HDPA (Greece) - 2/2026
From GDPRhub
| HDPA - 2/2026 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 12 GDPR Article 15 GDPR Article 18 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 23.01.2023 |
| Decided: | 11.02.2026 |
| Published: | 11.02.2026 |
| Fine: | 30,000 EUR |
| Parties: | Vodafone – ΠΑΝΑΦΟΝ Ανώνυμη Ελληνική Εταιρεία Τηλεπικοινωνιών |
| National Case Number/Name: | 2/2026 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | n/a |
The DPA fined a telecommunications provider €30,000 for violating transparency obligations, citing lack of clear information provided to the data subject, failure to grant full access to recorded calls, and failure to respect the data subject’s right to restrict processing.
English Summary
Facts
A data subject filed a complaint against Vodafone – Panafon S.A., a telecommunications provider (the controller), with the Greek Data Protection Authority (HDPA).
She had submitted three access requests seeking all recorded phone calls concerning a technical fault she had reported. The first two requests were rejected by the controller as vague, and the third request was only partially satisfied; some recordings were provided, but not all requested calls, and the controller did not inform her within one month about deficiencies in her request or the reasons for not fully complying.
The data subject also alleged that the controller obstructed the exercise of the right of access to the recorded conversations in question, resulting in some of them being deleted because the prescribed retention period had expired, a risk which, as alleged, had been pointed out to the controller. In particular, she requested restriction of processing to prevent deletion of recordings after the one-year retention period, but the controller did not properly address this request.
Furthermore, the controller provided misleading information through a representative regarding the manner of exercising or satisfying customers' right of access to recorded conversations concerning them.
Holding
The HPDA upheld the complaint and imposed an administrative fine of €30,000. It also ordered the controller to adopt appropriate technical and organizational measures and improve staff training, with proof of compliance within six months.
Specifically, it held that the controller violated Article 12(1), (2), (3), and (4) GDPR, because it failed to inform the data subject within one month of the deficiencies in the application, effectively prevented the exercise of the right and provided contradictory information, amounts to lack of transparency.
Moreover, it argued that the controller breached Article 15 GDPR by failing to provide full access to all requested recorded conversations and Article 18 GDPR by not honoring the request to restrict processing, which would have prevented the calls from being deleted before the request was reviewed.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 11-02-2026 No. Prot.: 780 DECISION 2/2026 (Department) The Personal Data Protection Authority met in a Department composition via teleconference on 04-02-2026 following an invitation from its acting Deputy President, in order to examine the case referred to in the history of this case. Present were Georgios Batzalexis, Deputy Chairman, the alternate member, Maria Psalla as rapporteur, replacing the regular member, Grigoriou Tsolias, who, although he had been legally invited in writing, was absent due to an impediment, and the alternate member, Demosthenis Vougioukas, replacing the regular member, Konstantinos Lambrinoudakis, who, although he had been legally invited in writing, was absent due to an impediment. The meeting was attended, by order of the Chairman, by Kyriaki Karakasi, legal auditor - lawyer, as assistant rapporteur and Irini Papageorgopoulou, employee of the Administrative Affairs Department of the Authority, as secretary. The Authority took into account the following: In the context of its no. prot. C/ΕΙΣ/498/23-01-2023 complaint submitted by A through her power of attorney, Danae Novak, it is stated that requests were submitted on her behalf to the company named "Vodafone - PANAFON Hellenic Telecommunications Company" dated 07-09-2022, 20-09-2022 and 22-11-2022, in order to grant her all the recorded conversations that concern her and are related to a technical failure that she reported to the said company and which were received by her. 1-3 Kifissias Ave., 11523 Athens, Tel: 210 6475600, Fax: 210 6475628, contact@dpa.gr / www.dpa.grcountry from 10-11-2021 and from there to and from the telephone numbers listed in her aforementioned requests, as submitted to the Authority. According to the allegations, the first two requests were rejected as indefinite, while the third was partially satisfied, to the extent that only some of the aforementioned requested conversations were granted to the complainant by the said company. Furthermore, the complainant claims that in this case the complained company posed obstacles to the exercise of the right of access to the disputed recorded conversations, resulting in some of them being deleted due to the expiry of the stipulated retention period, a risk that, as alleged, was pointed out to the complainant. In particular, in one of the elements of the case file, namely the email message dated 10-11-2022 sent by the complainant to a representative of the company in question, reference is made to the dispute resolution request numbered …, submitted by the complainant, requesting the respondent to retain the file beyond the year until the processing of her request, since some files were at risk of being deleted due to the completion of the year from 10-11-2021 to 10-11-2022 from the timely processing of her request. Finally, the complainant also complains about misleading information provided by the respondent’s representative regarding the manner of exercising/satisfying the right of access of customers to recorded conversations that concern them. The Authority, in the context of examining the above complaint, with the no. prot. G/EX/762/29-03-2023 document, requested clarifications from the company in question on the complainants, focusing first on whether and in what manner the complainant responded to the above requests of the complainant or for what reason the