HDPA (Greece) - 8/2026
From GDPRhub
| HDPA - 8/2026 | |
|---|---|
 | |
| Authority: | HDPA (Greece) |
| Jurisdiction: | Greece |
| Relevant Law: | Article 5(1)(d) GDPR Article 12(1) GDPR Article 12(3) GDPR Article 15(1) GDPR Article 28(1) GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 22.10.2023 |
| Decided: | 05.06.2026 |
| Published: | |
| Fine: | 110,000 EUR |
| Parties: | ZENITH SA (ΖΕΝΙΘ ΑΕ) PIRAEUS BANK (ΤΡΑΠΕΖΑ ΠΕΙΡΑΙΩΣ) |
| National Case Number/Name: | 8/2026 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | HDPA (in EL) |
| Initial Contributor: | ds |
The DPA fined an energy provider €100,000 and a bank €10,000 over a customer’s disputed direct debit mandates. Both controllers failed to properly respond to his access requests and breached the accuracy principle, while the energy provider also failed to control its processor.
English Summary
Facts
On 27 May 2020, a data subject entered into an electricity supply contract by telephone with the Greek energy provider ZENITH (controller A) for three service connections. The contract was concluded through controller A’s processor, Sigma and Kappa Import S.A. During the call, the data subject provided his bank account number (IBAN), at least for the purpose of paying one of the services by direct debit. On 4 June 2020, during a subsequent phone call with the processor, the data subject stated that he did not want the other two services to be paid by direct debit. When the relevant contract documents were later sent to him for signature, he signed only one of the three direct debit mandate forms.
However, the data subject subsequently noticed that all three electricity bills were being paid by direct debit. On 13 August 2020, he contacted controller A to complain about the matter. Controller A replied on 2 September 2020 that two additional direct debit mandates had been activated inadvertently because its processor had failed to take the necessary steps. The data subject then repeatedly requested copies of the signed direct debit mandates, but claimed that controller A did not properly respond to those requests.
The data subject also contacted his bank, Piraeus Bank (controller B), since the disputed payments were being made from his bank account. He argued that he had never authorised the two additional direct debit payments and made an access request on 16 February 2023, requesting copies of the direct debit mandates and information concerning their activation. Controller B replied that it acted only as an intermediary in the execution of payments and had a merely administrative role in the process. It did not provide copies of the mandates or access to the relevant electronic records held in its systems.
On 22 October 2023, the data subject lodged two separate complaints with the Greek DPA (HDPA) against controller A and controller B, arguing that both controllers had infringed his right of access. Controller A argued that it had investigated the issue after the data subject’s initial complaint and had contacted its processor. According to controller A, the processor had reviewed the recorded telephone conversation and confirmed that the data subject had initially agreed to the activation of direct debit mandates for all three services, but later clarified that he wanted the mandate to apply only to one service. Controller A acknowledged that only one of the three mandate forms had been signed, but maintained that the data subject had not clearly revoked his earlier consent regarding the other two mandates. It also argued that, after being informed of the situation and the available cancellation options, the data subject did not cancel the mandates and only returned to the matter two years later, when the relevant call recording was no longer available. Controller A further maintained that it had already responded to the data subject in a timely and sufficiently detailed manner on 2 September 2020.
Controller A also stated that it had concluded an agreement with its processor on 1 May 2019, under which the processor had to transfer the recorded call files to it, without keeping or copying them, and then delete the data from its own records. Controller A noted that, under its own retention policy, such data should be retained for five years after the end of the customer’s contract. However, it explained that, in practice, the processor operated the telephone recording system and had direct control over the recorded files. For this reason, the agreement was amended on 1 August 2021 to reflect the actual setup, expressly providing that the recorded calls were retained in a specific log file maintained by the processor. Since a long period of time had passed and the matter was considered closed, the processor had deleted the data subject’s recorded call.
Controller B argued that it had not violated the data subject’s right of access. It stated that it had informed him that it had received, via the interbank payment system, electronic files from controller A containing the details of the three direct debit mandates. It also argued that it had described the information it held and explained how the SEPA Direct Debit system works. According to controller B, it could not provide copies of the signed mandates because it did not receive or retain the original written mandates. It further argued that it had neither the factual nor the regulatory ability to verify or modify the content of the direct debit mandates received from controller A.
