HDPA (Greece) - 65/2022

HDPA - 65/2022
Authority:	HDPA (Greece)
Jurisdiction:	Greece
Relevant Law:	Article 12(1) GDPR Article 12(3) GDPR Article 12(4) GDPR Article 13 GDPR Article 15(1) GDPR Article 51 GDPR Article 55 GDPR
Type:	Complaint
Outcome:	Upheld
Started:	14.12.2022
Decided:	20.12.2022
Published:	20.12.2022
Fine:	n/a
Parties:	n/a
National Case Number/Name:	65/2022
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	Greek
Original Source:	HDPA (in EL)
Initial Contributor:	ANASTASIA TSERMENIDOU

The Greek DPA found that a polling company had violated Articles 12 and 15 GDPR, for failing to respond to an access request submitted by a participant in a telephone survey.

English Summary

Facts

In this case an individual, the data subject, who had taken part in a phone call with a polling company, the controller, submitted an access request (Article 15 GDPR) to obtain a copy of the recorded conversation. The company did not respond to her request and, subsequently, she filed a complaint with the Greek DPA.

When asked to provide submissions to the DPA, the controller responded to the complaint by stating, firstly, that it is not a commercial sales company and therefore does not record conversations or collect personal data in any way. Secondly, they explained that they have a three-month period for which they keep personal data on their files and so, had there been any collection of the data as suggested, it would have been deleted. The company also speculated that the subject’s access request (submitted via email) probably ended up in a “pile of unwanted corporate correspondence”.

Holding

Issuing its decision, the DPA acknowledged the two arguments put forward by the controller. In response to both of these claims, the authority held that “the controller is not released from its obligation to inform the data subject merely because the data in question does not exist in a file kept by [them]”.  Therefore, as the company did not respond to the data subject’s request in any way, they had violated Article 12 and 15 GDPR. The decision also found that the investigation, and the controller’s comments, demonstrated that the company does not appear to have any methods in place to deal with these sorts of requests.

Regarding the exercise of corrective powers, the DPA observed that the effects of the infringement were de minimis, that the company did not derive any benefit from it, and that there are have been no prior infringements by the controller. Therefore, in accordance with Article 58 GDPR, the DPA issued a reprimand to the controller, and imposed an order instructing the company to establish, within two months from the receipt of this notice, procedures to ensure that the rights of data subjects are duly satisfied and to inform the Authority accordingly.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

Summary
The Authority reviewed two related complaints of violation of the right to access recorded conversations against a polling company. This right was exercised by the complainants as participants in a public opinion survey carried out by the aforementioned company. The Authority accepted the complainant's request to withdraw, placing one complaint on file, while for the other, it found that there had been a violation of articles 12 para. 1, 3, 4 and 15 para. 1 of the GDPR, to the extent that the complained company never responded to the right exercised above, if only to inform about the fact that it does not have in its file the element requested by the complainant and imposed a reprimand for the above violations. At the same time, he instructed the complainant to act to formulate, within two months from the receipt of the decision, procedures, in order to adequately satisfy the rights of the data subjects and to inform the Authority accordingly.