requested information was not provided to her within the deadline, requesting that any replies of the company be attached. Furthermore, the Authority requested clarifications regarding the subject of the conversations in question with the complainant, whether it has recorded them, and if it has, on what legal basis and for how long it keeps them, and finally, clarifications were requested regarding the company's policy regarding the recording of conversations with its customers, and in particular, which calls (e.g. outgoing from the company or incoming to it) and by what procedure they are recorded, for how long they are stored, as well as whether and by what procedure 2requests for access to them are satisfied. Following the request of the complainant with no. Prot. C/ΕΙΣ/2703/12-04-2023 for an extension of the deadline for providing clarifications set by the Authority, the latter responded with its document no. prot. C/ΕΙΣ/3122/28-04-2023, which was also granted to the complainant following her relevant request (see no. prot. C/ΖΕ/1664/28-06-2023 document of the Authority). In this document, the complainant states, among other things, that the aforementioned request of the complainant dated 07-09-2022 was received by the competent corporate department on 09-09-2022, at which time it was discovered that the relevant form had been incorrectly completed, insofar as the complainant's postal address or email address for sending the copy of the recorded calls had not been completed, at which time the company branch contacted the complainant by telephone to inform her of the need to resubmit the relevant requests. Subsequently, the complainant states that the competent corporate department received on 23-09-2022 the new requests of the complainant from 20-09-2022 and found that the time period of the calls in question was not specified precisely in order to identify them systematically. It is noted that on 23-09-2022 the branch was notified of the need to specify the request. Furthermore, it is noted that on 08- 11-2022 a representative of the company contacted the complainant's representative by telephone in order to inform her that the time period of the calls was not specified precisely, calling on her to specify it. The complainant states that the complainant submitted the above mentioned requests on 22-11-2022, indicating the dates and times of the calls she requested. The last request was received by the competent corporate department on 25-11-2022 and on 28-11-2022, eighteen recorded conversations were retrieved that were located in the corporate systems for the period from 25-11-2021 to 31-12-2021 and were sent in an encrypted file to the email that the complainant had stated in her request. In addition, the complainant clarifies that the subject of the disputed recorded conversations was related to technical problems with fixed telephony and internet regarding two of the complainant's fixed telephony connections, as the above information results from the relevant records in the complainant's information system, which indicate the details of the 3 calls and in particular the date, time and subject of the latter. Furthermore, the company complained about lists the types of outgoing calls that are recorded, while noting that in compliance with the relevant ADAE Regulation they now proceed to record all incoming calls, which they retain for twelve months from the date of their occurrence. The company complained about then refers to the legal bases for recording conversations with its customers, namely that of Article 6, paragraph 1, subparagraph c’ of the GDPR for requests related to access to communication data and that of Article 6, paragraph 1, subparagraph f’ of the GDPR for proving the existence and content of a specific conversation of a professional nature. Finally, the company complained about reiterates the claim that the complainant's requests dated 07-09-2022 and 20-09-2022 were incorrect or incomplete, emphasizing that they informed her accordingly, while claiming that it responded in a timely manner to the access request dated 25-11-2022 by granting eighteen calls that it identified in its corporate system. Following the above response, the Authority needed further clarifications in the context of examining the case in question and therefore sent the no. Prot. C/ΕΣΕ/2798/06-11-2023 document, in which it called on the respondent to determine the reasons for which it requested on 23-09-2022 further specification of the time period during which the conversations in question took place, given that the complainant stated that she was seeking access to recorded conversations that concerned her and took place from 10-11-2021 onwards, as well as the reasons for which she did not retain all of the requested conversations since then (i.e. from 23-09-2022), since at that time the 12-month period provided for by the policy of preserving telephone conversations from 10-11-2021 onwards had not yet elapsed, until the completion requested by the complainant. Furthermore, the Authority requested clarifications as to whether the complainant had the systemic ability to identify the requested calls from 10-11-2021 onwards without any further specialization on the part of the complainant, as well as whether there is a regulatory obligation based on which the preservation of recorded conversations beyond a specific period of time is prohibited. The complainant company sent the no. Prot. C/ΕΙΣ/8255/20-11-2023 its response, in the context of which it states, among other things, that the specialization that 4it requested on 23-09-2022 from the complainant regarding the period for which she requested the recorded conversations concerning her, was necessary due to the systemic difficulty it faced in finding calls for a period of ten (10) months, especially since some calls may have been made by external call centers collaborating with the complainant. Furthermore, the respondent confirms that it granted the complainant eighteen (18) calls that were identified in its systems and related to the time period from 25-11-2021 to 31-12-2021, while stating that no calls were identified before 25-11-2021, because the complainant's disputed request was received by the competent department on 25-11-2022. Finally, the