HDPA (Greece) - 48/2021
| HDPA (Greece) - 2322/14-10-2021 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 4(11) GDPR Article 4(12) GDPR Article 5(2) GDPR Article 6(1)(f) GDPR Article 6(1)(a) GDPR Article 6(4) GDPR Article 7 GDPR Article 21 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 14.10.2021 |
| Published: | 14.10.2021 |
| Fine: | 20000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 2322/14-10-2021 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | Greek's DPA website (in EL) |
| Initial Contributor: | Elisavet Dravalou |
A company that conducts phone sales, processed customer personal data to promote its products and services to the customers, whose personal data was collected during the purchase of products. The controller held that consent was obtained but was unable to prove it and did not respect the data subject's opt-out requests.
English Summary
Facts
Three data subjects filed complains with the Greek DPA against a marketing agency for processing their personal data for a purpose other than it was collected in first place. The personal data was collected during purchases of goods. The data subjects claimed that the marketing agency was contacting them in order to promote its products without respecting their opt-out requests while the marketing agency was claiming that they contacted the data subject for a customer satisfaction survey after having obtained their consent.
Holding
The Greek DPA held that this processing constitutes use of personal data for a purpose other than that for which the personal data was originally collected, therefore the criteria of Article 6 (4) GDPR must be fulfilled and article 5 GDPR principles must be respected. In this case, it was found that the data subjects were not properly informed during the data collection stage that their personal data will be used for an additional different purpose, that their objections were not respected and the identity of the controller was not clear to the data subjects. Also, in relation to the application of the right of objection, the controller did not respect the data subject's opt-out requests and did not provide appropriate documents or instructions to prove that he was able to respond to such requests. The Authority imposed a fine of 20,000 euros for the violations found, taken into consideration the duration and the intensity of the violations.
Comment
What is interesting in this case is that the controller claimed that they processed personal data for marketing purposes (promotion of products) based on data subjects' oral consent obtained during the purchase of products. The DPA couldn't find evidence to suggest that consent was given. Therefore, in the absence of evidence, it cannot be accepted that consent is accepted as the legal basis of this processing. The DPA stated that it could accept legitimate interest as a legal basis, given the soft opt-in exception. Given though that the processing was carried out for a purpose different that the one for which the personal data was collected in first place, the Greek DPA held that article 6(4) and 5 of the GDPR must be respected. In this specific case at least appropriate information should have been provided to data subject at the data collection stage so that data subjects know that their personal data will be used for an additional purpose, while at the same time providing them with the opportunity to express their objections.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Category
Decision
Date
14/10/2021
Transaction number
48
Thematic unit
09. Promotion of products and services
Applicable provisions
Article 4.11: Consent (definition)
Article 4.12: Violation of personal data (definition)
Article 5.2: Principle of accountability
Article 6.1.a: Legal basis of consent
Article 6.1.f: Legal basis of overriding legal interest
Article 6.4: Compatibility of processing for another purpose
Article 7: Conditions for consent
Article 21: Right of objection
Article 11.2: Register - Article 11
Summary
A company that conducts long distance telephone sales, used to promote its products and services the customer data, which it collected during the purchase of products. This processing is the use of personal data for a purpose other than that for which the data were originally collected, therefore the criteria of Article 6 par. In this case, it was found that the data subject was not properly informed during the data collection stage, so that he knows that his data will be used for an additional different purpose, that customer objections were not respected and it was not clear to the data subjects the identity of the controller. Also, in relation to the satisfaction of the right of objection, the controller did not provide appropriate documents or instructions to prove that he was able to respond to such requests. The Authority imposed a fine of 20,000 euros for the violations found.
PDF Decision
48_2021anonym.pdf299.82 KB
Category
Decision
Date
14/10/2021
Transaction number
48
Thematic unit
09. Promotion of products and services
Applicable provisions
Article 4.11: Consent (definition)
Article 4.12: Violation of personal data (definition)
Article 5.2: Principle of accountability
Article 6.1.a: Legal basis of consent
Article 6.1.f: Legal basis of overriding legal interest
Article 6.4: Compatibility of processing for another purpose
Article 7: Conditions for consent
Article 21: Right of objection
Article 11.2: Register - Article 11
Summary
A company that conducts long distance telephone sales, used to promote its products and services the customer data, which it collected during the purchase of products. This processing is the use of personal data for a purpose other than that for which the data were originally collected, therefore the criteria of Article 6 par. In this case, it was found that the data subject was not properly informed during the data collection stage, so that he knows that his data will be used for an additional different purpose, that customer objections were not respected and it was not clear to the data subjects the identity of the controller. Also, in relation to the satisfaction of the right of objection, the controller did not provide appropriate documents or instructions to prove that he was able to respond to such requests. The Authority imposed a fine of 20,000 euros for the violations found.
PDF Decision
48_2021anonym.pdf299.82 KB