Holding
Regarding controller A, the DPA found that when the data subject first challenged the activation of the direct debit mandates, the recorded call of 27 May 2020 was still available. Controller A therefore could and should have obtained direct access to the recording in order to verify its content and respond to the data subject on the basis of its own assessment, instead of merely relying on the processor’s review. The DPA also noted that, in its response of 2 September 2020, controller A had presented the relevant facts as established, accepted responsibility, and apologised to the data subject for the distress.
The DPA held that, by 2 September 2020, controller A was already aware that the registration of direct debit mandates for two of the three services had been made inadvertently and did not reflect the data subject’s actual intention. As the controller, it should therefore have taken the necessary steps to correct the inaccurate data it held about him. According to the DPA, it instead continued to retain the inaccurate data and shifted the burden of correction to the data subject by asking him to take additional steps to cancel mandates which he had not validly given. The DPA also noted that the data subject’s objections could essentially be treated as rectification requests under Article 16 GDPR. It therefore found that controller A had violated the accuracy principle under Article 5(1)(d) GDPR and imposed a fine of €25,000.
The DPA further noted that controller A responded to the data subject’s access request only after five months and merely referred him back to its previous communication of 2 September 2020. It stated that it did not provide accurate and complete information, in particular regarding the fact that it no longer held the signed mandate form relating to the data subject or the recorded telephone conversation. The DPA therefore held that controller A had violated Article 12(3) GDPR, as well as Article 15(1) GDPR read together with Article 12(1) GDPR, and imposed a further fine of €25,000.
Finally, the DPA found that the processor had not followed controller A’s instructions. It pointed out that the processor did not transmit the recorded calls to controller A in accordance with their agreement, did not retain them in line with controller A’s retention policy, applied its own retention period, failed to properly register the data subject’s request to modify or cancel the direct debit mandates and did not retain even the single signed mandate form. It took into account that, despite these failures, controller A did not carry out an audit or require the processor to comply with its instructions but it instead amended the agreement in 2021 in a way that retroactively approved the processor’s practices. The DPA concluded that controller A had failed to use a processor providing sufficient guarantees for the implementation of appropriate technical and organisational measures, in breach of Article 28(1) GDPR, and imposed a fine of €50,000.
Regarding controller B, the DPA held that it was an independent controller for the electronic data it processed in order to execute the direct debit payments. The fact that controller B did not hold the original signed mandates did not release it from its GDPR obligations. Since controller B held electronic records relating to the disputed direct debit mandates, it should have provided the data subject with access to those records or otherwise given him the relevant personal data it held. By failing to do so, controller B infringed Article 15 GDPR. The DPA fined controller B €10,000.
Moreover, the DPA accepted that controller B was not required to verify the correctness of the direct debit mandates when it first received them through the interbank system. It noted however, that once the data subject directly informed controller B that the data relating to certain direct debit mandates was inaccurate, controller B, as an independent controller, had to ensure the accuracy of the personal data it continued to process. It should therefore have at least investigated the claim and sought further information from controller A in order to verify whether the data recorded in its systems was accurate. The DPA concluded that controller B breached the accuracy principle under Article 5(1)(d) GDPR. For this violation, the DPA issued a reprimand.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
Athens, 05-06-2026
No. Prot.: 2547
DECISION 8/2026
The Personal Data Protection Authority, convened, following the invitation of its Acting President and Vice President, Georgios
Batzalexis, following the resignation of its President Konstantinos Menudoudou, in a regular
meeting in a Department composition via videoconference on 27-05-2026,
in order to examine the case referred to in the history of this case.
