HDPA (Greece) - 04/2025
From GDPRhub
| HDPA - 04/2025 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 12(2) GDPR Article 12(3) GDPR Article 15(1) GDPR Article 58(2)(i) GDPR Article 82 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 07.09.2023 |
| Decided: | 07.01.2025 |
| Published: | |
| Fine: | €3,000 |
| Parties: | n/a |
| National Case Number/Name: | 04/2025 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Apostolos Karasakalidis |
The DPA investigated a complaint concerning a breach of the right of access to personal data including recorded conversations concerning the complaint against a loan and credit management company. Subsequently, it issued a fine.
English Summary
Facts
A credit consumer, the data subject, lodged a complaint with the Greek Data Protection Authority (DPA) against a loan and credit management company, a controller. The data subject asked the controller to provide him with a copy of the recorded conversations he had with the controller's employees, as well as to inform him of any personal data concerning him that are being processed and kept in the controller’s record.
The data subject claimed that the controller did not satisfy any of the requests appropriately, as he was asked to receive the copies in person from the controller’s offices, even though he had notified that he was living abroad, and the controller’s response regarding which personal data were being processed was not concrete and full.
In its defense, the controller claimed that it had sent a letter to the data subject’s registered postal address, stating which recorded conversations are kept in its records, and inviting him to receive them in person. Within the controller’s policy, there was an exception for those residing abroad, enabling them to obtain copies of the recorded conversations via courier or, exceptionally, via e-mail after a phone call with the controller’s representatives.
Holding
First, the DPA found that the controller did not, in a timely manner, inform the data subject of all his personal data that were being processed, thereby violating Article 15(1) GDPR in conjunction with Article 12(3) GDPR. Taking into account Article 58(2)(i) and Article 82 GDPR, the DPA imposed a €1,000 fine on the controller.
Second, the DPA imposed an additional fine of €2,000 on the controller because it held that the latter provided copies of the recorded conversations to the data subject past due, and only after the examination procedure before the Authority, which constituted a violation of Article 15(1) GDPR, together with Article 12(2) GDPR and Article 12(3) GDPR.
Finally, the DPA held that the controller’s current terms of access to recorded conversations violated Article 12(2) GDPR and ordered the controller to change its policy within 30 days of notification of the present decision to facilitate access to such recordings in the simplest possible way, as a rule, not an exception.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 07-01-2025 No. Prot.:41 Decision 4/2025 (Single-member Body) The President of the Authority, as a single-member body pursuant to article 17 par. 1 of law 4624/2019 (Government Gazette A' 137), within the framework of the responsibilities provided for in articles 4 par. 3 and 10 par. 4 of the Regulation of Operation of the Authority (Government Gazette B'879/25.02.2022), met via teleconference on 3 -10-2024 in order to examine the case referred to below in the history of this decision. Present without the right to vote was Kyriaki Karakasi, legal auditor-attorney, as well as Irini Papageorgopoulou, employee of the administrative affairs department, as secretary. The Authority took into consideration the following: The complaint under no. Γ/ΕΙΣ/6285/07-09-2023 of A was submitted to the Data Protection Authority, along with the attached and supplementary information (see the complainant's email message under no. Γ/ΕΙΣ/8666/06-12-2023, notified simultaneously to the complainant company), according to which the latter requested from the company under the name "doValue Greece S.A., a company for the management of claims from loans and credits", on ..., to send him copies of the recorded conversations that he had with representatives of the said company and that concerned him, while he also requested to take note of his personal data kept in its file as above complainant. According to the complaints, his above requests have not been satisfactorily answered by the above company, as, with the message from … Kifissias Avenue 1-3, 11523 Athens, Tel: 210 6475600, Fax: 210 6475628, contact@dpa.gr / www.dpa.grthe latter to the complainant, on the one hand, the applicant was required to appear in person at the company's headquarters in order to receive the requested copies of the recorded conversations in question, on the other hand, the request regarding the information on the complainant's personal data held by the company was answered vaguely. It is alleged that the company in question refused to provide the complainant with remote access to his requested personal data by telephone. The Authority, in the context of examining the above complaint, with its document no. Γ/ΕΞ/3106/05-12-2023, forwarded the disputed complaint to the said company, requesting the latter to clarify whether the complainant exercised, as he claims, the right to access data concerning him and to which specifically, as well as whether and in what way the company responded to the complainant's aforementioned request or for what reason it did not satisfy it within the deadline, and to attach the relevant documents at the same time. In addition, clarifications were requested on the issue of whether the conversations in question have been recorded by the