HDPA (Greece) - 57/2021
| HDPA (Greece) - 57/2021 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 13 GDPR Article 14 GDPR N.3471/2006 Article 11 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 12.07.2021 |
| Published: | 31.12.2021 |
| Fine: | 25,000 EUR |
| Parties: | PLUS REAL ADVERTISMENT |
| National Case Number/Name: | 57/2021 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Greek |
| Original Source: | HDPO (in EL) |
| Initial Contributor: | eleni.papadopoulou |
The Hellenic DPA fined a controller €25,000 for failing to provide information concerning their personal data to data subjects under Article 13 GDPR and Article 14 GDPR when making automated marketing phone calls.
English Summary
Facts
Two individuals submitted complaints before the Hellenic DPA (HDPA) against advertising company PLUS REAL ADVERTISMENT (henceforth: PLUS REAL) for unlawful processing of personal data for purely marketing purposes. PLUS REAL used an automated mechanism making telephone calls in order to contact individuals for advertising and marketing purposes.
As regards the first complaint, the individual received a phone call from an unknown number with a recorded message informing them they won a prize of €680,00. After some seconds a human person was on the line telling the individual they had to make an extra call and give a special code in order to win their prize, without giving him more details regarding accurate call charges. The individual made that second call and heard from recorded message that the call charges were higher than the ones mentioned on the first call, and that the line was busy, so they had to call again. After their third attempt, the individual spoke to an operator and realised that the prize was actually vouchers offered only in case the individual made high cost purchases.
As for the second complaint, the individual mentioned that they received a telephone call from an unknown number with a recorded message telling them they won money as prize for a competition, but the individual did not manage to hear the name of the company referred.
The Hellenic DPA asked integrated communication solutions companies MICROBASE and LEXITEL to whom the unknown numbers belong to, and was informed that the owner was PLUS REAL.
Holding
After reviewing the facts of the case, the HDPA first stated that PLUS REAL is a controller under Article 4(7) GDPR because it processed personal data of individuals for conducting automated phone calls to them with recorded messages.
Moreover, the HDPA held that PLUS REAL was in breach of Article 11 of the Greek Law on Unsolicited Communications (Law 3471/2006) and GDPR because it made these calls for advertising and marketing purposes without previously obtaining consent from the data subjects .
In addition, the HDPA held that PLUS REAL failed to comply with the principle of accountability under Article 5(2) GDPR according to which the controller bears the responsibility to demonstrate compliance with the principles of lawful processing of personal data.
Furthermore, PLUS REAL did not reveal to data subjects its identity as controller, and did not have a mechanism to respond to data subjects requests for information concerning their personal data.
Therefor, the HDPA fined the controller, PLUS REAL, €25,000 under Article 58(2) GDPR and Article 83(5) GDPR for the breach of Article 13 GDPR and Article 14 GDPR for failing to provide adequate information to the data subjects when making the marketing phone calls, as well as violating Article 11 of the Greek Law on Unsolicited Communications (Law 3471/2006) for not obtaining consent for the processing of personal data to make these calls.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Category Decision Date 05/01/2022 Decision number 1 Thematic unit 15. Video surveillance 16. Other Applicable provisions Article 12.3: Deadline for responding to a right Summary A toll management company operates a video surveillance system in order to detect non-payment of tolls. After being informed about a fine imposed on him, a car owner. exercised the right of access to the company in order to obtain photographic material and a copy of the incident book in connection with the imputation of the infringement. The company initially replied that the crossing had been recorded by the toll station crossing system, but could only provide information by order of the Prosecutor and with the relevant permission of the Authority. Following the intervention of the Authority, the company provided the available data, which did not include visual material. The Authority, which had informed the company as early as 2017 that such requests constituted an exercise of the right of access,which he has to satisfy, he imposed a fine of 1,000 euros due to delayed satisfaction of a right. PDF of the decision Imposition of a fine for late satisfaction of the right of access