The meeting was attended by the Deputy Chairman of the Authority, George Batzalexis, and the alternate member Maria Psalla, as rapporteur, in place of the regular member Grigorios Tsolias, who, although he had been duly invited in writing, was absent due to impediment, and the alternate member Dimosthenis Vougioukas in place of the regular member Konstantinos Lambrinoudakis, who, although he had been duly invited in writing, was absent due to impediment. Present, without the right to vote, were Haris Symeonidou, special scientist - auditor, as assistant rapporteur and Irini Papageorgopoulou, employee of the administrative affairs department of the Authority, as secretary. The Authority took into account the following:
With the no. prot. C/ΕΙΣ/7484/22-10-2023 and C/ΕΙΣ/7485/22-10-2023
his complaints to the Authority, A (hereinafter referred to as the “complainant”),
is directed against the company with the name “ΕΤΑΙΕΙΑ ΠΕΙΑΜΙΤΗΙΑΣΙΑΣΙΑΣΙΑΣΙΑΣΙΑΣΙΑΣΙΑΣΙΑΣΙΑΣΙΑΣΙΟ ΑΙΟΙΟ” and the distinctive title “ZeniΘ”
(hereinafter referred to as “ΖΕΝΙΘ”) and against Piraeus Bank S.A. (hereinafter
1referred to as the “Bank”), respectively, for violation of the right
of access to his personal data. Specifically:
A) In accordance with the first above complaint against ZENITH, three
(3) electricity bills based on a contract concluded in 2020 are being paid through standing orders to the complainant's account at Piraeus Bank,
one of which is in the complainant's name and two in the name of his wife
, B. After being informed via e-mail on 2/9/2020 by ZENITH
(customercare@zenith.gr) that there is a standing order for the payment of bills
in his name and that two more standing orders had been activated incorrectly,
as the ZENITH associate "by mistake did not take the necessary
actions" (see the supplementary document under no. protocol G/ΕΙΣ/559/23-01-2024), the
complainant repeatedly requested from ZENITH the provision of copies
of signed standing orders, however, according to the complaint, ZENITH
did not respond in any way to his requests. Specifically, the
complainant provided his request dated 11/10/2022 via e-mail to the
address customercare@zenith.gr as well as the
response dated 20/10/2022 from ZENITH that the complaint has received a reference code -… and that further
investigation is required. However, until the submission of the complaint (one year after
the above response), he had not received a definitive response to his request, as
he stated. In the context of investigating the aforementioned complaint, the Authority, with the no.
prot. C/EXE/383/24-01-2024 document forwarded the complaint and the relevant
documents to the accused ZENITH and invited it to present its views on
the accused, providing all relevant documentary evidence. Because the
Authority did not receive a response to the said document, with the no. prot. C/EXE/1134/12-
04-2024 reminder document it again invited ZENITH to immediately submit its
views on the complaint. With the no. prot. C/ΕΙΣ/3580/17-04-2024
response document, the accused ZENITH first stated that the
complainant, who has been its customer since 2020, when a contract was signed between them for the supply of electricity through an external partner (the
company "Sigma and Kappa Import S.A."), contacted ZENITH for the first
time on 13/8/2020, complaining about the standing order for payment of the aforementioned
bills, for which he claimed that he had not provided his consent,
and due to the measures to address the pandemic that were in force at that time,
the company's management system was overloaded by the volume of requests
it was receiving. Nevertheless, as ZENITH claims, on 20/8/2020
it immediately proceeded to a thorough investigation into the complainant's complaint,
contacting the above external partner, who informed it that
after checking the recorded conversations that took place on 27/5/2020,
at 11:57 in a call made to the landline -… and lasted 22 minutes and 23
seconds, at the 16th minute of the conversation and while the details of the 3 benefits had already been provided by the customer,
he himself disclosed the IBAN registered in his
card, with the aim of directly paying the bills that
corresponded to the benefit with number … via a standing order. The conversation in question was recorded in the context of carrying out a legitimate professional practice for the purpose of activating the service with the customer. Subsequently,
the partner proposed that this order apply not only to the provision of
the garage but also to the other services, so that the complainant would benefit
from the non-payment of a guarantee, which the complainant initially accepted, as
ZENITH reports, but in a subsequent communication with the said
partner on 4/6/2020, after he had signed and consented to the payment of
his benefit bills via standing order, the complainant clarified that
he wanted this payment method to apply only to the provision corresponding
to the garage … and not to the household services, as he preferred to deposit the
guarantees in these.