company in question, and if so, on what legal basis. Finally, the company was asked to clarify whether and by what procedure it satisfies access requests, taking into particular account Article 12, paragraph 2 of the GDPR, according to which “The controller shall facilitate the exercise of the rights of data subjects provided for in Articles 15 to 22. …”. Following this, the company complained about sent the response document with no. prot. C/ΕΙΣ/9034/20- 12-2023, with which, among other things, it confirmed that the complainant’s right of access in question had been exercised by … before it. It also stated that it sent to the complainant's postal address, which was registered in the company's management system, the letter dated … informing the latter that the relevant archive of recorded conversations for the period from … to … has been extracted from its systems and is available for collection from the company's offices. The above letter also provided a list of the complainant's personal data being processed. In the context of the above response of the respondent to the Authority, the process of satisfying the relevant requests for access to copies of recorded conversations of its customers is described in detail in cases where the latter are unable to come to its premises to receive the files exported by the company. In particular, it is noted that in those exceptional cases where the applicant is a resident abroad, the respondent sends the file with the recorded conversations to the mailing address declared by the debtor via courier, while in the event that the debtor wishes to have the said conversations sent to him via electronic mail, a special procedure is followed in the context of which the debtor is required to contact the company by telephone in order to receive the special key code that will allow him to access the file, which will be received via a separate e-mail. Subsequently, the company states that the complainant returned the above request for access to … by submitting it via the company website and in response to this he received the e-mail from …, to which the complainant attached the above letter from … that she had sent to him by post, informing him that his request from … has been granted and inviting him to contact the company’s call centre again in order to set an appointment to receive the recorded calls. Furthermore, the company states that on …, the complainant, in the context of a telephone conversation with a representative of the company, requested other documents concerning him, which he sent to him via the e-mail from …. Furthermore, it is noted that with the e-mails dated … and … the complainant informed the company that he resides abroad and that his postal address registered in the company system is not valid, requesting that the latter be deleted, while he requested, according to the complainant, some other clarifications regarding his personal data. The company claims to have responded to the above with its e-mail dated … to the complainant. Following this, the Authority summoned the complained company and the complainant to a hearing before the President of the Authority as a single-person body via videoconference, with the no. Prot. C/ΕΣΕ/2573/23-09- 2024 Call. Prot. C/ΕΣΕ/2572/23-09-2024 Summary of the complainant on 03-10-2024, date on which, the complainant appeared in person, and the respondent appeared and developed her views through her lawyer, Maria Androulakis (AM/DSA …), while B as Head of the Complaints Department, C as a specialist in personal data protection issues and D as Data Protection Officer were present on behalf of the same above-mentioned respondent to provide clarifications where deemed appropriate during the discussion. Furthermore, after the hearing in question, both parties were granted a deadline to submit a memorandum in further support of their claims until 11-10-2024. Subsequently, the company complained about submitted, within the deadline, namely on 11-10-2024, its memorandum with no. prot. C/ΕΙΣ/7896/14-10-2024, together with the documents attached to it, in which it cites, among other things, the following in summary: First of all, it confirms the exercise of the complainant's disputed access requests both to the recorded conversations that concerned him and to his personal data that are processed by the company complained about. Furthermore, it largely repeats the allegations it made in the above-mentioned memorandum with no. Prot. C/ΕΙΣ/9034/20-12-2023 its response to the Authority in addition, stating that the letter of … of the respondent in response to the complainant, was sent to the latter's email address, since, as the respondent accepts, it became possible to identify him through the other information it had about him. Similarly, the respondent company argues that with its email of … it again provided the complainant's personal data that are registered in the company's systems, pointed out the need to update his information and invited him again to receive the archive of recorded calls without the company's claiming that the latter could not be identified. Furthermore, the defendant reports that the complainant did not update the data, although he had been requested to do so, according to the company's allegations, while it is noted that the complainant insisted on being granted remote access to the data in the file "refusing to discuss any alternatives". Furthermore, the defendant company is repeating the internal process of satisfying requests for access to its customers' recorded conversations, also reinstating the alternative of sending them via email for the exceptional cases in which the complainant is unable to come to the company's premises to receive them and has