HDPA (Greece) - 56/2021
|HDPA (Greece) - 56/2021|
|Relevant Law:||Article 13 GDPR|
Article 14 GDPR
Article 11(1) Law 3471/2006
INFO COMMUNICATION SERVICES
|National Case Number/Name:||56/2021|
|European Case Law Identifier:||n/a|
|Original Source:||HDPA (in EL)|
English Summary[edit | edit source]
Facts[edit | edit source]
The Hellenic DPA (HDPA) received a great number of complaints from data subjects concerning unsolicited automated telephone calls (without human intervention) and sms messages to promote products and services. The data subjects claimed that these communications provided no information regarding who was contacting them for these purposes. In their complaints, the data subjects stated that they did not consent to being contacted by the controller.
The controller was eventually identified as INFO COMMUNICATION SERVICES, a marketing company. It argued that the data subjects consented to the calls. However, as per general company policy, the records of the consent were destroyed after the respective promotional cycle ended. Moreover, the company claimed the calls were not automated calls and, therefore, no consent was needed under Greek national law.
Holding[edit | edit source]
The HDPA found that the behaviour of the controller violated Article 11 Law 3471/2006. Article 11(1) Law No. 3471/2006 stipulates that the use of automatic calling systems (and more generally, the making of unsolicited communications by any means of electronic communication without human intervention) for any kind of advertising purposes, is only allowed if the data subject expressly consents in advance. The HDPA held that the calls were automated, taking the principle of accountability under Article 5(2) GDPR into consideration. According to this provision, the burden of proof is on the controller, and in this case, it did not prove otherwise. On the other hand, the complainants fully identified the automated nature of the calls.
Regarding the sms messaging, Article 11(3) Law No. 3471/2006 makes an exception from the consent requirement, provided that the contact details were lawfully obtained in the context of a sale of products or services (or similar transactions) as long as the recipient is given the opportunity to object in each message. The HDPA found the requirements of Article 11(3) Law No. 3471/2006 were not fulfilled and, as a result, consent was also needed.
Furthermore, the HDPA held that the controller failed to prove that the data subjects gave their consent to being called and messaged. According to the HDPA, the deletion of subscribers' details after the end of the respective promotion cycle could not excuse this failure, and the company should have kept the data subjects' proof of consent for a reasonable period of time to ensure the proper conduction of the investigation, especially since the controller was aware of the existence of the complaints before the deletion took place.
Additionally, the HDPA stated that, when carrying out promotional phone calls, the controller should inform the data subject of its identity and its representative, the purpose of the processing, and it should not conceal or falsify its number, according to its obligations under Articles 13 and 14 GDPR.
The HDPA decided to issue a fine of €30,000. When it determined the amount of the fine, the HDPA took into consideration the fact that taking the controller had a financial aim with the processing in question (since there is a charge for users if they select the appropriate key on their phone and proceed further), that it did not have a complaints procedure, that it had not responded to the HDPA in a timely manner, and it was not aware of the relevant legal framework.
Comment[edit | edit source]
The corresponding decision of the same date can be found here: HDPA (Greece) - 57/2021.
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 31-12-2021 No. Prot..: 3035 DECISION 56/2021 The Personal Data Protection Authority met, at the invitation of its Chairman, in a meeting by videoconference on 12-07-2021, following the meeting of 23-04-2021 and postponing the meeting of 31/3/2021, in order to examine the case referred to in the background of this document. In attendance were Konstantinos Menoudakos, Chairman of the Authority, regular members Spyridon Vlahopoulos, Konstantinos Lambrinoudakis, as rapporteur, and Charalambos Anthopoulos. The meeting was attended, without the right to vote, by the Chairperson's mandate, by the Auditors Konstantinos Limniotis and Ioannis Lykotrafitis, IT specialists, as assistant rapporteurs, and Irini Papageorgopoulou, employee of the Administrative Affairs Department, as secretary. The Authority has taken into account the following: A number of complaints have been submitted to the Authority in recent years regarding automated (without human intervention) telephone calls with the purpose of promoting products or services (offers - gifts), without specifying, in these calls, the identity of the person on whose behalf the calls are made, while all calling telephone numbers started with the same prefix "..." (i.e. the differentiation of the numbers existed, in these cases, in the last two digits of the calling numbers). In one case, the complaint concerned the sending of a short text message (SMS). Ave. 1-3 Kifissia Street, Athens, Greece11523 T: 2106475600- E: email@example.com - www.dpa.gr 1 Specifically, the complaints were the following: α) Complaint No. C/EIS/6386/23-07-2018 by A, according to which her telephone number ... received on ...2018 a telephone call from the number ..., in which she was informed that they were calling from a "supermarket offer/ online supermarket". She then called the above number, looking for the person in charge, Mrs B, who was absent, as she was informed, and asking the question about the source of her data. She received, according to the complainant, a vague reply that her number had arrived on their lists either because she had filled in a form herself or because she had given it to one of their employees. She also states that when she called the company back, she "pressed" option 2 to remove her number from their lists, however, she notes that they continue to harass her. The complainant names the name of the company (INCOSER) on her complaint form. b) Complaint of C under file No. C/EIS/1342/19-01-2019, as completed by document No. C/EIS/2184/21-03-2019, according to which his telephone number ... received on ...2019 at ...2019 and time ... an automated telephone call from the number ..., to which he answered and heard an audio message that he had won 850 Euros and that he should proceed with the procedure by typing "1" on his telephone. c) Complaint No. C/EIS/1552/27-02-2019 by D, according to which her telephone number ... received on ...2019 at ...2019 and time ... an automated telephone call from the number ..., advertising purchases from a supermarket as a gift. d) Complaint No. C/EIS/2332/27-03-2019 by E, according to which his telephone number ... received on ...2019 at ... ... ... ... an automated telephone call from the number ..., without specifying the content of the promotional action. The complainant states that his telephone number was registered in the register under Article 11 of Law No. 3471/2006 (opt-out register) of his provider. 