respondent company invokes the no. 253/2022 ADAE Decision “Regulation on the adoption of security measures when serving requests from subscribers or users related to access to communication data”, according to article 3.5 of which it is stipulated that the provider retains the content of the telephone communication with the subscriber for serving the said requests for a period of one year, without prejudice to any obligation to retain it for a longer period, if provided for by other provisions of the applicable legislation. Subsequently, by document no. Prot.C/EIS/8273/21-11-2023, the complainant submitted some additional information by e-mail that was sent simultaneously to the complainant. With her above supplementary document, the complainant reiterates the above facts, noting, among other things, that she never received copies of the recorded conversations that concerned her for the period from 10-11-2021 to 25-11-2021, while she has not been granted all the calls for the period from 26-11-2021 onwards. It is reported that on 28-11-2022 and 29-11-2022 she complained about this to the company complained about via email, without receiving any response. The Authority called with the no. Prot. C/EXE/2004/06-06-2025 and C/EXE/2006/06-06- 2025 summons both parties to a hearing, via videoconference, so that they can be heard at the meeting of the Department of the Authority dated 18-06-2025. At the aforementioned meeting the complainant was represented by her attorney, Danae - Eleni Novak, attorney (AM DS …), and the respondent by her attorneys Emmanouil Demogerontakis (AM DS …), Xenophontos Kritikou (AM DS …) and Konstantina Karopoulou 5 (AM DS …), while B, Data Protection Officer of the complained company, was also present, in case further clarifications were needed. However, the complainant's attorney, Danae - Eleni Novak, submitted a request to postpone the case hearing due to her illness. The parties then left and the Department decided to accept the complainant's attorney's request. The parties who reconnected immediately afterwards were informed that the request had been accepted and the postponed hearing would take place on 16-07-2025 at 10:00 without further calls. Furthermore, in the context of the aforementioned postponed meeting of the Department, which took place again via videoconference on 16-07-2025, the company being complained about was represented by its lawyers, Emmanuel Demogerontakis (Member of the Board of Directors…), Xenophon Kritikou (Member of the Board of Directors…) and Konstantina Karopoulou (Member of the Board of Directors…), while the Data Protection Officer of the company being complained about was also present, in case further clarifications were needed, while the complainant was not present at the beginning of the discussion. Subsequently, the representatives of the complainant were disconnected from the videoconference and the Deputy Chairman and the members decided to examine the case. During the discussion, a email from the complainant's representative requesting a new postponement (see message with no. prot. C/ΕΙΣ/6674/16-07-2025, cf. also with no. prot. C/ΕΙΣ/6673/16-07-2025 message of the complainant's power of attorney). Subsequently, the present complainant was granted a deadline to submit a memorandum in further support of its claims until 30-07-2025. The company complained with no. prot. C/ΕΙΣ/7412/04-08-2025 memorandum sent on 1 -08-2025, briefly states, among other things, the following: First of all, it repeats the sequence of events, as they were also cited in its previous responses to the Authority, noting, however, that in the two applications submitted by the complainant through her authorized representative from 07- 09-2022, she had filled in different telephone numbers in the field entitled: “number of the telephone connection for which the recording was made”, while she also filled in different numbers in the fields of the applications entitled: “number of the telephone connection on which the call was made”. Subsequently, the complainant states that in the requests submitted by the complainant on 20-09-2022, after being informed for the first time about the need to correct the above requests from 07-09- 62022, she had filled in two more numbers in the field entitled "telephone connection number on which the call was made", in relation to her corresponding previous request. Therefore, according to the company being complained about, when the new requests were received on 23-09-2022, the competent corporate department found that the complainant's initial request had changed significantly, as it now concerned the provision of all recorded calls, made from/to four telephone numbers during the period of ten months. Due to the volume of requested incoming calls, the competent department informed the store on the same day, as the complainant notes, of the need to seek additional information from the complainant, in order to make it possible to satisfy her request in a timely and complete manner. In fact, the company under complaint underlines that the relevant clarifications requested by the complainant were not intended to limit the response to the access request it made, nor were they used to hide recorded calls, but were aimed at easier, timely and complete satisfaction of the general and complex request in question due to the volume of calls. Furthermore, according to the company being complained about, a representative of the latter contacted the complainant's authorized representative on 08-11-2022 in order to request further information in order to facilitate, as it states, the satisfaction of the submitted request, while on the same day the aforementioned authorized representative sent a written request/complaint to the complainant via the special form, which received a unique reference number SR ID: …. In the said complaint, the submission of which was requested by the Authority during the hearing, however, without it ultimately being submitted by the company being complained about, the complainant mentioned, according to what the complainant cites, "the requests it had submitted for the disclosure of recorded calls and informed that on 10-11-2021 [in apparently 10-11-2022] marks one year since the occurrence of technical problems on the complainant's