requested that they be provided to him electronically. The complainant then states that after the examination of the case in court, the Data Protection Officer of the company tried to contact the complainant 4 times by telephone in order to ascertain whether there was any pending request of his, but the complainant did not answer the calls and as it was not possible to locate any proof of electronic sending of the disputed recorded conversations to the complainant, she sent them to the latter by the email from …, as presented to the Authority, noting at the same time that the complainant had to contact the Data Protection Officer of the company in order to grant him the key code for opening the relevant files, in accordance with the relevant provisions of the aforementioned internal corporate policy. Finally, the defendant states that it has provided explicit instructions to its representatives so that the latter can explicitly and promptly inform the applicants about alternative ways of receiving calls in exceptional cases where there are reasons that preclude their receipt in person at the corporate headquarters. The complainant submitted his memorandum with the no. prot. C/ΕΙΣ/7682/06-10-2024 within the deadline, in which he briefly states, among other things, the following: First, he states that, in an aside during the hearing before the Authority, he admitted that he had received the requested recorded conversations, a fact that had not taken place until the discussion before the Authority. Furthermore, he points out that he had sent the disputed access request to the company by electronic means (email), requesting to be informed in the same way and notifying that he resides abroad, while he claims that there was no dispute on the part of the company regarding his identity or regarding the request that was submitted electronically. The Authority, having taken into account the above, HAS DECIDED IN ACCORDANCE WITH THE LAW 1. Since it follows from the provisions of Articles 51 and 55 of the General Data Protection Regulation (Regulation (EU) 2016/679 – hereinafter, GDPR) and Article 9 of Law 4624/2019 (Government Gazette 137) that the Authority has the competence to supervise the implementation of the provisions of the GDPR, this Law and other regulations concerning the protection of individuals from the processing of personal data. Article 5 para. 1 of the GDPR sets out the principles that must govern processing. According to the principle of accountability introduced by the said article, it is stipulated in paragraph 2 thereof that the controller “shall be responsible for and able to demonstrate compliance with paragraph 1 (“accountability”)”. As the Authority has judged, the GDPR adopted a new compliance model, the central point of which is the principle of accountability within the framework of which the controller is obliged to design, implement and generally take the necessary measures and policies in order for the processing of data to be in accordance with the relevant legislative provisions. In addition, the controller is burdened with the further duty to demonstrate himself and at all times his compliance with the principles of Article 5 par. 1 GDPR. 2. Because according to article 15 par. 1, 3 and 4 of the GDPR “1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and to the following information: a) the purposes of the processing, b) the categories of personal data concerned, c) the recipients or categories of recipients to whom the personal data have been or are to be disclosed, in particular recipients in third countries or international organisations, d) if possible, the period for which the personal data will be stored or, where that is not possible, the criteria determining that period, e) the existence of the right to request the controller to rectify or erase personal data or to restrict the processing of personal data concerning the data subject or to object to such processing, (f) the right to lodge a complaint with a supervisory authority, (g) where the personal data are not collected from the data subject, any available information on their origin, (h) the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, meaningful information on the logic involved, as well as the significance and envisaged consequences of such processing for the data subject. 2. […] 3. The controller shall provide a copy of the personal data being processed. […] If the data subject submits the request by electronic means and unless the data subject requests otherwise, the information shall be provided in a commonly used electronic format. 4. The right to a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. These provisions establish the right of access to personal data concerning him or her. In the context of this right, the data subject must, on the one hand, have access to personal data collected and concerning him or her in order to ascertain the accuracy and nature of the processing of his or her data and to verify the lawfulness of the processing, and, on the other hand, be able to exercise that right easily and at reasonable regular intervals. The controller must provide remote access to a secure system through which the data subject can access the data concerning him or her directly. 