2 ε) Complaint No. C/EIS/3218/06-05-2019 by Z, according to which her telephone number ... received on ...2019 at the hours of ..., ... and ... automated telephone calls from the number ..., advertising, as she states, money. f) Complaint No. G/EIS/3367/10-05-2019 by H, according to which his telephone number ... received on ...2019 at ... time ... an automated telephone call from the number ..., which advertised, as he states, a monetary benefit of Euro.850 g) Complaint No. C/EIS/3906/31-05-2019 by I, according to which on his telephone number ... he received on ...2019 at ...2019 and time ... a short text message (SMS) from the number ..., which stated "Thank you for participating! You are the big winner! To receive your gifts for free, call INCOSER9019015906. Charge 3.5€/1'+VAT. G.PAR. 2120001516". According to the complainant, the telephone number given as a complaint line does not seem to correspond to a real number (it does not call). η) Complaint of I. under reference C/EIS/4417/24-06-2019, as supplemented by document C/EIS/4653/02-07-2019, according to which his telephone number ...received on ...2019 at ...2019 and time ... a call from the number .... He did not have time to answer and called that number, where he was informed that he had been called by Super Market Offers because he had won an 800 euro gift voucher, which he would have to call another number to receive. As the complainant also states, his telephone number was registered in the opt-out register of his provider. (i) Complaint No 31475-19/03/2020 from K, forwarded to the Authority by means of letter No. ... (ref. no.: G/EIS/3590/26-05-2020) from the General Secretariat of Commerce and Consumer Protection. According to this complaint, on ...2020 at ..., the complainant received a call from ..., during which, after listening to a recorded message, which stated that she had won 600 euros for purchases from a super market, she was invited to press 1, which she did, whereupon she spoke to a lady, who told her that 3 won the amount of 640 euros for purchases from a super market. Subsequently, according to the complainant, when she asked which super market the offer was from, the caller hung up the phone, and then by calling the above number again, she was informed that it was from Super Market Offers. The complainant also stated that on that day she had tried to place orders in various super markets by entering her mobile phone number in the relevant websites. ι) Complaint No. G/EIS/4560/01-07-2020 by L, according to which his telephone number ... received on ...2020 at ... an automated telephone call from the number ..., advertising, as he states, gift vouchers. As the complainant also states, his telephone number was registered in the opt-out register of his provider. For the first of the above complaints (complaint under point (a)), the Authority sent INFO COMMUNICATION SERVICES (INCOSER), in the context of its investigation, the letter No. C/EΞ/6386-1/02-08-2018, requesting the company's views on the complaints, and in particular on the issue of failure to satisfy the right of access, failure to adequately satisfy the right of the subscriber natural person to be informed of the data controller, and failure to provide information on the exercise of the rights of access and objection. The complainant company replied by letter C/EIS/9369/26- 11-2018. In it, it states, inter alia, the following: i) ii) iii) The company occasionally undertakes promotions of various products and services by telephone with clear terms of participation which are communicated in detail in advance to the participants. Participants register either online or on forms by consenting to be contacted. Subscribers who are registered in the register referred to in Article 11. 4 iv) When a call is made to a participant, in the initial menu of the service two options are given: a. to contact a representative by selecting the number and 1,b. to be removed from the company's lists by selecting the number 2. v) For the above complaint, the following information is provided in particular: a) For the sake of brevity, the company is referred to as INCOSER, instead of the full name INFO COMMUNICATION SERVICES, and it owns the online supermarket of offers https://www.websupermarketdeal.gr/, b) the complainant was given all the information about the identity of the company and its activity, i.e. that it is a promotional company for products and services, c) only one call was made to the complainant, so there is no evidence of systematic harassment, as she states, d) the remaining calls/contacts with the company were made on her own initiative, (e) she was made aware of the nature and purpose of the communication and collection of her data (right to be informed), as well as her right to object (which, according to the company, was exercised by the complainant since, according to the complainant herself, she chose the number not 2to be called again). She did not choose to call back in order to request more information; f) There is a possibility, which has unfortunately happened sometimes, that the telephone number provided by the participant may have been incorrectly indicated or even deliberately by a third party that someone else's telephone number was indicated; g) The complainant has appealed to the Authority without having previously exercised her rights vis-à-vis the controller. For the remaining complaints, for which the complainants did not mention the name of the complainant company because it had not been disclosed to them during the calls they received, the Authority, in the cases of the complaints under (b) and (c) above, sent a letter to Microbase Advanced Services of Communications and Informatics IKE (hereinafter referred to as Microbase), whose network included the telephone exchanges 5 numbers mentioned as callers in these complaints, the documents No. C/EX/1342- 1/19-03-2019, C/EX/1552-1/05-04-2019 respectively, requesting to provide the necessary subscriber information for the respective numbers (name or surname, address and/or other contact details). In both cases, Microbase replied that the