HDPA (Greece) - 52/2024
HDPA - 52/2024 | |
---|---|
Authority: | HDPA (Greece) |
Jurisdiction: | Greece |
Relevant Law: | Article 58(1)(a) GDPR Article 58(2)(b) GDPR Article 83 GDPR Article 11 (1) 3471/2006 Article 11 (7) 3471/2006 |
Type: | Complaint |
Outcome: | Upheld |
Started: | 01.03.2021 |
Decided: | 13.11.2023 |
Published: | 18.12.2024 |
Fine: | 10,000 EUR |
Parties: | Dalnave - data subject WEDOO Digital Agency - controller |
National Case Number/Name: | 52/2024 |
European Case Law Identifier: | n/a |
Appeal: | Unknown |
Original Language(s): | Greek |
Original Source: | HDPA (in EL) |
Initial Contributor: | Vasiliki Kalantzi |
The DPA fined a company (controller) €10,000 for unsolicited communication, in violation of national greek law, Article 11 (1) Act 3471/2006 Protection of personal data & privacy in electronic communications.
English Summary
Facts
On 1 March 2021 the data subject filed a complaint with the DPA, for the fact that they had received unsolicited communication via email, and in particular the commercial promotion of digital advertising services, without having any prior relation with the controller. The data subject further stated that in response to their question regarding how their data became available to the controller, they received the generic answer that these had been collected through market research.
After the DPA had made numerous attempts to contact the controller without response, they issued decision no. 23/2023, where: -According to Article 58 (2) (b) GDPR they reprimanded the controller. -According to Article 58 (1) (a) they instructed the controller to immediately reply to the filed complaint. -Informed the controller that in case of non-compliance, they will impose an administrative fine according to Article 83 GDPR.
Holding
The DPA held that: a) According to national greek law, Article 11 (1) Act 3471/2006 Protection of personal data & privacy in electronic communications: "The use of automatic systems, in particular by means of fax machines or electronic mail, and in general the making of unsolicited communications by any means of electronic communication, [with or] without human intervention, for the purposes of direct marketing products or services and for any kind of advertising purposes, shall be permitted only if the subscriber has given his or her express prior consent. b) According to Article 1 (1) (2) GDPR: This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. c) The controller did not comply with the aforementioned decision 23/2023 of the DPA. d) The e-mail account to which the unsolicited commercial services promotion e-mail was sent, according to the filed complaint, did not correspond to a natural person but to a legal person, being the central contact address of a company. According to national greek law, Article 11 (7) Act 3471/2006 Protection of personal data & privacy in electronic communications: "The above-mentioned regulations also apply to subscribers who are legal persons".
For the above reasons the DPA imposed on the controller a total fine of €10,000 for the violation of national greek law, Article 11 (1) Act 3471/2006 Protection of personal data & privacy in electronic communications.
Comment
This case highlights the fact that under national greek law, not only natural but legal persons, as well, are protected by unsolicited communications.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
1 1-3 Kifissias Ave., 11523 Athens T: 210 6475 600 • E: contact@dpa.gr • www.dpa.gr Athens, 18 December 2024 Case No. 3610 Decision 52/2024 The Personal Data Protection Authority convened, following an invitation from its President, in a meeting via videoconference on Wednesday 13.11.2023 at 10:00, in order to examine the case referred to in the background of this case. Present were Georgios Batzalexis, Deputy President, due to the inability of the President of the Authority, Konstantinos Menudoukou, and the alternate members of the Authority, Nikolaos Livos, as rapporteur, Dimosthenis Vougioukas and Maria Psalla in place of the regular members Charalambos Anthopoulos, Konstantinos Lambrinoudakis and Grigoriou Tsolias respectively, who, although legally summoned in writing, did not attend due to inability. Present, without the right to vote, were Panagiotis Tsopelas, auditor, as assistant rapporteur. By order of the President, Irini Papageorgopoulou and Georgia Palaiologou, employees of the Administrative Affairs Department of the Authority, attended, as Secretary, and Georgia Palaiologou as coordinator. The Authority took into account the following: A complaint was submitted to the Authority regarding the promotion of products and services of the company “SOCIAL COOPERATIVE ENTERPRISE OF COLLECTIVE AND SOCIAL BENEFIT wedoo Digital Agency” (hereinafter WEDOO), via email messages. Specifically, with the no. protocol no. C/ΕΙΣ/1433/01- 03-2021, A (hereinafter complainant) submitted a complaint to the Authority stating that he received a message from WEDOO via email for commercial promotion of digital advertising services. In detail, the email mention, among other things, the following: “we would like to propose cooperation for the creation of an e-shop or the promotion of your 2 business through Digital Marketing services. Our team specializes in digital advertising services. (Google Ads, Social Media Marketing, Content Creation, Mail Marketing, Viber Campaign). We would like to point out that we provide you with the ability to connect your e-shop with ERP management programs & XML connection. The above services are part of our long-standing expertise and experience that guarantees the safe and smooth connection of stores. Furthermore, the complainant states that he had no previous relationship with WEDOO and that in his relevant question regarding the origin of his data, he received the answer that it had been collected from market research. The Authority informed WEDOO of the above complaint with the document no. Γ/ΕΣΕ/855/17-03-2021. On 17-05-2021, it was sent with the document no. proc. C/EXE/1234/17-05-2021 reminder email and on 07-06-2021 the