3 Furthermore, the Authority firmly accepts that the data subject has the right to know whether personal data concerning him or her are being processed, and to obtain information about them, without the need to invoke a legitimate 4 interest, since this is inherent and constitutes the basis of the right of access, i.e. the right of the data subject to obtain information concerning him or her that has been recorded in a file kept by the controller, thus implementing the basic principle of the law on the protection of personal data, which consists in the transparency of the processing as a prerequisite for any further control by the data subject of its legitimacy. Similarly, it is not required to state the reasons why the data subject wishes to exercise the right of access. Moreover, the obligation to satisfy the right 2 See recital 63 of the GDPR. 3See also recital 63 of the GDPR and Decisions of the Authority 23/2020, 22/2023. 4See in particular, Decisions of the Authority 22/2023, 32/2019, 144/2017 195/2014 193/2014 and 75/2011, available on the Authority's website. 5See indicatively Decisions of the Authority 2/2020, 23/2020, 16/2017, 98/2014, 149/2014, 72/2013 and 71/2013. 6 See EDPB, Guidelines 01/2022 on data subjects’ rights – Right of access, Version 2.0, adopted on 28 March 2023, Chapter 61, para. 167, p. 52, https://edpb.europa.eu/system/files/2023- 04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf. 7access is universal, that is, it concerns all information concerning the data subject and, moreover, it does not depend on the invocation of the grounds for exercising the right. Consequently, the satisfaction of the right does not depend on a prior judgment of the controller as to whether or not the exercise of the right is justified. Furthermore, with regard to determining the scope of the limits of a data subject's right of access to his or her personal data, access is understood as extending to the personal data themselves, without a general description of the said data or a simple reference to the categories of personal data processed by the controller being sufficient. Therefore, data subjects have the right to access all data that are processed and that concern them, unless limits or restrictions are specifically provided for in the GDPR (see Articles 12(5), 15(4), 23, 89(2) and (3), 85(2) of the GDPR). Finally, it is noted in this regard that unless the data subject explicitly requests otherwise, the request to exercise the right of access is understood as general and includes all personal data concerning the data subject in question. 9 3. Since, according to Article 12 GDPR “1. The controller shall take appropriate measures to provide the data subject […] with any communication in the framework of Articles 15 to 22[…] 2. The controller shall facilitate the exercise of the rights of data subjects set out in Articles 15 […] 3. The controller shall provide the data subject with information on the action taken on a request pursuant to Articles 15 to 22 without delay and in any event within one month of receipt of the request. That period may be extended by two further months, if necessary, 7See Authority Decision 16/2017. 8See regarding Decision of the Authority 1/2005, by which it was held that the controller must respond to the data subject's access request without vagueness and evasion invoking reasons unrelated to the civil satisfaction of the right of access. See also Decision of the 9th Authority 16/2017. For the above, see analysis in No. 01/2022 EDPB Guidelines on the rights of data subjects – Right of access, Version 2.1, 28 March 2023, (https://www.edpb.europa.eu/system/files/2024- 04/edpb_guidelines_202201_data_subject_rights_access_v2_el.pdf) and in particular see chapters 2.2.1.2 and 2.3.1. respectively (pp. 15 and 20). 8taking into account the complexity of the request and the number of requests. The controller shall inform the data subject of such extension within one month of receipt of the request, as well as of the reasons for the delay. If the data subject submits the request by electronic means, the information shall be provided, if possible, by electronic means, unless the data subject requests otherwise. 4. If the controller does not act on the data subject's request, the controller shall inform the data subject, without delay and at the latest within one month of receipt of the request, of the reasons for not acting and of the possibility of lodging a complaint with a supervisory authority and of seeking a judicial redress.». Furthermore, in accordance with paragraphs 1 and 2 of Article 24 of the GDPR:«1. Taking into account the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and be able to demonstrate that the processing is carried out in accordance with this Regulation. Those measures shall be reviewed and updated when necessary. 2. Where justified by the processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller. 4. Because in the above-mentioned case, it appears from the information in the file that the complainant exercised before the accused controller appropriately and clearly already on … the right of access to the personal data concerning him. The said request, to the extent that it did not impose any restriction, occupied all of the personal data held by the complainant company as controller for the complainant, and rather, since, as is apparent from all of the information in the case file (see, for example, the document of the complainant to the Authority dated 19-12-2023), the complainant managed a single consumer credit loan agreement, the volume of the personal data held for him could not, by object, be large. Therefore, the complainant's request in the way in which it was formulated also included the copy of the agreement held by the complainant and which the company reasonably had at the time of its submission of the complainant's initial request. However, the respondent sent the said information to the complainant with the email from …, and since there was a relevant telephone communication with the complainant (see the relevant email from … of the company being complained about to the complainant submitted to the Authority), and in any case