owner of the numbers in question is INFO COMMUNICATION SERVICES ADVERTISING - PROMOTIONAL - COMMERCIAL - RESEARCH AND PUBLICATIONS MONOPROSOOPI IKE (hereinafter, INCOSER or controller). Therefore, due to the common characteristics of all complaints and the respective complainant telephone numbers, the Authority did not re-contact Microbase for the following (d) - j) complaints - for which, as it follows from the following, the complainant is indeed INCOSER. Subsequently, the Authority, in the context of the examination of the above complaints, sent to INCOSER the documents C/EX/1342-2/10-04-2019 (for the complaints under (b) and (c)), C/EX/2332-1/14-05-2019 (for the complaint under (b) and (c)) and C/EX/2332-1/14-05-2019 (for the complaint under (d)). d'), C/EX/3218- 1/06-06-2019 (for complaints under (e) and (f)), C/EX/3906-1/11-07-2019 (for complaints under (g) and (h)) and C/EX/4560-1/27-07-2020 (for complaints under (g) and (h))). i' and j' complaints), requesting its views on the complainants, while also requesting information on the general procedures followed by the company for carrying out telephone promotions, namely how the selection of the called numbers is made, whether all calls made are automated without human intervention, as well as the procedures followed to examine whether the subscribers/holders of the called numbers have indicated that they do not wish to receive calls from the company, and the procedures followed to examine whether the subscribers/holders of the called numbers have indicated that they do not wish to receive calls from the company. It should be noted that because the company did not reply to the above Authority documents, each new Authority document was accompanied by a reminder of the relevant previous ones. INCOSER finally responded in total, for all the above mentioned complaints, by letter no. C/EIS/6506/25-09-2020. In the said document it states the following: Α. The company with the name "INFO COMMUNICATION SERVICES ADVERTISING - 6 PROMOTIONAL-COMMERCIAL - RESEARCH AND POLLING ONE-MAN-AGENCY IKE" 7 has as its statutory purpose, inter alia, the carrying out of promotional activities by telephone, with clear conditions of participation, which were communicated in detail to the participants. Within the framework of the above statutory purpose, the company carried out promotional activities until the end of 2019 on the basis of published written terms of participation for each promotional activity, deposited with a notary and posted on the company's website for the purpose of informing the public for the duration of each promotional activity. The terms of the promotions generally stated, inter alia, the following: "Participation in the Promotion shall be made by submitting valid contact information in one of the following ways: (1) through internet postings/postings, in particular either on the website or on other sites, where there is a relevant posting by the Organising Company, or (2) through the special entry forms, bearing the name of the Organising Company and distributed by its representatives, or (3) via the special telephone number , with a civil charge. Specifically, to ensure the validity of their participation, participants must, for each of the above-mentioned methods, respectively: (1) fill in the special Participation Form for the Promotion ". ", which is available on the site , indicating obligatorily and in a complete and true manner the following data: name, surname and telephone number, or (2) state in a complete and true manner the following data: name, surname and telephone number on the relevant entry form, which will be provided by a representative of the Promoter and will be completed by the Entrant or by the Promoter's representative, at the Entrant's discretion; or (3) state the following information obligatorily and in a complete and true manner: Their first name, last name and telephone number to the Promoter's answering machine, which will answer 24 hours a day to telephone calls to the dedicated telephone number , with a civil charge." (...) "The Promoter considers that each participant is the owner and has exclusive control of the e-mail address he/she declares". "During the Promotional Action, all valid, according to the above mentioned, Participation Statements will be collected in a special 8 file (Excel) of the Promoter and will receive a serial number, followed by a notification to the Beneficiaries for the next stages of the Promotion. This file will be destroyed after the completion of the Promotion." "Each Beneficiary will be informed free of charge, through a call from the call center of the Organizing Company to the mobile or fixed telephone number that he/she has declared during his/her participation under article 4, that he/she is a Beneficiary of the Promotion's prizes and must confirm that he/she wishes and accepts the prizes he/she is entitled to. If he/she accepts the gifts, he/she will be informed during the same communication of the number to which he/she will call in order to be informed of how to receive them (...)'. "All participants acknowledge, declare and accept expressly and unconditionally that: (a) their personal data in this promotion may not belong to a third party natural or legal person, but to themselves; (b) they are over the age of majority 18and have legal capacity; (c) their personality is not infringed or diminished in any way by their participation in this promotion of the Promoter, in which they will participate with their personal data; (d) they do not infringe the personal data or the right of personality of any third party, (e) do not infringe the intellectual property rights of any third party; (f) expressly consent to the Promoter's use and processing of their personal data (name, telephone number, e-mail address) for the sole purpose of serving the Promotion; (g) give their consent and authorization to the Promoter for the promotion of the Promotion and its results through the printed and electronic press and the internet throughout its duration. The Promoter reserves the right to use and publish any news item relating to the conduct of the Promotion." "Personal Data. By participating in the Promotion, each participant expressly declares and accepts that his/her personal data will be collected and used by the Promoter for processing. 