According to ZENITH, there was no other reason for the complainant to disclose the IBAN number of his bank account, apart from
satisfaction of his request regarding the standing order for payment of the bills. Subsequently, as ZENITH reports, during the examination of the complainant's complaint in August of the same year, it was found that, by mistake and subsequently, the specific standing order activation form had not been attached to the contract, resulting in only a verbal standing order. Thus, it contacted the complainant on 2/9/2020, via email, informing him of the fact that, by mistake, its associate had not taken the necessary actions and, after apologizing for the inconvenience, informed him of the possible 3 ways to cancel the standing orders on his behalf. According to the
complainant, the complainant never questioned or opposed the
content of the above communication and never followed the aforementioned
procedure for canceling the orders, on the contrary he accepted their continuation, while
he contacted the company again about the same issue 2 years later, in October
2022, requesting copies of the standing order, even though he knew that the
activation had been carried out via a recorded call and was in
valid for two years. According to the same response, on 11/10/2022 the complainant
requested to be informed why the standing order was activated without
his consent, requesting for the first time a copy of the disputed
recorded call, and upon re-examination of his request and after
contacting the aforementioned collaborating company, the latter
notified ZENITH that the call was no longer available, due to
a long period of time having elapsed since its occurrence, while the complainant
was informed of the above verbally and in writing. In particular, the electronic letter dated 3/3/2023, which ZENITH provided, states the following: "We would like to inform you that ZENITH has already responded to you regarding your standing orders with the electronic letter dated 02.09.20
that it sent to you, which is attached". In addition, with the same no. prot.
Γ/ΕΙΣ/3580/17-04-2024response to the Authority, ZENITH provided the
Process for Managing Subject Requests (version dated 19/12/2023 which replaces
the initial version dated 6/2/2020), the
Policy for Protection and the
Preservation Plan for Personal Data (with initial version on 24/6/2021 and revisions on
15/4/2022, on 7/7/2023 and on 19/12/2023) as well as the
Directive for Recording of Telephone Conversations of the company dated 11/12/2023. According to the submitted Personal Data Retention Plan dated 19/12/2023, the recorded telephone calls relating to the conclusion of a supply contract are retained by ZENITH “Throughout the duration of the contract + 5 years”, while the data relating to the receipt and management of a standing order request from a Customer are retained “For as long as the contract is in force + 5 years from the end of the year in which the contract was terminated and in any other case 5 years from the submission of the request or until the withdrawal of the customer’s consent”. Subsequently, after the complainant requested and received from the Authority a copy of the above response of the complained ZENITH, with no. prot. C/ΕΙΣ/3857/25-
04-2024 his supplementary document, pointed out that this is the first time he is being informed
about the existence of a third company with the name "Sigma and Kappa Import S.A.",
since the information he had on the phone was "we are from ZENITH".
The
complainant noted that he immediately complained to ZENITH about his lack of
consent for standing orders and emphasized that according to clause 23,
among other personal information, the IBAN Account Number is requested in
the context of concluding the contract, without mentioning that it is possible to join a
standing order program by disclosing only the IBAN number or
upon a verbal request from the client. He further disputed the claim
that he had consented to and signed the standing orders, a fact which is proven,
as he states, by the relevant documents which he did not hand over to the carrier
when signing the contracts and which are still in his possession, as
he did not wish the bills to be paid through standing orders.Furthermore,
he pointed out that even the one standing order that he ultimately signed, according to
ZENITH's response, "was not attached to the contract by mistake, with
the result that there is only an oral order", and wondered why
the client's signature is therefore required to activate the standing order, since, ultimately, in ZENITH's opinion, the oral order is sufficient,
which in fact has not been preserved in his case. Furthermore, the complainant
stated that the procedure for cancelling standing orders can only be carried out by the person who ordered them, who in this case is not
himself. The oral order, in his opinion, was invalid, therefore void and
given that he had already challenged the other orders, stating that
unauthorized transactions were being carried out, ZENITH should have
canceled them. According to the complainant, the actual fact of the continuation
of payment of electricity bills through standing
orders does not necessarily mean acceptance of this method of payment,
given that he was waiting for ZENITH and 5Piraeus Bank to provide him with copies of the orders, which, as it now turns out,
do not exist. Finally, he pointed out that according to terms 6.4 and
20.10 of his contract, the telephone call was to be kept for 5 years after
the end of the contract, while he was first informed through
ZENITH's response to the Authority that the specific call was no longer
available. Therefore, since there are no signed written orders or
recorded verbal requests for their activation, the complainant
noted that a serious issue arises for the security of transactions, in the absence of
elementary checks.