not with its first response from … (sent via email to the complainant on …) to the disputed access request. With these data, it appears that the request from … was not properly satisfied with the above first response of the respondent, because this response did not include all of the personal data relating to the complainant since the said copy of the contract had not been sent and, therefore, the right of access of Article 15 of the GDPR in conjunction with the provision of Article 12, paragraph 3 of the GDPR was violated, to the extent that the complainant was satisfied with the above copy of the contract out of time. 5. Because as regards the recorded conversations also requested by … that the complainant had with representatives of the respondent, it does not appear from the information in the file that this part of the exercised right of access has been satisfied, except by sending them after the hearing of the parties before the Authority by an e-mail sent to the complainant on … (as presented before the Authority). And although in the context of the hearing the complainant stated that the recorded conversations he requested had been sent to him, however, in his memorandum with No. Prot. C/ΕΙΣ/7682/06-10-2024 he clarified that the said report was incorrect and that the disputed calls had never been sent until the hearing. The company complained about in the aforementioned e-mail message from …, which was presented before the Authority, does not prove the sending but, on the contrary, accepts that it did not find any proof of receipt of the said recorded conversations. In particular, in the company’s initial response from …, which seems to have come to the attention of the complainant with the e-mail message from … of the complainant, according to the above, the latter informed the complainant that a file with the requested recorded conversations that concerned him is available and that he should contact its 10telephone center to set an appointment, in order to collect it from the company’s premises. However, the information in the file shows that the complainant, by e-mail dated ..., requested that his postal address registered in the company's system be deleted because he was now residing abroad and, consequently, the company knew at least from the receipt of this e-mail that the complainant was a resident of abroad and therefore that there was an objective obstacle to receiving in person the electronically requested conversations. Furthermore, the complainant, by e-mail dated ..., sent to the respondent, explicitly requested that the above request be satisfied remotely. However, it did not receive the requested calls even with the next response from the accused (see the relevant submitted e-mail message). Notwithstanding this, the policy for satisfying corresponding requests described in the accused's response to the Authority includes the exceptional sending of recorded conversations to customers via e-mail upon their request (see page 3 of the accused's views contained in its response to the Authority under No. Prot. C/ΕΙΣ/9034/20-12-2023 as well as the relevant internal policy submitted by the accused with its post-hearing memorandum under No. Prot. C/ΕΙΣ/7896/14-10-2024). Besides, in the same way, namely by e-mail, the company had also sent other personal data of the complainant to the latter, while, as both parties involved confirm, there had been prior telephone communications between them, without ever actually raising the issue of disputing the identity of the complainant requesting access. In particular, the complained company states that it was possible to identify the complainant through the other -except for the postal address- identification data that it recorded in his request dated … and therefore sent its letter dated … to his electronic address, while on … it sent a new electronic letter to the complainant, attaching contractual and other documents that the complainant had requested and indicating, as it claims, to the latter the need to update his data that were incorrect or inaccurate (see pages 2 and 3 of the post-hearing memorandum of the complained company). Therefore, with the above data, based on the relevant procedure provided for exceptional cases 11with its aforementioned policy, in view of article 12 par. 3 sub. b’ of the GDPR, according to which when the data subject submits the request by electronic means, the information is also provided in electronic form, the company, regardless of the update of the complainant’s data to the extent that a relevant legal obligation arose, was obliged to satisfy the complainant’s request for access to the recorded conversations concerning him by sending him, as he had expressly requested, a relevant email message at least by …, the date on which it became aware of the fact that the complainant resided abroad and while the latter had been previously identified. Therefore, it follows from the above that the respondent violated the complainant's right to access the recorded conversations concerning him, since she did not send them on time and in the manner desired by the complainant, which was also dictated by the relevant policy of the company, while in this way she also created a difficulty in satisfying the complainant's right, as is apparent from the above detailed history, in violation of Article 12, paragraph 2, of the GDPR. 6. Since the controller must always be able to demonstrate that the way in which the right of access under Article 15 of the GDPR is handled by the data subject is intended to give the widest possible effect to that right and that it is consistent with its obligation under the aforementioned provisions of Article 12 of the GDPR to facilitate the exercise