9 by automated or non-automated means, either by itself or through any other person appointed by it to carry out the aforementioned processing on its behalf and on its behalf hereunder. The personal data of the winners in the Promotion, in this capacity, will be retained by the Promoter and will be used solely for the purposes of the Promotion. In any case, the personal data of the participants will be kept in accordance with the current Greek legislation, Law 4624/2019 on the Personal Data Protection Authority and the General Regulation for the Protection of Personal Data - Regulation (EU) 2016/679 of the European Parliament (GDPR). Participants will have the right at any time and without charge to confirm, modify or correct, limit or delete all their personal data held on file in accordance with the terms of the applicable Greek legislation, the Law. 4624/2019 on the Personal Data Protection Authority and the General Regulation for the Protection of Personal Data - Regulation (EU) 2016/679 of the European Parliament (GDPR) as in force by contacting the Organizer's data controller, at WebSuperMarketDeal@gmail.com or at the contact telephone number with civil charge. The exercise of the rights of restriction, opposition and/or the right of erasure, if they concern data necessary for the implementation and/or continuation of this Promotion, entails either the inability to participate, if exercised before the implementation of the Promotion, or the automatic cancellation of participation in it if exercised at any stage of the Promotion. The Promoter expressly declares and undertakes that it follows the principle of minimum processing of personal data and the above data collected are processed exclusively and only for certain purposes as set out above. Furthermore, it declares that it has taken all necessary measures, technical, organizational, legal, in order to ensure the protection of such data (...)" 10 As stated by INCOSER in its above-mentioned document, the following briefly follows from the above basic terms, according to INCOSER: 1. Participation in the promotion was at the initiative of the participant, in one of the ways expressly provided for. Therefore, the participant voluntarily provided his or her own details by filling in a form in which, among other things, he or she indicated the desired contact telephone number. 2. In order for a participation to be considered valid, all the minimum required information, namely name, surname and telephone number, should be provided, so that the holder can be identified if necessary. 3. Valid entries were collected in an electronic file in order for communication to take place, informing participants of the next steps of the promotion. 4. The above records were kept only for the duration of the promotion. They were then destroyed. The same applied to the registration forms. 5. The communication was made to the number that the participant himself had indicated, giving his consent to this communication for the purpose of the promotion. 6. A special telephone number was assigned to each promotion to allow for complaints. 7. Each participant declared that they consented to the processing of their personal data, including their telephone number, for the purpose of serving the promotion. 8. A special telephone number was designated for the purpose of facilitating the exercise of the right to object. Participants could at any time and free of charge confirm, modify or correct, limit or delete all their personal data by contacting the Organizer's data controller at a designated e-mail or telephone number. 11 9. Each participant was aware of the terms and conditions before submitting his/her participation, when he/she declared that he/she was aware that if he/she participated, he/she did so voluntarily and that he/she also accepted unconditionally the terms and conditions under which it was carried out, i.e. telephone communication. Β. With regard to the above complaints, INCOSER states, in all cases (except for the complaint under point f), that they are not substantiated and should not be admitted because the complainants do not provide evidence of the calls, and in no case was the right to object exercised. For some specific cases in some complaints, the company provides some additional clarifications as follows: i) For the complaint under (b), it states that the date of the call shown on the screenshot attached to the complaint (i.e. 2019) is different from the date shown in the complaint (and states that "it is therefore not clear exactly which complaint we are called upon to answer"). ii) For the complaint under point (e), the company considers that the truth of the statements made is not verified because the signature of the complainant is missing, and it is also technically and practically impossible, taking into account the way in which the calls are made, i.e. successively through an automated system, to make three calls within a period of minutes.90 iii) For the complaint under point (f), which is the only one for which the company does not indicate that there is no evidence missing from the complainant, it states that it assumes that a technical error was made. iv) With regard to complaint (g), the company states, in addition to the general questioning of the content of the complaint by analogy with its allegations for the other complaints - apart from (f) - that the complainant's reference to the fact that the company's complaints line was not in operation ('does not call') is an arbitrary conclusion because some 12 his call was not forwarded for technical reasons. Further, the company states that an internet search on its11888 service - OTE Information (https://www.11888.) shows that the number in question belongs to M and not to I, who is listed as the complainant, and therefore the complainant has no legal interest in making the complaint, as he is not the owner of the telephone line. v) For the complaint under point (h), the company states, in addition to the general questioning of the content of the complaint by analogy with its allegations and for the other complaints - apart from the one under point (f) - that the complainant's answer NO to the question under point8 (b) of the complaint form regarding the question of whether it is a recorded call is not true, as the communication is automated and recorded. vi) For the complaint under (i), the company states that since the complainant herself states that she listed her phone number on multiple online supermarket pages, including her own, she confesses that she declared her participation in the promotion and therefore requested the communication and therefore everything she complains about is contrary to her actions. The company further submits, as an additional allegation, that the relevant Authority complaint form completed by the complainants states that "in order for the complaint to be substantiated, you must either be registered in the register under Art. 11 with your provider (in which case 30 days must have passed) or you must have exercised the right to object