B) According to the second above-mentioned complaint against Piraeus Bank, the
complainant, who is a joint beneficiary of a Bank account together with
his wife, B, and his son, C, following the finding that electricity bills are paid to
ZENITH through the above
account, despite the fact that the above had not given a relevant standing order, with the
out-of-court statement dated 16/2/2023, requested from the Bank, among other things,
the grant of copies of the standing orders on the basis of which the said
accounts were paid, to be informed of how the standing orders were activated and to be notified of any relevant document. However, as the complainant claimed, although the Bank responded to the said out-of-court statement on 22/3/2023, stating that the assignment order was given electronically by the ZENITH organization on 27/5/2020, it refused to send and provide copies of the said standing orders, claiming that it “acts as an intermediary for the payment of the payments, maintaining an administrative role in the process” and did not respond to his request until the submission of the complaint. In the context of the investigation of the aforementioned complaint, the Authority, with its reference no. prot. G/ΕΣΕ/375/23-01-
2024 document forwarded the complaint and the relevant documents to the
complained Bank and invited it to present its views on the
complained, providing all relevant documentary evidence. With the no.
prot. C/ΕΙΣ/984/08-02-2024 its response document, the Bank stated the following:
that on 04/10/2022, a request from the
complainant for a copy of the signed direct debit orders was received via a communication form, through which the electricity and
gas bills are paid at ZENITH and that the Bank, on 05/10/2022, sent a reply letter to the customer's declared
email address informing him that
in order to proceed with the personalized investigation of his case,
a telephone call with him was required, for reasons of confidentiality, that the Bank acts as an intermediary for the payment of
payments, maintaining a processing role in the process and that in any
case, the complainant could contact the competent Bodies/Organizations, so that they could direct him in this regard from their side. In a telephone conversation that the Bank had with the complainant on the same day, the latter stated that two years ago he had signed a contract with ZENITH and that he was
sure that he had never assigned direct debit orders, he was informed
by the Bank's representative that he should contact ZENITH in order to
be informed about the procedure for assigning direct debit orders,
as these were determined by the body (ZENITH) and not by the Bank. According to the Bank, because the complainant appeared particularly negative in the communications with it, on 06/10/2022 the Bank sent him a new reply letter, informing him of the possibility of submitting a complaint through the Complaints Management Mechanism, if he had not been satisfied with the handling of his request up to that point. On 17/10/2022, a request was received, through the Bank's complaint form, from a complainant, according to which, although he had provided his bank account number to ZENITH by phone, he had not signed any document for the assignment of standing orders, and requested to be informed of the origin of the assignment of the direct debit orders that were registered with the Bank, based on which documents they were registered, as well as to be sent the relevant signed documents. As the Bank reported, from the investigation of his case by its competent Unit, it emerged that the Bank received on 27/5/2020, through the DIAS interbank system, three (3) direct debit orders from ZENITH debiting the bank account, in which the complainant is a co-beneficiary and he appears as the one who issued the orders. By its letter dated 15/11/2022, the Bank informed
the complainant that, pursuant to the relevant legislation governing payment services,
it processes payment services only upon a relevant
order and authorization from the customer and/or the business with an order that
is transmitted directly to the Bank by the Beneficiary or the Payment Initiation Service Provider as defined in Art. 1 par. 1.2 Chapter E of the
PAYMENT SERVICES AGREEMENT, to which, in each case, the
customer and/or the business has previously given its consent for
the execution of the transaction. Therefore, the assignment of a direct debit order can
be made directly to the Organization using IBAN only, and this
possibility of assignments directly to the Organization is provided under the
terms of the payment services agreement (paragraph 2.1 g), which
forms an integral part of the Bank's general terms and conditions, of which
the complainant has been informed and which he has accepted when
opening his account. In this case, the Bank received direct debit orders from the ZENITH organization, debiting the specific bank
account and for this reason referred the complainant to ZENITH,
in order to inform him about how any assignment of a direct debit order was registered. In conclusion, the Bank argued that it has
a facilitating role in the process, as a payment intermediary. Subsequently,
according to the same response, on 21/02/2023, a judicial
bureaucrat notified the Bank of an extrajudicial statement by the complainant, in which the
latter requested again the provision of copies of the signed
direct debit orders to ZENITH and information on how to
activate them, claiming that he had not received a response to his
requests for copies of the orders from ZENITH. The Bank stated that, in
order to serve the complainant, it contacted National Bank, through which ZENITH has signed up to the DIAS payment system, for more information
regarding the case, and which forwarded to Piraeus Bank
the following response from ZENITH: "We have every intention of cooperating, but in accordance with the mandatory provisions of the GDPR, the transmission of the data in question would constitute an unlawful act, so we have started an investigation into the matter and Zenith will contact the customer and inform him of its progress." With the response letter of Piraeus Bank dated 22/03/2023, the complainant was explained how the payment system DIAS operates and the procedure for receiving and registering requests for direct debit orders directly from companies: Specifically, if a company has joined the Interbank Payment System (DIAS), it has the possibility of sending an electronic file with direct debit orders for the payment of its customers' accounts at DIAS. DIAS then sends the files to the
corresponding Bank where the client maintains his declared bank account.