lines and the making of the requested calls". The complainant company then notes that up to two days before the completion of the twelve-month period for keeping the recorded calls, the complainant refused to specify information in order to satisfy her request, while noting that in the very text of the special form that she completed on 08-11-2022, the complainant states that it will be examined within twenty (20) days. 7After submitting the said complaint, the company complained about states that its representative tried to contact the subscriber by telephone at the contact number listed on her card, in order to receive more information about her complaint and to refer the request to the competent department for further management, however, the subscriber, as stated, refused to cooperate, stating that she only communicates in writing with the complained company. Subsequently, it is noted that the complainant submitted a new request on 22-11-2022 at a store of the complainant, specifying all the requested information, including the dates and times when the requested calls were made. The competent department of the respondent received the said request on 25-11-2022, when on 28-11-2022, eighteen (18) recorded calls were retrieved, which were located in the systems of the complainant company for the period from 25-11-2021 to 31-12-2022 and were subsequently sent in an encrypted file to the email address, which the complainant had declared through her power of attorney in her relevant application. The respondent confirms in its post-hearing memorandum that it granted to the complainant all of the calls it located in its systems, responding legally and within the deadline to the latter's access request dated 25-11-2022. Furthermore, the defendant states the types of incoming and outgoing calls that are recorded, without specific mention of calls (incoming/outgoing) related to technical failures, while noting that now, in compliance with the ADAE Regulation, it records all incoming calls without distinction. As for the retention period of the recorded calls, the defendant company notes that it amounts to 12 months from their making, while the same retention period applies to the relevant records in its information system, which display the details of the calls, such as the date and time of their making as well as their subject. The complainant then refers to the manner in which the rights of the data subjects can be exercised before it, emphasizing that the relevant application form to be completed that it provides operates as an auxiliary in terms of the management and identification of the critical data at any given time and does not constitute a formal condition for the validity or acceptance of the request. Finally, the complainant company describes the manner in which the 8 requests for recording of conversations, which were made by third-party cooperating companies, emphasizing, however, that the calls concerning the case under examination were made only with representatives of the complainant itself and therefore no third-party cooperating company was involved in the management of the complainant's relevant requests in question. The Authority, after examining the information in the file, after hearing the rapporteur and the clarifications from the assistant rapporteur, who attended without the right to vote, after a thorough discussion, HAS DECIDED IN ACCORDANCE WITH THE LAW 1. Since it follows from the provisions of Articles 51 and 55 of the General Data Protection Regulation (Regulation (EU) 2016/679 – hereinafter, GDPR) and Article 9 of Law 4624/2019 (Government Gazette 137) that the Authority has the competence to supervise the implementation of the provisions of the GDPR, this Law and other regulations concerning the protection of individuals from the processing of personal data. Article 5(1) of the GDPR sets out the principles that should govern processing. In accordance with the principle of accountability introduced by that article, paragraph 2 thereof states that the controller “shall be responsible for and able to demonstrate compliance with paragraph 1 (“accountability”)”. As the Authority has assessed, the GDPR has adopted a new compliance model, the central point of which is the principle of accountability, within the framework of which the controller is obliged to design, implement and generally take the necessary measures and policies in order for the processing of data to be in accordance with the relevant legislative provisions. In addition, the controller is further obliged to demonstrate at all times its compliance with the principles of Article 5(1) of the GDPR. 2. Because according to Article 15 par. 1, 3 and 4 of the GDPR “1. The data subject has the right to obtain from the controller confirmation of 1 See Authority decision 26/2019, paragraph 8, available on its website. 9whether or not personal data concerning him or her are being processed and, if so, the right of access to the personal data and to the following information: a) the purposes of the processing, b) the categories of personal data concerned, c) the recipients or categories of recipients to whom the personal data have been or are to be disclosed, in particular recipients in third countries or international organisations, d) if possible, the period for which the personal data will be stored or, where that is not possible, the criteria determining that period, e) the existence of the right to request the controller to rectify or erase personal data or to restrict the processing of personal data concerning the data subject or to object to such processing, f) the right to lodge a complaint with a supervisory authority principle, (g) where the personal data are not collected from the data subject, any available information on their origin, (h) the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) and, at least in such cases, meaningful information on the logic involved, as well as the significance and envisaged consequences of such processing for the data subject. 2. […] 3. The controller shall provide a copy of the personal data processed. […] If the data subject makes the request by electronic means and unless the data subject otherwise requests, the information shall be provided in a commonly used electronic format. 