HDPA (Greece) - 57/2021
| HDPA (Greece) - 57/2021 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 13 GDPR Article 14 GDPR N.3471/2006 Article 11 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 12.07.2021 |
| Published: | 31.12.2021 |
| Fine: | 25,000 EUR |
| Parties: | PLUS REAL ADVERTISMENT |
| National Case Number/Name: | 57/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Greek |
| Original Source: | HDPO (in EL) |
| Initial Contributor: | eleni.papadopoulou |
The Hellenic DPA fined a controller €25,000 for failing to provide information concerning their personal data to data subjects under Article 13 GDPRand Article 14 GDPR.
English Summary
Facts
Two individuals submitted complaints before the Hellenic DPA (HDPA) against advertising company PLUS REAL ADVERTISMENT(henceforth: PLUS REAL) for unlawful processing of personal data for purely marketing purposes. PLUS REAL used an automated mechanism making telephone calls in order to contact individuals for advertising and marketing purposes. As regards the first complaint, the individual received a phone call from an unknown number with a recorded message informing him he won a prize of 680,00 euros. After some seconds a human person was in line telling the individual he had to make an extra call and give a special code in order to win his prize, without giving him more details as for the real call charges. The individual made that second call and heard from recorded message that the call charges are bigger than the ones mentioned at the first call and that the line was occupied so he had to call again. After his third attempt, the individual spoke to a woman and realised that the prize was actually vouchers offered only in case the individual would make high cost purchases. As for the second complaint, the individual mentioned that he received a telephone call from an unknown number with a recorded message telling him he won money as prize for a competition, but the individuals did not manage to hear the name of the company referred. The Hellenic DPA asked integrated communication solutions companies MICROBASE and LEXITEL to whom the unknown numbers belonged and was informed that the owner was PLUS REAL.
Holding
After reviewing the facts of the case, the HDPA first stated that PLUS REAL is "controller" under Article 4(2)(7) GDPR because it processed personal data of individuals for conducting automated phone calls to them with recorded messages. Moreover, the HDPA held that PLUS REAL was in breach of GDPR provisions because it made these calls for advertising and marketing purposes and without previously granting the specific consent of data subjects . In addition, PLUS REAL failed to comply with Article 5(2) GDPR since it failed to prove that these calls never happened or that even though they happened, they were in compliance with law. Furthermore, PLUS REAL did not reveal to data subjects its identity as controller, and did not have a mechanism to respond to data subjects requests for information concerning their personal data. Therefor, the HDPA fined the controller, PLUS REAL, €25,000 under Article 58(2) GDPR and Article 83(4) GDPR for the breach of Article 13 GDPR and Article 14 GDPR.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Category
Decision
Date
08/12/2021
Transaction number
52
Thematic unit
09. Promotion of products and services
Applicable provisions
Article 28: Perform the processing (arrangements)
Article 32: Processing security
Article 11.1: Unsolicited electronic communication
Summary
The Authority received 17 complaints regarding illegal telephone calls aimed at promoting products or services of the company ZENITH - Gas Supply Company of Thessaloniki, Thessaly SA. For this specific processing ZENITH has the position of controller, and One Way Private Company has the position of executor. The examination of the case revealed that due to an error in the implementation of the processor, telephone calls were made to subscribers who had been registered in register 11, in violation of article 11 of Law 3471/2006. The Authority imposed on the processing One Way Private Company a fine of 30,000 euros for violation of article 32 par. 2 and 4 of the GCP in combination with article 28 par. 3, c. He also imposed on the person in charge of processing ZENITH, the sanction of the reprimand for violation of article 28 par. 3 case c of GKPD.
PDF Decision
52_2021anonym.pdf272.69 KB
Category
Decision
Date
08/12/2021
Transaction number
52
Thematic unit
09. Promotion of products and services
Applicable provisions
Article 28: Perform the processing (arrangements)
Article 32: Processing security
Article 11.1: Unsolicited electronic communication
Summary
The Authority received 17 complaints regarding illegal telephone calls aimed at promoting products or services of the company ZENITH - Gas Supply Company of Thessaloniki, Thessaly SA. For this specific processing ZENITH has the position of controller, and One Way Private Company has the position of executor. The examination of the case revealed that due to an error in the implementation of the processor, telephone calls were made to subscribers who had been registered in register 11, in violation of article 11 of Law 3471/2006. The Authority imposed on the processing One Way Private Company a fine of 30,000 euros for violation of article 32 par. 2 and 4 of the GCP in combination with article 28 par. 3, c. He also imposed on the person in charge of processing ZENITH, the sanction of the reprimand for violation of article 28 par. 3 case c of GKPD.
PDF Decision
52_2021anonym.pdf272.69 KB