specifically to the controller (advertiser)." On this basis, the company comments in this context on the cases of complaints where complainants indicate that their telephone numbers were registered in the opt-out register of their provider, noting that either the date of registration of this in the register is not indicated in the complaint (under para. e' complaint), or that thirty days had not elapsed since the date of registration of the number in the register (complaint under point d'), or finally that the time elapsed between registration (.../2020) and the making of the call (/2020) was short and 13 there is a possibility that the relevant file (under point (j) of the complaint) may not have been updated. Γ. Finally, INCOSER states that the calls were made on its behalf in the context of its business activity, while the telephone numbers were derived from the entries made by the holders of the telephone numbers themselves ,declaring their participation in the respective promotional activities, on the basis of the relevant terms mentioned above. Consequently, according to INCOSER, the holder of the number also granted the right under Art111. 3471/2006 express written consent to communicate with him. The call made to the number registered at the time of submission was initially automated so that the participant was informed that he could participate in the promotion for which he had registered by pressing the button to1 obtain further information, free of charge. The caller could then either press the button and1 be connected to a company representative, who in real time would provide the necessary and/or additional information requested, or leave the call. If, therefore, he proceeded by pressing the button, 1,which of course indicates again that he expressly wishes and consents to the communication, he would be connected and the representative would remind him of the necessary information, such as the name of the company, the purpose of the call, the possibility of expressing objections/complaints,how to exercise the right of access and theright to object, how to receive the gift, which the caller already knows, having accepted the terms of the promotion. According to the company, no charge is imposed on the participant in the promotion at this stage. All participants were given the opportunity to withdraw their participation and object at any time in a clear and definite manner, both in the terms of the promotion and at the beginning of the conversation with the company's representative. As long as the caller indicated to the representative that they did not wish to receive communications, despite their initial explicit consent to them, they were automatically removed from the relevant list. The registration forms, the files containing the details of the participants and the 14 callers - outgoing calls record was kept for the duration of the promotion, i.e. until the receipt of the gifts, and then deleted, as the purpose of keeping the record had been fulfilled. No use beyond that covered by the purpose of the promotion was made. Given that the calls were made mechanically, following the entry of the participants' number in an electronic database, it is likely that among the numerous calls registered there was an error in the number, due either to a wrong entry of the number in the database, i.e. human error, or to a technical problem in the system carrying out the automated calls. As a measure of extra due diligence, staff were trained at regular intervals to ensure that they were aware of current legislation and company procedures. The process was supervised by an experienced supervisor on a daily basis. Finally, as the company states, numerous calls were made in the context of each promotion, so that only nine (9) complaints, which the company claims are not substantiated, demonstrate the company's adherence to due process. D. In its above reply INCOSER also attaches the company's VAT returns for the months of January to2020 June. 2020. The Authority subsequently invited INFO COMMUNICATION SERVICES to a hearing - ADVERTISING - PROMOTIONAL - COMMERCIAL - RESEARCH AND SURVEYS SINGLE-PARTY JV to the meeting, via videoconference, of the Plenary Session of 31- 03-2021 (see the invitation with the reference number C/EXE/850/16-03-2021). At the meeting of 31-03-2021, Mr. Nikos Petropoulos, lawyer (AMDSA ...) attended the meeting as representative of the controller, who submitted a request for postponement of the discussion, which was granted, setting a new date for the discussion of the case on 23-4-2021. Ms Ioanna Kamarinopoulou, lawyer (DPA ...), representing the controller, attended the hearing on 23-4-2021. After the meeting, the controller was given a deadline for submitting a statement, which it submitted, within the time limit, by 15 document No C/EIS/3392/24-05-2021. This memorandum states the following: α) The controller occasionally engaged in promotions of various products and services by telephone, with clear conditions of participation communicated in advance to participants. It has discontinued that activity since the end of 2019, while providing, in its memorandum, indicative VAT returns of the company for the months of November and December The 2019.company, as mentioned during the hearing of the controller before the Authority, has since then been inactive and remains active with a view to activating one of those activities in the future. It should be noted that during the hearing of the controller the question was raised regarding the complaint under point (j), which concerns a call made during the period in which the company is allegedly inactive, and the representative of the controller replied that this was an error, without further clarification either at the hearing or in his subsequent written submission. (b) The controller, at the start of its activities, had notified its processing operations to the Authority. It reiterates in its memorandum that the promotional activities were carried out only to persons who had registered for participation, having recorded their details on a special form or voucher, thus consenting to be contacted. He also states that this allegation is confirmed - according to the data controller - by the complaint referred to in point (i), since the complainant states that she registered via the internet. At the end of each promotion, the data of the participants are deleted. Further, the controller states that in the calls to each participant, two options are given, either to contact a representative by selecting the key number '1' or to request the deletion of their details from the lists by selecting the key number '2'. (c) With regard to the individual complaints, nothing additional is mentioned in the memorandum, in relation to what the controller had originally stated in its original document. 