4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others. These provisions establish the right of access of the subject to his/her personal data. Within the framework of this right, the subject must, on the one hand, have access to personal data which have been collected and concern him/her, in order to be aware of and ascertain the accuracy and nature of the processing of his/her data and to verify the lawfulness of the processing, and, on the other hand, be able to exercise this right easily and at reasonable regular intervals. 2 Furthermore, the Authority firmly accepts that the data subject has the right to know whether personal data concerning him or her are being processed, and to obtain knowledge of them, without the need to invoke a legitimate interest since this exists and constitutes the basis of the right of access, i.e. the right of the data subject to obtain knowledge of information which concerns him or her and has been recorded in a file kept by the controller, thus implementing the basic principle of the law on the protection of personal data, which consists in the transparency of the processing as a condition for any further control by the subject of its lawfulness. Similarly, it is not required to invite the reasons for which the data subject wishes to exercise the right of access. Moreover, the obligation to satisfy the right of access is universal, i.e. it concerns all information concerning the data subject and, moreover, it does not depend on the invocation of the grounds for exercising the right. Consequently, the satisfaction of the right does not depend on a prior judgment of the controller as to whether or not the exercise of the right is justified. 3. Since, according to Article 12 GDPR “1. The controller shall take appropriate measures to provide the data subject […] with any communication in the framework of Articles 15 to 22 and Article 34 relating to the processing in a concise, transparent, intelligible and easily accessible form […] The information shall be provided in writing or by other means, including, where appropriate, electronically […] 2. The 2See recital 63 of the GDPR 3 See in particular, Authority decisions 32/2019, 144/2017 195/2014 193/2014 and 75/2011, available on the Authority’s website. 4See, for example, Authority decisions 22/2023, 2/2020, 23/2020, 16/2017, 98/2014, 149/2014, 72/2013 and 71/2013. 5See EDPB, Guidelines 01/2022 on data subjects’ rights – Right of access, Version 2.0, adopted on 28 March 2023, Chapter 61, para. 167, p. 52, https://edpb.europa.eu/system/files/2023- 04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf. 6 See Authority Decision 16/2017. 7 See Authority Decision 1/2005, which held that the controller must respond to the data subject's request for access without vagueness or evasion invoking grounds unrelated to the civil satisfaction of the right of access. See also Authority Decision 16/2017. 11the controller shall facilitate the exercise of the rights of data subjects set out in Articles 15 to 22 […] 3. The controller shall provide the data subject with information on the action taken on a request pursuant to Articles 15 to 22 without delay and in any event within one month of receipt of the request. That period may be extended by two further months, where necessary, taking into account the complexity of the request and the number of requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, as well as of the reasons for the delay. […] 4. If the controller does not act on the data subject’s request, the controller shall, without delay and at the latest within one month of receipt of the request, inform the data subject of the reasons for not acting and of the possibility of lodging a complaint with a supervisory authority and of seeking a judicial remedy. Whereas Article 18 of the GDPR provides that: “1. The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:….. (c) the controller no longer needs the personal data for the purposes of the processing, but the data are required by the data subject for the establishment, exercise or defence of legal claims,….” Furthermore, Article 24(1) and (2) of the GDPR provides: “1. Taking into account the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and be able to demonstrate that the processing is carried out in accordance with this Regulation. Those measures shall be reviewed and updated when necessary. 2. Where justified by the processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller. » 4. Because according to article 4 par. 3 of Law 3471/2006 “Protection of personal data and privacy in the electronic communications sector”, 12 by which Directive 2002/58/EC has been transposed into national law, as in force after its amendment by Directive 2009/136/EC), “3. The recording of conversations and related traffic data is permitted when they take place in the course of a legitimate professional practice for the purpose of providing evidence of a commercial transaction or other professional communication, provided that both parties, after prior information on the purpose of the recording, give their consent.” As the Authority has also held (see Annual Report for the year 2006, p. 78, available on its website www.dpa.gr), when the recording of conversations is lawful according to article 4 par. 3 of law 3471/2006, then no prior consent of both parties is required, but prior notification of the party who did not initiate the recording in accordance with article 11 of law 2472/1997 (cf. article 5 par. 2 of Directive 2002/58/EC 8 in conjunction with recital 23 of the same Directive). The required notification may also be carried out by means of a recorded notification before the start 9 of the critical telephone conversation. In view of the fact that recorded conversations also constitute personal data of subscribers or telephony users (of both parties to the communication), for matters not specifically regulated in Law 3471/2006, the provisions of the GDPR and the implementing Law 4624/2019 apply. Moreover, Directive 2002/58/EC, which has been transposed into national law by Law 3471/2006, is a specification of the rules of Directive 95/46/EC. Therefore, the interpretation of the provision of Article 4, paragraph 3 of Law 3471/2006 should be made in