HDPA (Greece) - 36/2021
| HDPA (Greece) - 1947/26-08-2021 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 5(2) GDPR Article 12(2) GDPR Article 15 GDPR Article 83 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 26.08.2021 |
| Published: | |
| Fine: | 40.000 EUR |
| Parties: | KOTSOVOLOS S.A National Bank of Greece S.A. |
| National Case Number/Name: | 1947/26-08-2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | Hellenic Data Protection Authority (in EL) |
| Initial Contributor: | Stergios |
The HDPA investigated a complaint against two data controllers for failure to comply with a consumer's access request in the context of the sale of a product which had been returned. The HDPA imposed an administrative fine of EUR 20,000 on each Controller for failure to comply with the the right of access.
English Summary
Facts
The complainant had bought a product from a seller (Controller A). It was agreed that the price of the product would not been paid in full at the time of the sale, but rather via several installments. Shortly thereafter, the Complainant decided to return the product. Despite this return, the Complainant realized that he was still being charged every month on his credit card. he therefore contacted Controller A in writing (via the Facebook Messenger App) and asked the latter to notify the bank (Controller B) of the need to cancel his credit card installments. Controller A however did not notify Controller B. The Complainant therefore attempted to directly contact Controller B with the same request. Controller B never answered him.
The Complainant then requested Controller A to provide him with a copy of the correspondence it had with Controller B with respect to the installments. Controller A however refused to grant him access to this information on the basis of that the communication that had taken place with the bank constituted an internal communication with "no possibility of disclosure".
In this context, the Complainant decided to file a complaint with the Greek DPA (the HDPA)
Holding
The HDPA held that Controller A and B should have responded positively to the request of the Complainant in accordance with Article 12(2) GDPR and Article 15 GDPR. The HDPA imposed an administrative fine of EUR 20,000 on each Controller for failure to comply with the the right of access.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