16 d) During the hearing of the controller, the question of any relationship with PLUS REAL Advertisement was raised, given that according to a search in the General Commercial Register (GEMI), the two companies show the same natural person as Management, have similar activities, while the representative of the controller during his hearing before the Authority also represented, in the same meeting and for another case, PLUS REAL Advertisement. Both at the hearing, and in the subsequent memorandum of the Controller, it was indicated that the two companies in question have different registered offices, different premises, numbers and infrastructure, and with regard to the specific activity that each of them carries out independently, VAT returns of both companies for September 2019 were submitted with the memorandum, showing that they operated in parallel and not in succession. The Authority, having considered all the elements of the file and the arguments presented at the meeting of 23-04-2021, having heard the Rapporteur and the clarifications of the Assistant Rapporteurs, who (assistants) withdrew after the discussion and before the deliberation and decision, and after a thorough discussion, THOUGHT IN ACCORDANCE WITH THE LAW 1.2.It follows from the provisions of Articles 51 and 55 of the General Data Protection Regulation (Regulation (EU) 2016/679 - hereinafter referred to as the GDPR) and the article of 9Law 4624/2019 (Government Gazette A' 137) that the Authority is competent to supervise the application of the provisions of the GDPR, this law and other regulations concerning the protection of the individual from the processing of personal data. In accordance with Article 4(4). 7 of the GDPR, which has been in force since 25 May 2018, a controller is defined as "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data". 17 3. The controller, in the context of its compliance with the principle of fair and lawful processing of personal data (Article 5(1) of the GDPR), must, in accordance with Article 12(1) of the GDPR. 1 of the GDPR, must take appropriate measures to provide the data subject with all the information referred to in Articles 13 and 14 of the GDPR in order to inform the data subject that his or her data are to be processed in a lawful and transparent manner, and in addition must be able to demonstrate at any time that he or she complies with these principles (principle of accountability under Article 5(51) of2 the GDPR). The information obligation incumbent on the controller is detailed in Articles 13 (regarding the information to be provided if the personal data are collected from the data subject) and (14regarding the information to be provided if the personal data have not been collected from the data subject) of the GDPR. 4. The issue of telephone calls, for the purpose of direct promotion of products or services and for all kinds of advertising purposes, is regulated in article 11 of Law no. 3471/2006, which sets out the relevant provisions on unsolicited communications (see paragraphs 1 and 12). It should be noted that, for this issue, the prior consent rule was originally chosen (see previous version of Article 11 of Law 3471/2006). However, with the provisions of Article 16 par. 1 and 2 of Law No. 3917/2011 amended paras. 1 and 2 of Article 11 of Law No. 3471/2006, so that Article 11 par. 1 of Law No. 3471/2006 now stipulates that: "The use of automatic calling systems, in particular using fax or e-mail devices, and more generally the making of unsolicited communications by any means of electronic communication, without human intervention, for the purpose of direct marketing of products or services and for any kind of advertising purposes, is only allowed if the subscriber expressly consents in advance", while the paragraph of the 2same article stipulates that: "Unrequested communications with human intervention (calls) for the above purposes shall not be allowed, if the subscriber has declared to the provider of the service available at 18 public service, that it does not generally wish to receive such calls. The operator shall be obliged to enter such declarations free of charge in a special subscriber list which shall be available to any interested party. Consequently, after 01-09-2011, when the amended provision - which is more favourable to data controllers - came into force, telephone calls with human intervention, in view of the above purposes, are allowed, unless the called party has indicated that he does not wish to receive them (opt-out system). Advertisers, if they carry out telephone promotions with human intervention, must receive from all providers updated copies of the Registers of Article 11 of Law no. 3471/2006 and ensure that they have available the subscribers' declarations made up to thirty days before the telephone call is made (see also the Authority's Decisions No. 62-67/2016). Moreover, pursuant to Article 13 of the above mentioned Law. 3471/2006, the control of the compliance with the provisions of this law is the responsibility of the Authority. 5. In any case, calls without human intervention (automated calls) require, as expressly required by Article 11 par. 1 of the law. 3471/2006, the prior consent of the subscribers is required - even if these numbers are not registered in the opt-out register of their provider. It should be noted that the provision on automated calling, pursuant to Directive 2002/58/EC, has been in force since the entry into force of Law No. 3471/2006 and the previous law. 2774/1999, i.e. it was not affected by the subsequent amendment of Law no. 3471/2006. Besides, automated calls are a quite invasive means of promoting products and services, since by their nature, the recipient of the communication does not easily have the possibility to be informed and exercise his/her rights, as in the case of communication by human intervention. 6. Exceptionally, in accordance with Article 11 par. 3 of Law No. 3471/2006, e-mail contact details lawfully obtained in the context of the sale of products or services or other transaction may be used for the direct marketing of similar products or services. 