combination with the basic principles governing the processing of personal data (Article 5 of the GDPR). Consequently, according to this provision, as the Authority has ruled, the recording of a professional conversation is permitted, exceptionally, only when it is 8Recital 23 of Directive 2002/58/EC: “The confidentiality of communications should also be ensured in legitimate business practice. Whenever necessary and legally permissible, communications may be recorded for the purpose of proving commercial transactions. In this process, Directive 95/46/EC shall apply. Before recording, the parties to the communications should be informed about it, its purpose and the duration of storage. The recorded communication should be erased as soon as possible and, in any case, at the latest at the end of the period during which it is lawful to challenge the transaction. Article 5(2) (privacy of communications) of Directive 2002/58/EC: Paragraph 1 shall not affect any lawful recording of conversations and the related traffic data when they are made in the course of a legitimate professional practice for the purpose of providing evidence of a commercial transaction or any other communication of a professional nature. 9For the above, see Decisions of the Authority 47/2018, para. 2, 73/2017, para. 5 as well as 86/2015, sec. 1. 13it is necessary to prove that the specific conversation took place and had a specific content and not generally in every case of communication of a professional nature. 5. Whereas it is further noted that the no. 253/2022 ADAE Decision (Government Gazette 3773/Β’/18-07-2022) entered into force, in accordance with Article 4 thereof, 6 months after its publication in the Government Gazette and therefore did not apply at the critical time of exercise of the disputed rights under examination exercised by the complainant in the year 2022. According to the said Decision, the provider shall retain the content of the telephone communication with the subscriber or user for serving the said requests for a period of one year, without prejudice to any obligation to retain it for a longer period, if provided for by other provisions of the applicable legislation. In any case, the recording of the communication is carried out after prior information and consent of the subscriber or user, in accordance with the applicable legislation (see article 3.5 of the said Decision). Following this, telephone conversations concerning technical failures may constitute a legitimate professional practice pursuant to article 4, paragraph 3 of law 3471/2006 in conjunction with the aforementioned ADAE Decision. 6. Because in this case the recorded conversations of the complainant's power of attorney with the representatives of the Vodafone company constitute, in principle, her personal data (article 4, item 1 of the GDPR). The recording of the above data by the company complained of constitutes automated processing (article 4, item 2 of the GDPR). Furthermore, it follows from the above that the legal professional practice, which may allow the recording of a relevant call, is based on Article 4, paragraph 3 of Law 3471/2006 in combination with other provisions, such as in this case, the aforementioned Decision No. 253/2022 of the ADAE. It is also noted that the respondent did not prove whether she lawfully recorded the calls in question, as at the relevant time of their making, the said Decision had not entered into force. Regardless of this, if they were recorded, they should have been granted to the complainant in the context of satisfying her relevant request. 10 See in this regard Decision of the Authority 73/2017 as well as 22/2023. 147. Furthermore, from the above facts, as they arise from the data of the file of the case in question, it is established that the disputed right of access to the aforementioned recorded conversations was first exercised on 07- 09-2022, after which the complainant reinstated it through her power of attorney on 20-09-2022, after the complainant was informed of the need to correct the address for sending calls, so that instead of the address of the complainant's store, the complainant's postal or email address is entered. Finally, a request for access was resubmitted on 22-11-2022, while the complainant had only been informed on 08-11-2022, which took place on the initiative of her power of attorney, as she claims (see page 2 of the complainant's supplementary document with No. Prot. C/ΕΙΣ/8273/21-11-2023), that the latter had incorrectly stated the time period in which the requested calls were made, and therefore she was asked to specify them. It is noted in relation to the above that the failure to further specify the above time period for making the calls also existed in the context of the complainant's initial request of 07-09-2022 and therefore she could have been informed of the said specification already then and not two months later. Furthermore, the complainant requested the complainant to further specify the time period for making the above calls on the grounds that otherwise the request would be systemically difficult to satisfy, as stated in item no. Prot.C/ΕΙΣ/8255/20-11-2023 in her response to the Authority. In view of the above, there is a violation of Article 12, paragraph 4 of the GDPR with regard to the right of access first exercised on 07-09-2022, to the extent that the complainant was not informed since then and in any case within one month of the exercise of the above right of all the irregularities that made it difficult to satisfy the request on the part of the respondent, although the latter was already in a position to know from that time the alleged necessity of further specifying the time period for making the calls, as mentioned in detail above. The above violation is aggravated by the fact that there was no relevant information within the deadline specified in Article 12, paragraph 4 of the GDPR, neither after the submission of the same request of 20-09-2022 that the complainant brought back, as the company informed her of the necessity of further specifying her request on 08-11-2022, as discussed above. Moreover, the obligation of timely relevant information is also mentioned in the context of the internal policy that the complainant submitted to the Authority (see pages 9 and 12 thereof). Furthermore, the respondent violated Article 12(2) of the GDPR, insofar as it made it materially difficult for the complainant to exercise her right of access by failing to timely identify all of the irregularities alleged by the company in the access requests in question, as mentioned above. It is noted in this regard that it is reasonable for the provider in question to request certain clarifications for the specification of the respective access requests, but in any case without causing undue hardship to the data subject, especially since in this case the complainant's initial request of 07-09-2022 was clearly formulated for the calls that concerned her and took place from 10-11-2021. and onwards from and to specific telephone numbers, specifying even the subject of the conversations in question. In fact, from the allegations of the accused company, as included in particular in the post-hearing memorandum following a relevant question posed during the hearing by the Authority, it did not emerge what are the minimum clarifications that it requires from the data subjects, in order to make it systemically possible to find recorded calls relating to technical failures. Moreover, with regard to the claim raised by the first respondent in her post-hearing memorandum regarding the confusion created due to the change in the complainant's requests, it is noted that already in the two related requests submitted by the complainant's power of attorney on 07-09-2022, a total of four telephone numbers were included from and to which the requested recorded conversations were made. The same four telephone numbers were repeated in the same fields in the two related requests for the power of attorney, submitted on 20-09-2022 and in the last two related requests of 22-11-2022, the above four telephone numbers also appeared in total. Therefore, the defendant had, from the very first requests, an accurate picture of the number of telephone lines from and to which the requested calls were received. Moreover, given that the complainant's request of 20-09-2022 was clear and with it the recorded conversations concerning her were requested, from 10-11- 162021 onwards, while this was also supplemented with the requested e-mail address, the fact that the complainant sent on 28-11-2022 only part of the calls, omitting the requested calls that had been recorded from 10-11- 2021 to 24-11-2021, constitutes a violation of the right of access of Article 15 of the GDPR in conjunction with Article 12 par. 3 of the GDPR with regard to the above right. 8. Because in the request referred to with reference number … submitted by the complainant to the complained company on 08-11-2022, which the respondent did not submit with her post-hearing memorandum, but nevertheless transferred to this content, it is noted that it included not only a reference by the complainant to the already submitted access requests but also a note to the complained company that on 10-11-2022 one year has passed since the requested calls were made. Therefore, the right to restrict processing was exercised, as from the content of the above request, which the complainant herself states, it is clear that the complainant wishes the company to retain the records of the conversations that concerned her from 10-11-2021 to 10-11-2022 until the processing of her request due to the risk of their twelve-month retention in the company's archives lapse. Moreover, in the email message of the complainant's power of attorney dated 10-11-2022 to the company being complained about, it is stated that with her complaint no. …, the retention of the requested records beyond a year was requested until at least the processing of the disputed request (see the relevant submitted email message). However, in the email no. Prot. C/ΕΙΣ/3122/28-04-2023 the company's response notes that the complainant's request dated 22-11-2022 was received by Vodafone on 25-11-2022 and therefore on 28-11-2022 eighteen (18) recorded calls were retrieved and granted to the complainant, which were located and related to the period from 25-11-2021 to 31-12- 2021. From the above response it follows that no calls were found for the period before 25-11-2021, although it had been clearly requested, already in the context of the complainant's request dated 07-09-2022 - as, moreover, this was also supplemented later by the above-, access to calls from 10-11-2021 onwards and therefore the company never satisfied the right to restrict the processing exercised by the complainant from 08-11-2022, nor does it appear from the information in the case file that it informed the complainant within the deadline of Article 12, paragraph 174 of the GDPR, of the reasons for not acting on the said request (see also page 10 of the company's policy submitted to the Authority). Consequently, due to the aforementioned non-satisfaction of the right to restrict processing and therefore a violation of Article 18, paragraph 1 of the GDPR, the complainant's right of access was partially satisfied in accordance with aforementioned. 9. Because, from the submitted e-mail messages from 11-11-2022, sent by a representative of the defendant to the complainant, a different information was provided to the data subject in relation to the process of satisfying the right of access to recorded conversations from the one that the defendant company states that it followed to satisfy the relevant request of the complainant. In particular, from the above messages, the complainant was informed that the notification of recorded conversations is made exclusively through Vodafone stores, while already from 09-09-2022, as mentioned above, a relevant correction had been requested in the complainant's request from 07-09-2022, regarding the address for notification of the calls in question so that they would be sent directly to her and not to a store of the complainant. Therefore, the above results in a violation of Article 12, paragraph 1, regarding the obligation of transparent information, which burdens the respective controller, to the extent that the information about the above procedure for satisfying the right of access exercised by the complainant was contradictory. 