HDPA (Greece) - 8/2021

HDPA - 901
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 4(7) GDPR 11 (3) 3471/2006
Type:	Complaint
Outcome:	Upheld
Started:
Decided:	02.12.2020
Published:	16.04.2021
Fine:	2000
Parties:	n/a
National Case Number/Name:	901
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Greek Greek
Original Source:	Αρχή Προστασίας Προσωπικών Δεδομένων (in EL) Αρχή Προστασίας Προσωπικών Δεδομένων (in EL)
Initial Contributor:	n/a

The Greek DPA held that a 2000€ fine should be imposed to a candidate of the municipal elections for illegal processing of personal data for the purpose of political communication via emails.

English Summary

Facts

The complainant received an SMS from the political candidate which was promoting the candidate’s participation at the municipal elections without having granted a consent to do so. The political candidate, wasn’t able to provide proofs that the complainant and other data subjects gave their consent for the processing.

Dispute

Was the political communication legal under article 4 GDPR?

Holding

The DPA held that in the light of Article 4 GDPR, Article 13 of the national law 3471/2006 and Article 11 of the national law 3471/2006, the political communication for the purposes of the promotion of the candidate’s political campaign, can be considered legal only after the granting of explicit consent. Political communication without consent is possible only if the data subject has been given his personal details and was informed that the details will be used for the purposes of the political communication. Moreover the data subject should be able to withdraw and refuse this processing.

For this reason the DPA fined the candidate for unlawful processing of data by a 2000€ fine.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

  
    