19 services of the supplier or for similar purposes, even when the recipient of the message has not given his/her prior consent, provided that he/she is given the opportunity to object, in a clear and distinct manner, in an easy and free of charge way, to the collection and use of his/her electronic data, and this during the collection of contact details, as well as in each message, in case the user did not initially object to this use. Furthermore, it is noted that short text messages (SMS) are also e-mail messages according to the definitions of Law no. 3471/2006 and Directive 2002/58/EC. 7. Furthermore, the controller must also satisfy the other rights of data subjects, in particular the rights to information (Article 13 of the GDPR regarding information provided if personal data are collected from the data subject and Article 14 of the GDPR with regard to information provided if the personal data have not been collected by the data subject), access (Article of the 15GDPR) and opposition (Article of the 21GDPR). This means, with regard to the obligation to inform, that when making a telephone call, the controller should inform about his identity and the identity of his representative, not to conceal or falsify the caller's number and to inform about the purpose of the processing and the possibility to exercise the above rights. Furthermore, as regards the right to object provided for in Article 21 of the GDPR, the controller must, in order to comply with the obligation under that provision, ensure that, where a called subscriber objects to receiving calls from that controller (and/or its representative), a clearly defined procedure is followed to ensure that the number is excluded from any telephone marketing/advertising by the controller on the medium of the caller. 8. In the specific cases, on the basis of the above, it appears that the complainant company, as controller, has carried out, 20 automated telephone promotions, as well as promotions via short text messages (SMS). Therefore, the lawfulness of such promotions is ensured if the above considerations are respected. 9. Examination of the facts of the case file shows in particular that the controller makes automated calls to promote products and services without the prior specific consent of the data subjects. That is because the data controller's basic claim that automated calls are made only to those who have given express prior consent is unfounded because it is not borne out by the evidence relied on, for the following reasons: α. For none of the complaints the controller did not provide evidence showing that it had obtained the prior consent of the called subscriber. On the contrary, the controller stated that it considered the complaints inadmissible, without in substance examining them. However, in all complaints detailed information (at least the called and calling numbers, but also the date and time of the calls) is provided by the complainants. As the Authority has already held, and indeed before the entry into force of the GDPR (see, for example, the Authority's judgment in Case No. 66/2016 Decision of the Authority), when the called subscriber is the recipient of an unsolicited nuisance, the only thing he can do to prove it in case he wants to make a complaint is to limit himself to external details of the call and a report of its content (caller's telephone number, time and day of calls, advertiser and, in addition, person with whom he spoke, if declared to him, or other details of the oral conversation). Where the complainant provides full details, the advertiser (data controller) should be able to prove that it did not make the call or that it was made in accordance with the conditions of lawful processing, i.e., in this case, to prove that it had obtained prior consents. 21 This is also fully in line with the principle of accountability (Article 5(2) of the GDPR), according to which the controller bears the responsibility to be able to demonstrate compliance with the principles of lawful processing of personal data. In the cases of the complaints, the controller did not carry out a substantive check on the complainants, since it did not verify whether the contested calls were actually made and, if so, whether prior consent had been obtained. Indeed, it is noteworthy that for the complaint under point (g), the controller carried out a check of the public electronic telephone directory in order11888 to verify the complainant's subscriber details, instead of checking its internal consent records. It should also be noted that, as the Authority has already specified in this regard (see, for example, the already mentioned Decision No 66/2016), in order for the controller to be able to investigate any complaints by data subjects, it should ensure that it keeps the information necessary for the investigation of each complaint. In this particular case, the data subjects' consents should be kept for a reasonable period of time to serve the above purpose - all the more so in the present case, where the data controller was aware, from the Authority's documents, of the existence of complaints submitted to the Authority. Therefore, the deletion of the data of the participants which the controller claims to carry out after the end of the promotion in question cannot justify its inability to prove that the promotions were indeed made to users for whom it had obtained specific consent. β. The very procedure described by the controller regarding the general way of obtaining the consent of data subjects does not ensure that the consents obtained are 22 valid. This is because there is no check as to whether the person who enters his/her data in a consent form is indeed who he/she claims to be, both when filling in paper forms and when filling in electronic forms (see also in this regard the Authority's Directive 2/2011 on electronic consent, which sets out the requirements for obtaining valid electronic consent). Moreover, the risk of personal data being filled in by another third party and not by the data subject is also acknowledged by the data controller itself in its initial response to the Authority in the context of the examination of the complaint under point (a) (see the above mentioned in relation to its letter2018 C/EIS/9369/26-11), while the information text on the processing of personal data that takes place explicitly states that the company considers that each participant is the owner and has exclusive control over the electronic data processing, and that the data controller has no control over the processing of personal data. It follows from this that the company does not carry out any checks on the accuracy of the data provided. Therefore, even if it is accepted that it obtains consents in accordance with the procedure described (for which it has however not provided any evidence), these consents cannot be valid as described above. 