of the rights of data subjects. Furthermore, regarding the form in which the controller should provide a response to the data subject's exercise of the right of access, Article 15(3) of the GDPR, as noted above, provides that if the data subject submits the request by electronic means, the information shall be provided in a commonly used electronic format, unless the data subject requests otherwise. In order to determine the format that should be considered commonly used in a given case, the controller should assess whether there are specific formats that are generally used in the controller's sector of activity or in the given context. When assessing whether a format is a commonly used electronic format, the European Data Protection Board considers it important that the individual can easily access the requested information provided in the current format. However, it appears from the policy of the company complained about that there is generally a difficulty in satisfying the right of access to the recorded conversations of the data subjects, insofar as the rule is the transfer of the latter to the company's premises and only exceptionally are other methods applied that make it easier for the data subjects exercising the right of access, such as by sending them by email (see the submitted internal policy of the company complained about). Therefore, regardless of the inappropriate, in the light of the facts of the specific case, satisfaction of the right of access, which the complainant exercised, as mentioned in the previous considerations, the procedure defined by the internal policy of the company complained of does not ensure the satisfaction of the relevant rights of access to recorded conversations in principle in the simplest possible manner, because this procedure creates a difficulty for the data subjects and therefore the relevant policy needs to be amended so that the simplest satisfaction for the data subjects becomes the rule and not the exception. 7. Since, according to what is mentioned in the previous considerations, on the one hand, there is an improper satisfaction of the right of access with regard to the data that concerned the complainant, in the measure of the letter from… and the first response of the complainant to the relevant exercised right of access, the total of the complainant’s personal data was not included (see above paragraph 4), on the other hand there is a violation of the complainant’s right of access (article 15 of the GDPR) with regard to the recorded conversations concerning him, since the company complained of sent them late in the manner desired by the complainant and dictated by the relevant corporate policy and already after the hearing before the Authority, in violation of Article 12(2) and (3) of the GDPR (see paragraph 5 above). It is considered that the relevant internal policy on the satisfaction of access rights to recorded conversations needs to be amended so that the satisfaction of the right to access rights becomes the rule and not the exception 10See in this regard 01/2022 EDPB Guidelines on the rights of data subjects – Right of access, Version 2.1, 28 March 2023, (https://www.edpb.europa.eu/system/files/2024- 04/edpb_guidelines_202201_data_subject_rights_access_v2_el.pdf) and in particular see chapters 2.3.1 and 5.2.5. (pp. 22 and 62). 13 of the relevant rights of data subjects in the simplest possible way, namely in principle remotely (see above paragraph 6). 8. Whereas according to the GDPR (App. Sk. 148) in order to strengthen the enforcement of the rules of this Regulation, sanctions, including administrative fines, should be imposed for any infringement of the Regulation, in addition to or instead of the appropriate measures imposed by the supervisory authority in accordance with this Regulation. 9. Given that, based on the above, the Authority considers that it is appropriate to exercise its corrective powers under Article 58, paragraph 2 of the GDPR in relation to the established violations and that, based on the circumstances established, effective, proportionate and dissuasive administrative fines under Article 83 of the GDPR should be imposed, in accordance with the provision of Article 58, paragraph 2, subparagraph i’ of the GDPR, both to restore compliance and to punish illegal conduct. The Authority further took into account the criteria for measuring fines set out in Article 83, paragraph 2 of the GDPR and paragraph 5, subparagraph b’ of the same article which are applicable to the present case, the Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679 issued on 03-10-2017 by the Article 29 Working Party (WP 253) and the Guidelines 04/2022 of the European Data Protection Board on the calculation of administrative fines in the context of the General Regulation, as well as the actual facts of the case under consideration and in particular the criteria set out below, as well as the fact that another complaint had been submitted to the Authority against the complainant, prior to the one under consideration, for a violation of a data subject’s right, following which the Authority had addressed the company to 06-07-2023 document (see the document with no. C/ΕΕΣ/1730/2023), with which by weighing the corresponding facts, it had drawn the attention of the latter, so that it satisfies, within the deadlines provided for in article 12 par. 3 of the GDPR the rights of the data subjects, taking the appropriate technical and organizational security measures and demonstrating due attention to the utilization of the contact details provided by the complainant's customers. 