The Personal Data Protection Authority met in
at its seat on 02-12-2020 at the invitation of the
of its President, in order to examine the case relating to the case history of the
of the present case. In attendance were George Batzalexis, Deputy Chairperson,
in the absence of the Chairman of the Authority, Konstantinos Menoudakou, the full member
Charalambos Anthopoulos and the alternate member Evangelos
Papaconstantinou, as Rapporteur, replacing the alternate member
Konstantinos Lambrinoudakis, who, although duly invited in writing, was not able to attend the meeting.
was absent due to an impediment. The alternate member Spyridon Vlahopoulos, although invited to attend, was not present.
duly invited in writing, did not attend due to his absence. The following were present at the meeting
by order of the President, Mr Ioannis Lycotrafitis, Specialist Scientist - Controller, as
as assistant rapporteur and Irene Papageorgopoulou, official of the
Administrative Affairs Department of the Authority, as Secretary.
The Authority took note of the following:
Complaint No. C/EIS/1717/06-03-2019 was submitted to the Authority,
The complaint was received on 17/17/77/63, which concerns the receipt of unsolicited political communication (sms) by A for the purpose of receiving unsolicited political communication (sms) from A.
(a) The request for information (a) is in response to a request for a political communication from A. The request was made in response to an e-mail sent to A. The request was in response to a request for information (a) to promote his candidacy in the municipal elections of .... 
2
According to the above complaint, the complainant received on ..., on his mobile phone
a short text message (SMS) from the complainant on his mobile phone with the number ...
(the sender of the message appeared to be the surname of the complainant
"A"), which was of a political nature for the purpose of promoting the
candidacy in the forthcoming municipal elections of ..., without having - as
the complainant alleges - any previous relationship with him.
In the context of its examination of this complaint, the Authority sent the complainant
the complainant the document No C/EX/1717-1/19-03-2019 in which
requesting its views on the complainants, taking into account the
Guidelines issued by the Authority on political communication.
The complainant replied to the Authority by letter No C/EIS/6683/04-
10-2019, in which it states, inter alia, in summary
mentioned:
1) In order to promote his candidature, he used all legal
He used all legal means available to him, including short text messages via mobile phones.
(sms). The sending of these messages was mass, i.e. not
personalised to selected persons or telephone numbers, did not
was not addressed to anyone personally and did not affect any personal data
of the recipient. In fact, as regards the recipients, when they were sent they did not
the complainant did not even know whether they were voters in Municipality F.
2) The lists of cell phones used for the mailings
of the messages were delivered to him either by candidates for city council
and related to persons controlled by them, or from lists that had been
previously used by other politicians to any degree
involvement in elections, or from the Internet where telephone numbers were posted that
were used to promote or advertise the holder and the capacity that
he or she has (e.g. professional advertising, etc.).
3) It does not constitute a violation of Law no. 3741/2006 does not constitute an offence if such messages are sent, the
which was of course used as a method of promotion by all
This case does not fall under the mandatory concession of the 
3
possibility for the complainant to object to the use of his telephone after
the number used was freely accessible to third parties.
The Authority then invited the complainant by letter C/EX/1717-2/06-11-2019
document inviting the complainant to a hearing by videoconference in order to
to discuss the above-mentioned complaint as well as the general practice followed by
by the candidate for political communication by electronic means.
The meeting of 11-11-2020 was attended by teleconference by A, who
presented his views orally. The complainant was given a deadline, but did not
submitted a memorandum.
The Authority, after examining the evidence on the file, the hearing
hearing and having heard the rapporteur and the assistant rapporteur, who
having left the case after the hearing and before the hearing and the adoption of the
after a thorough discussion,
CONSIDERED IN ACCORDANCE WITH THE LAW
1. In accordance with Article 4(4)(a), (b) and (c), after deliberation and after having considered the case in accordance with Article 1(1), (d) and (e), the parties have decided on the basis of Article 1. 7 of the General Regulation (EU) 2016/679 for the
Protection of natural persons with regard to the processing of data
Protection of personal data against the processing of personal data and on the free movement of such data
(hereinafter, the Regulation), which has been in force since 25 May 2018, as
controller is defined as 'the natural or legal person, the public
authority, agency or other body which, alone or jointly with others, determines
the purposes and means of the processing of personal data
personal data'.
2. The issue of making unsolicited communications with any
means of electronic communication, without human intervention, for the purposes of
direct marketing of products or services and for any kind of
advertising purposes, is regulated by Article 11 of Law No. 3471/2006 on the
protection of personal data in the electronic communications sector.
According to this article, such a communication is only allowed if the
The communication is only allowed if the subscriber has expressly consented in advance. Exceptionally, according to 
4
Article 11 par. 3 of Law no. 3471/2006, the contact details of electronic
legally acquired in the context of the sale of products or
services or other transaction, may be used for the direct sale of goods and services or other
direct marketing of similar products or services of the supplier or for
or for similar purposes, even if the recipient of the message
has not given his or her prior consent, provided that
is given the opportunity to object in a clear and distinct manner, by
in an easy manner and free of charge, to the collection and use of his or her electronic
data and this during the collection of contact data, as well as at any
message, in the event that the user did not initially object to this
use. Moreover, according to paragraphs 1 and 4 of Article 13 of the same law.
3471/2006, as regards compliance with that law, the Data Protection Authority
Personal Data Protection Authority has the powers conferred on it by Law No. 2472/1997, as amended.
and shall impose the sanctions provided for by the latter law
in the event of a breach of the provisions of the aforementioned law. 3471/2006.
3. Especially for political communication through electronic means without human
intervention and in accordance with the Authority's guidelines on
processing of personal data for the purpose of political communication
In accordance with the provisions of Article 11 of Law No. 3471/2006, as well as the
Directive 1/2010 of the Authority on political communication, as well as the General
EU Regulation (EU) 2016/679 on the protection of natural persons with regard to the communication of personal data in the context of electronic communications