10. The controller did not properly inform the data subjects of its identity, since - as is clear from the complaints - none of the complainants was able to name the company because no such information was available (with the exception of the case referred to in point (b)). g' complaint, which however concerns the sending of SMS, and the complaint under point (a), where - despite the fact that the company is named as the complainant - it does not appear that information on the identity of the controller was provided during the relevant telephone promotion). 11. In addition to automated telephone calls, it appears - on the basis of the complaint under point (g) - that the company also sends short text messages (SMS) of a promotional nature. In this case too, 23 as in the case of automated telephone calls, it does not appear that it had obtained the prior consent of the recipient of the message, nor that the exception of Article 11 para. 3 of Law No. 3471/2006 for the sending of such messages without prior consent. 12. Apart from the lack of the conditions for lawful processing in terms of carrying out promotional activities, as described above, the controller does not have, as is clear from the information in the case file, procedures for examining complaints, since it did not - as stated above - carry out a substantive examination of the complaints. Furthermore, in support of this, it is worth mentioning that, in the case of the complaint referred to in point (a) above, the Commission did not take any action against the complainant. i' complaint, the controller interprets the complainant's reference to the fact that she attempted to make online purchases from various supermarkets as a statement that she also attempted to make a purchase from the controller, even though no such statement can be inferred from the complaint, but instead the complainant stated that she was unaware of the supermarket allegedly advertised by the controller. 13. The data controller appears not to have - as it should - a clear knowledge of the legal framework, since it claims that the complainant subscribers had either not registered their number in the opt-out register of their provider or that this registration had been made either in a short period of time before the call was made or in an unspecified period of time. However, as stated above, it is not permissible to carry out automated telephone promotions without prior consent even if the called number is not registered in the opt-out register of its provider. Moreover, even if it were permissible to make such calls to numbers that were not registered in the opt- out register, the controller would have had to obtain the registers from all providers on a monthly basis - which it does not appear that it did, since it makes no mention of it. And the controller's claims of due diligence by training staff at regular intervals to be aware of the applicable legislation and company procedures, for which no documentation is provided, are in any event unproven. 24 14. The controller reports that the number of complaints is low. However, it should be taken into account that, in common experience, not all those who receive summonses in violation of the provisions of Article 11 of Law No. 3471/2006, while indicatively it is noted that for the company's telephone numbers there are web pages on the Internet where subscribers report receiving such unwanted calls, with content similar to that reported by the complainants1. Moreover, given that the company has been inactive (see VAT returns for months of 2019 and 2020 submitted with its memos), it would not be possible that there has been an increase in complaints in recent months (although, as mentioned above, there was one complaint also during the period of inactivity of the controller's activities, for which no clear explanation was given). In any event, the number of complaints cannot in itself, in this case, be a criterion for assessing the extent of the infringement since, as stated above, the controller was in any case not receiving valid consents in the context of its activities. 15. The controller clearly intended to obtain an economic benefit from that processing. 16. Furthermore, the controller did not always respond in a timely manner to the Authority's documents transmitting complaints and requesting its views (see in particular, the documents referred to in points (a) and (b) above). b' - j' complaints, for which the controller sent its replies cumulatively after the Authority's letter No C/EX/4560-1/27-07-2020 - i.e. more than one year after the first relevant letter of the Authority, No C/EX/1342-2/10-04-2019, by which the initial complaints had been transmitted to it). Moreover, despite the Authority's documents, the same activity was still being carried out by the controller, without complying with the conditions for lawful processing of personal data. 1 See for example https://www.white-pages.gr/ and https://www.white-pages.gr/ (last accessed: 2021) 25 17. The Authority, taking into account the above established infringements of Articles 13 and 14 of the GDPR and Article 11 of Law No. 3471/2006 and taking into account on the one hand that the data controller: i) aimed at financial gain from such processing for as long as the company was active (since there was a charge for users if they made the appropriate key selection to proceed further); ii) did not have a procedure for examining/meeting data subjects' complaints; iii) did not respond in a timely manner to the Authority's documents by continuing processing without taking into account the Authority's observations; and iv) was not aware of the relevant legal framework, since582 the data controller was not aware of the relevant legal framework. 1(b) of Act No. 2472/1997 (which remains in force pursuant to Article of 84Law 4624/2019), the administrative penalty of a fine, referred to in the operative part of the present decision, which in any case is deemed - by virtue of the article of the 83GDPR - effective, proportionate and dissuasive. FOR THESE REASONS The Authority Impose on INFO COMMUNICATION SERVICES ADVERTISING - PROMOTIONAL - COMMERCIAL - RESEARCH AND PUBLICATIONS COMPANY, as the responsible person processing, the effective, proportionate and dissuasive administrative fine appropriate to the specific case in accordance with the specific circumstances of this case, amounting to thirty thousand euros (30,000.00) euros, for the above violations of Articles 13 and 14 of Regulation (EU) 2016/679 and Article of 11Law No. 3471/2006, in accordance with Article 13(58i2) of the GDPR in conjunction with Article 83(1)(a) of the GDPR. 5 of the GDPR, and with Article 21(5) of the GDPR, and with Article 21(2)(a) of the GDPR. 1(b) of Law No. 2472/1997, in conjunction with Article 13 par. 4 of Law No. 3471/2006 and Article 84 of Law 4624/2019. 26 The President Konstantinos Menoudakos IriniThe Secretary Papageorgopoulou 27