

Summary
The Authority examined complaints from a subscriber of WIND, now NOVA, in which he complained about repeated receipt of e-mails for promotional purposes despite his opposition and repeated protests, as well as non-satisfaction of requests to exercise the right of access.

The Authority imposed a fine a) 60,000 euros for violation of Article 21 (3) GDPR due to the sending of five promotional messages despite the opposition and the removal of the complainant's telephone number from the Register of Article 11 Law 3471/2004 for a period of three months without to have requested it himself, b) 60,000 euros for failure to satisfy the right of access, failure to provide an answer, even if negative, and making it difficult to exercise the right of access, pretextually citing the inability to correctly identify the complainant in other ways than physical presence in the store or through by registered letter in violation of article 15 (1) cond. 12 par. 2, 3 and 4 GDPR and c) 30,000 euros for violation of Article 25 (1) GDPR because it did not in practice have the necessary procedures to ensure the right to object and stop the processing of the data for the promotional purpose.