processing of personal data which is in application
from 25 May 2018, the following shall apply:
Political communication1 is of interest from the point of view of the protection of
It is relevant from the point of view of personal data protection, it takes place in any period of time,
from the point of view of data protection in terms of privacy, at any time, whether electoral or non-electoral, by political parties, MPs, MEPs, MEPs,
Whether in political parties, whether in elections, political parties, MEPs, political parties and holders of elected office in local government or
candidates in parliamentary elections, elections to the European Parliament
and local government elections. Such persons shall be responsible for
processing, in accordance with Regulation (EU) 2016/679, Article 4, point 7)
 1 See definition in Article 1 par. 2 of Directive 1/2010 of the Authority. 
5
in so far as they determine the purpose and means of the processing. For example, where
Members of Parliament or parliamentary candidates receive data from political parties
parties and process them for their personal political communication,
they also become data controllers. In this capacity and on the basis of
the principle of accountability2 , they must be able to demonstrate compliance with the
their obligations and the rules on processing.
4. Where the political communication is made by electronic means
without human intervention, through public networks
public communication, such as in the case of e-mails
(e-mail), the communication presupposes, in accordance with Article 11 (par. 11), that the communication is subject to the use of the electronic communication system. 1 ν.
3471/2006, as in force, the prior consent of the data subject is required.
data subject, without prejudice to paragraph 3 of the same Article, as applicable.
It should also be noted that short text messages (SMS) also constitute
e-mails in accordance with the definitions of the Act on the Protection of Personal Data, as amended by Act No.
3471/2006 and Directive 2002/58/EC.
5. Political communication using electronic means is permitted without
The use of electronic media without human intervention and without the consent of the data subject is permitted.
The following conditions must be fulfilled without the consent of the data subject:
(a) The contact data have been lawfully acquired in the context of
(a) the contact information has been legally obtained in a previous, similar contact with the data subjects; and
The data subject was informed of their use at the time of collection of the data by means of a previous and similar contact with the data subject, and the data subject was informed of their use by means of a prior contact with the data subject.
The data subject has been informed of the use of the data for the purpose of political communication, has been given the opportunity to express his or her views on the use of the data for the purpose of political communication
to object to such use but did not do so. The previous contact was not
need not necessarily be of a purely political nature, e.g. is it lawful to
where the email details are not legally valid?
were collected in the context of a previous invitation to participate in a
event or action, regardless of its political nature. On the contrary, it is not
is not considered to constitute a similar contact and it is not lawful to use the
electronic contact details for the purpose of political communication
where such information was obtained in the context of a professional relationship, such as 2 As set out in Article 5 par. 2 of the GDPR
6
for example the use of the client file by a candidate for parliament.
(b) The controller must provide the data subject with the information on the
data subject to exercise the right to object in an easy and
clear, and this in every political communication message. In each communication
shall clearly and unambiguously indicate the identity of the sender or
the person for whose benefit the message is being sent, as well as
and a valid address to which the recipient of the message can
request termination of the communication.
6. In this particular case, the complainant, as controller, shall
carried out a political communication by sending short written messages to the data subject, and
(sms). The legality of the sending is ensured if the following have been complied with
the above considerations 4, 5.
the following emerge from the data controller's response:
7. The controller has not provided evidence that
that the required prior consent of the recipient had been obtained
of the offending SMS message. On the contrary, the complainant notes that
he used several sources (other candidates, internet sites)
and that the mailing was sent in bulk, without knowing at the time of sending whether the
recipients were voters in the municipality in which he was a candidate, i.e. the municipality in question.
that communication was made without any of the following
conditions of legality described in Considerations 4 and 5 above.
Moreover, the controller has not demonstrated that it follows procedures,
regarding the sending of short text messages for the purposes of
communication policy, which ensure that the above mentioned conditions are met?
conditions of legality.
8. The controller did not provide relevant information on other persons
to whom he has sent political communication messages, nor has he identified the
specified the exact number of messages sent.
9.
The complainant was not given the opportunity to exercise the right to object in an easy manner.
and clear, to the offending sms message of the complaint.
10. The controller cooperated satisfactorily with the Authority, since 
7
responded to the document for clarifications, providing the information that
requested, as well as at the meeting of the Authority.
11. No administrative sanction has previously been imposed by the Authority on the
The Authority has not been previously sanctioned by a controller.
On the basis of the above, the Authority unanimously considers that in accordance with Article 11 of Act No.
3471/2006, the Authority considers that the conditions for imposing an administrative penalty on the controller are fulfilled.
on the basis of Article 13 of Law No. 3471/2006, in conjunction with Article 13 of Article 13 of Regulation (EC) No 3471/2006.
Article 21(21) of Regulation (EC) No 3471/71, in conjunction with Article 21(2)(a) of Regulation (EC) No 3471/2006. 1(b) of Law No. 2472/1997 and with Article 84 of Law No. 84. 4624/2019, and
on the other hand, Article 58 par. 2(i) of the Rules of Procedure and Article 15(2)(i) of the Rules of Procedure and Article 15(2)(i) of the Rules of Procedure. 6 of Act No.
4624/2019, the administrative sanction referred to in the operative part of this Order,
which is effective, proportionate and dissuasive, taking into account the
aggravating elements referred to in paragraphs 7, 8 and 9 of this Article and the
mitigating circumstances set out in paragraphs 10 and 11 of this Decision.
FOR THESE REASONS
The Data Protection Authority:
Impose on A the effective, proportionate and dissuasive administrative
appropriate in the specific case in accordance with the
2 000,00 euros (EUR 2 000,00) for the specific circumstances of the case, for the following
for the above-mentioned violations of Article 11 of Law No. 3471/2006.
The Deputy President The Secretary
Georgios Batzalexis Irene Papageorgopoulou