10. Whereas, in this case, and in accordance with the above, the company complained of violated the provisions of Articles 12, paragraphs 1, 2, 3 and 4, 15 and 18 of the GDPR, as specified in detail in the aforementioned considerations. 11. Whereas the violation of the rights of the data subjects provided for in Articles 12-22 of the GDPR, entails the imposition of the relevant sanctions pursuant to Article 83 paragraph 5, letter b of the GDPR. According to the GDPR (Article 148), in order to strengthen the enforcement of the rules of this Regulation, sanctions, including administrative fines, should be imposed for any infringement of this Regulation, in addition to or instead of the appropriate measures imposed by the supervisory authority in accordance with this Regulation. 18 12. Based on the above, the Authority considers that it is appropriate to exercise its corrective powers under Article 58(2) of the GDPR in relation to the infringements identified. 13. The Authority further considers that the imposition of a corrective measure is not sufficient to restore compliance with the provisions of the GDPR that have been violated and that based on the circumstances established, an additional and effective, proportionate and dissuasive administrative fine should be imposed pursuant to the provision of Article 58(2)(i) of the GDPR, both to restore compliance and to sanction the unlawful conduct. 11 14. Furthermore, the Authority took into account the criteria for measuring fines, set out in Article 83(2) of the GDPR, paragraph 5(b) of the aforementioned article, which are applicable to the present case, the Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679, issued on 03-10-2017 by the Article 29 Working Party (WP 253), the Guidelines of the European Data Protection Board on 12 the calculation of administrative fines under the GDPR, as well as the actual facts of the case under examination and in particular: i. The fact that the company complained of violated provisions relating to data subject rights and in particular not only the right of access of Article 15, in conjunction with the provisions of Article 12 para. 2, 3 and 4 of the GDPR, but also the provision of Article 12 para. 1 of the GDPR, as well as the right to restriction of processing of Article 18 para. 1 of the GDPR, as explained in detail above. ii. The fact that the training of the representatives of the complained of needs improvement, in particular with regard to the procedures followed in the context of exercising and satisfying the rights of data subjects, in order to prove that the latter complies, as stated above, with the 11See OE 29, Guidelines on the application and determination of administrative fines for the purposes of Regulation 2016/679 WP253, p. 6. 12See EDPB, Guidelines 04/2022 on the calculation of administrative fines under the GDPR, version 2.1, adopted on24may 2023, which states, inter alia (see pp. 3 and 6) that they apply in addition to the aforementioned Guidelines on the application and determination of administrative fines for the purposes of Regulation 2016/679, WP253. 19 obligations of the controller including the transparent information of data subjects regarding the process of exercising and satisfying their rights. iii. The fact that the complainant substantially hindered the exercise of the right of access, in particular by failing to timely identify all of the irregularities of the access requests in question, as detailed above, in violation of Article 12, paragraph 2, of the GDPR. iv. The fact that the above violations of the GDPR in this case affected one (1) natural person as a data subject. v. The fact that the above violations did not affect any specific categories of personal data of the complainant. vi. The fact that, from the information brought to the attention of the Authority and based on which it established the above violations of the GDPR, the controller did not cause material damage to the complainant and it does not appear that he derived any financial benefit from the above violations. vii. The fact that the respondent mostly satisfied the complainant's request for access to the recorded conversations that it identified by providing the majority of the requested calls, as mentioned in the history of this case and even before the intervention of the Authority. viii. The fact that the disputed request was complex due to its repeated submission and the number of telephone numbers from and to which the requested recorded conversations took place. ix. The fact that all the elements of the file are not proven to be fraud on the part of the accused for the violations found. x. The fact that the violation of the provisions relating to the rights of the subjects is subject, in accordance with the provisions of Article 83, paragraph 5, subparagraph 2, GDPR, to the highest category provided for in the system of grading administrative fines. xi. The fact that the turnover for the financial year 2022- 2023 of the respondent was taken into account, as shown by its most recent published financial statements 20 15. Based on the above, the Authority unanimously decides that the administrative sanctions referred to in the operative part, which are deemed proportionate to the seriousness of the infringement, should be imposed on the respondent company, as controller. FOR THESE REASONS The Authority a) Imposes on the reported company with the name "VODAFONE – PANAFON HELLENIC TELECOMMUNICATIONS COMPANY S.A.", as controller, the effective, proportionate and dissuasive administrative fine, appropriate in this specific case, according to its specific circumstances, of thirty thousand (30,000) euros for the above-identified violations of the provisions of articles 12 par. 1, 2, 3, 4, 15 and 18 of the GDPR, as specified above, in accordance with articles 58 par. 2 letter i' and 83 par. 5 letter b' of the GDPR. b) Orders, pursuant to article 15 par. 4, paragraph b’ of law 4624/2019, the company complained about to take the appropriate technical and organizational measures to examine the rights of data subjects in a timely manner, including the more effective training of its representatives, providing the Authority with relevant documentation within six (6) months of notification of this. The Deputy President The Secretary Georgios Batzalexis Irini Papageorgopoulou 21