no. proc. C/EXE/1424/07-06-2021 document with which the Authority invited WEDOO to submit its views within ten calendar days. On 16-09-2021 the Authority, following a telephone conversation with WEDOO, resent, upon request, the above documents to the email address indicated without any relevant response. On 15-10-2021 the Authority again sent via registered mail the initial information document with no. proc. C/EXE/2345/15-10-2021, which was returned as unsolicited. The relevant documents were served on WEDOO by the Chaidari Police Department on 04-02-2022, as is apparent from the no. C/ΕΙΣ/1797/04-02-2022 proof of service, without there being any response from WEDOO to the relevant document. WEDOO was summoned to a hearing with the no. prot. C/ΕΣΕ/2664/21-10-2022 document of the Authority which was served by the Chaidari Police Department on 24/10/2022. No one from the company attended the meeting. Subsequently, the Personal Data Protection Authority issued decision 23/2023, the operative part of which states the following: 3 The Authority: 1. Exercising the corrective powers conferred on it by Article 58 par. 2 b) of Regulation (EU) 2016/679 (General Data Protection Regulation - hereinafter GDPR), reprimands the accused company under the name "SOCIAL COOPERATIVE ENTERPRISE OF COLLECTIVE AND SOCIAL BENEFIT wedoo Digital Agency", as controller for the reasons extensively mentioned in the previous section. 2. Exercising the corrective powers conferred on it by Article 58 par. 1 a) of the GDPR, instructs the respondent to respond immediately to the complaint. 3. Informs the respondent that in case of non-compliance with the order of the previous paragraph within seven (7) calendar days from the service of this letter, it will proceed, exercising the corrective powers granted to it by article 58 par. 2 letter i) of the GDPR, to impose an administrative fine pursuant to article 83 of the GDPR. Finally, the Authority notified the above decision to WEDOO with the registered letter No. Prot. C/ΕΙΣ/1466/23-05-2024 which was received by a representative of the said company on 29/05/2024 according to the proof of delivery of the Hellenic Post (EL.TA.). Because WEDOO did not comply with the operative part of the above decision, the Authority summoned the company to a hearing with the document no. Γ/ΕΣΕ/2024/2755 . The summons was served by the Egaleo Police Department on 13/1- /2024. No one from the company attended the meeting. CONSIDERED IN ACCORDANCE WITH THE LAW 1. According to article 11 par. 1 of Law 3471/2016 “The use of automatic calling systems, in particular using fax machines or 4 e-mail, and more generally the making of unsolicited communications by any means of electronic communication, [with or] without human intervention, for the purposes of direct marketing of products or services and for any kind of advertising purposes, is permitted only if the subscriber expressly consents in advance.” It is noted that, based on paragraph 7 of the same article, “The above regulations also apply to subscribers who are legal entities.” 2. According to Article 1, paragraphs 1 and 2 of the GDPR: “ 1. This Regulation establishes rules concerning the protection of individuals with regard to the processing of personal data and rules concerning the free movement of personal data. » 3. The Authority, by Decision 23/2023, ordered WEDOO, exercising the corrective powers conferred on it by Article 8, paragraph 1, subparagraph a) of the GDPR, to respond immediately to the complaint. The company in question did not respond within the seven (7) calendar day period referred to in point 2 of the operative part of the decision. 4. The email account to which the commercial services promotion email was sent according to the complaint form does not correspond to a natural person but to a legal person as it is the central contact address (dalnave@dalnave.com) of a company and is not otherwise related to any natural person. Therefore, taking into account WEDOO's refusal to cooperate with the Authority and that according to paragraph 7 of article 11 of law 3471/2006 the provisions of this article also apply to subscribers who are legal persons, it is established that WEDOO, by sending an email with the aim of promoting its products or services to a legal person, violated article 11 paragraph 1 of law 3471/2006. 5. WEDOO, according to the "Announcement of Registration of Decision for the Conversion of 5 Company into IKE" 1 published on 17/05/2023, changed its corporate form from a Social Cooperative Enterprise (KOINSEP) to a private capital company (IKE) with No. GEMI 166386961000, and Tax Identification Number (TIN) Audit Firm: 193. 6. Based on the above, the Authority considers that it is appropriate to exercise the powers under article 21 of Law 2472/1997 in conjunction with article 13 par. 1 of Law 3471/2006, taking into account article 84 of Law 4624/2019, for the established violation of article 11 par. 1 of Law 3471/2006. In order to calculate the sanction, the Authority takes into account the actual facts of the case under examination, the continued refusal of the audited company to respond and cooperate with the Authority even after the issuance of the previous decision, the gravity of the established violation, which is considered minor, the small number of complaints and the size of the company's turnover2. 1 https://publicity.businessportal.gr/company/166386961000 2 Latest available turnover: €1,368,852.16 (year 2023). https://publicity.businessportal.gr/company/166386961000 Financial Statements 6 FOR THESE REASONS The Authority Imposes, on WEDOO DIGITAL AGENCY SINGLE-PERSON IKE, based on article 21 of Law 2472/1997 in conjunction with article 13 par. 1 of Law 3471/2006, the effective, proportionate and dissuasive administrative fine that is appropriate in this specific case according to the specific circumstances of this case, amounting to ten thousand (10,000) euros, for the above-identified violation of article 11 par. 1 of Law 3471/2016 as analyzed in paragraphs 3 and 4 of this. The Deputy President The Secretary George Batzalexis Irene Papageorgopoulou