HDPA (Greece) - 5/2023
| HDPA - 5/2023 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(b) GDPR Article 6(1)(a) GDPR Article 6(4) GDPR Article 13 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 02.02.2023 |
| Published: | 30.03.2023 |
| Fine: | 10.000 EUR |
| Parties: | Vodafone |
| National Case Number/Name: | 5/2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | Anastasia Vlachopoulou |
The Greek DPA fines Vodafone €10,000 for transferring personal data from their customers to an advertising company without prior consent.
English Summary
Facts
After requesting the provision of mobile telephony service to Vodafone (the controller), the data subject received a package with product samples at home. The package was sent by one of the controller's partner advertising company. Dissatisfied, the data subject filed a complaint with the DPA, claiming that they had explicitly opposed the use of their personal data for advertising purposes.
In response, the controller argued that the package was not sent for advertising purposes, but rather as an additional service to the mobile telephony requested by the data subject. According to the controller, the purpose of this extra service would be to reward new customers, who receive gifts regardless of their preferences in terms of promotions. In addition, the controller alleged that its customers are informed about this extra service through banner on its website.
Holding
The DPA dismissed the controller's allegations and held that the transfer of personal data to the partner company had advertising purposes. It highlighted that consumers, when providing their personal data to contract a telephone service, do not expect that such data will be used for other purposes. In the case under analysis, such an expectation was explicitly expressed, as the data subject opposed the use of his data for advertising purposes. For this reason, the DPA found a violation of the principle of lawfulness, fairness and transparency established in Article 5(1)(a) GDPR.
Moreover, the DPA found a violation of Article 13 GDPR, since the controller did not correctly inform data subjects that the simple request for a telephone service would imply the contracting of additional services.
As part of the exercise of its powers, the DPA imposed a fine of €10,000 on the data controller and ordered it to adapt its practice accordingly.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Summary The Authority examined a complaint from a subscriber who, after applying for a new Vodafone connection, received from an advertising company collaborating with Vodafone a parcel with samples of consumer products, despite his opposition to the use of his data for commercial promotion purposes. According to Vodafone, the sending of the parcel was not a promotional action, but an incidental provision of the telecommunications services contract already drawn up between the parties, which is sent to all, without exception, new subscribers who register through the website www.vodafonecu.gr, regardless of the their choices regarding promotional actions, while relevant information is provided via a banner posted on the website in question. The Authority considered that the transmission to an advertising company and the related processing of the complainant's data was done for the purpose of promotion, in violation of the principle of legality, objectivity and transparency of the processing, because it was not necessary for the purpose of the contract nor was it reasonably expected for the subject, who had expressly objected to the use and transmission of his data for promotional purposes while it was not proven that the complainant had been fully informed in accordance with Article 13 GDPR about the processing in question. Vodafone was fined 10,000 euros and ordered to adapt its practice regarding the additional benefits in question in order to provide the subjects with full information and the possibility to object.