14A. For the violation of the provisions of articles 15 par. 1 of the GDPR in conjunction with the provisions of paragraphs 3 of article 12 of the GDPR regarding the inappropriate and, specifically, the late satisfaction of the right of access with regard to the data concerning the complainant, to the extent that the letter dated … and the first response of the complainant to the relevant exercised right of access, did not include all of the complainant's personal data i. The fact that the defendant delayed, as explained in detail above, the right of access exercised by the complainant under Article 15, paragraph 1 of the GDPR regarding the provision of a copy of his loan agreement and after further relevant telephone consultation with representatives of the company being complained about ii. The fact that none of the complainant's requested personal data appears to include special categories of personal data iii. The fact that the infringement in this case affected one (1) natural person as a subject of personal data in relation to the satisfaction of the right of access. iv. The fact that no fraud on the part of the company being complained about is proven for the above-mentioned infringement. v. The fact that from the information brought to the attention of the Authority and based on which it established the violation of the GDPR, the controller did not derive any financial benefit, nor did it cause material damage to the complainant. vi. The fact that the violation of the provisions relating to the rights of subjects falls, in accordance with the provisions of Article 83, paragraph 5, subparagraph b’ GDPR, into the highest category provided for in the grading system of administrative fines. vii. The turnover of the company complained about as shown by the documents submitted by the complainant for the year 2023. B. For the violation of the provisions of articles 15 in conjunction with paragraphs 2 and 3 of article 12 of the GDPR regarding access to the recorded conversations that 15 concerned the complainant, who falls under the category of sub-paragraph b of paragraph 5 of article 83 of the GDPR regarding the grading system of administrative fines: i. The fact that the respondent did not satisfy the right of access that the complainant exercised pursuant to Article 15, paragraph 1 of the GDPR to the recorded conversations that concerned him, only after the hearing that took place before the Authority and therefore the non-satisfaction took on a continuing nature exceeding one year. ii. The fact that none of the requested personal data of the complainant appears to include special categories of personal data. iii. The fact that the infringement in this case affected one (1) natural person as the subject of the personal data in relation to the satisfaction of the right of access. iv. The fact that the respondent is not proven to have acted fraudulently for the above committed infringement. v. The fact that from the information brought to the attention of the Authority and based on which it established the violation of the GDPR, the controller did not derive any financial benefit, nor did it cause material damage to the complainant. vi. The fact that the violation of the provisions relating to the rights of subjects falls, in accordance with the provisions of Article 83, paragraph 5, subparagraph b, of the GDPR, into the higher category of the administrative fines grading system. vii. The turnover of the company complained about as shown by the relevant documents submitted by the complainant for the fiscal year 2023. 10. Because based on the above, the Authority decides to impose on the company complained about as controller the administrative sanctions referred to in the operative part, which consist not only of fines but also of other appropriate measures, as the above are judged according to the gravity of the violations. 16 FOR THESE REASONS The Authority a) Considers that the company complained of violated Article 15, paragraph 1 of the GDPR in conjunction with the provision of paragraph 3 of Article 12 of the GDPR as it proceeded in an inappropriate and specifically late satisfaction of the right of access with regard to the data concerning the complainant, as referred to in paragraphs 4 and 7, and imposes an administrative fine of one thousand (1,000.00€) euros for this violation, in accordance with Article 58, paragraph 2, item 9 GDPR b) It finds that the company complained of violated the right of access of the complainant (Article 15 of the GDPR) with regard to the recorded conversations that concern him, since it sent them in the manner desired by the complainant and dictated by the relevant corporate policy, in a timely manner, and in particular after the hearing before the Authority, in violation of Article 12, paragraphs 2 and 3 of the GDPR, as referred to in paragraphs 5 and 7, and imposes an administrative fine of two thousand (€2,000.00) euros for this violation, in accordance with Article 58, paragraph 2, item i' GDPR c) It considers that the company's internal policy regarding the manner of satisfying the right of access to recorded conversations violates the provision of Article 12, paragraph 2 of the GDPR, as explained in detail in paragraph 6 of this and therefore directs the company complained about to amend the said internal policy within thirty (30) days from the notification of this, so that the simplest possible satisfaction for the data subjects becomes the rule and not the exception and to subsequently inform the Authority of its actions. In any case, the Authority reserves the right to re-examine the case and in particular the entire practice followed by the company complained about, in particular in the event that the Authority examines more related complaints. The President The Secretary Konstantinos Menudakos Irene Papageorgopoulou 17