According to the Bank, based on the Service Agreement after the
required verification of the data, the Bank is obliged to proceed with the
immediate execution of the orders, while it does not receive signed copies of the
relevant assignments. The process is carried out automatically through the
company DIAS Interbank Systems S.A. On 09/10/2023, the complainant
submitted a new request of similar content and on 11/10/2023, the Bank
replied to him that it had received the orders electronically from ZENITH; therefore, the
complainant should have contacted ZENITH to be provided with copies
of the orders. Finally, the Bank stated that it made every effort, within its competence, to satisfy the complainant's request and informed him in detail about the possibility of contesting the direct debit orders, revoking them and returning his money within a predetermined time period, since it considered that the orders were not authorized by him, however, the complainant did not proceed with any of the above actions. Subsequently, after the complainant requested and received from the Authority a copy of the above response of the complained Bank, with the no. prot.
G/ΕΙΣ/3348/10-04-2024 supplementary document, he first argued that
in order to execute a transaction, the Bank must have in its possession
the customer's order, which can be given directly to the Beneficiary
(ZENITH), but is transmitted to the Bank in order to execute the transaction
and he questioned how the Bank has been processing transactions to date.
He further emphasized that the Bank undoubtedly had in its possession the standing orders,
or the direct debit orders from ZENITH, but stubbornly refused to grant them to him.
Furthermore, as he mentioned, with the Bank's response dated 15/11/2022,
he was informed that no standing order was found in his name nor a standing order with a debit card,
even though the Bank's response dated 22/3/2023 stated that the person ordering the standing orders was himself, and not his son and the first beneficiary of the account. The complainant emphasized that despite the Bank's claim to the contrary, he has disputed the transactions from the very beginning from 2020 and the Bank has not taken any action beyond informing him that it has a processing role in the process, while he argued that he cannot revoke orders that he has not given. Finally, he questioned
whether the Bank is required to check the orders transmitted to it by third-party
organizations, what information is included in these orders, whether they are transmitted
in writing or electronically, and how the Bank verifies the customer's consent to the transaction, given that it bears
responsibility for the security of transactions and argued that direct debit orders constitute the customer's personal data, therefore the Bank
was required, since it had received such orders from the organization (ZENITH), to grant them to the customer, as the data subject. According to the
complainant, a major issue of transaction security is raised and that a
legal action on the part of ZENITH, namely the knowledge of his bank account number (IBAN) and his personal details, was used,
unknown by whom, how and in what manner, in collaboration with the Bank, so that
his account was continuously breached.
Following the above, the Authority, with the no. prot. C/ΕΣΕ/685/05-02-2026,
C/ΕΣΕ/684/05-02-2026 and C/ΕΣΕ/682/05-02-2026 summons the
complainant, the defendant ZENITH and the defendant Bank,
respectively, to a hearing before the Department of the Authority on 25-02-2026
in order to present their views on the case, notifying
each defendant of the complainant's additional documents that
concerned her and were not already known to her. At the same time, with the above summonses, the
Authority requested the company ZENITH to provide a copy of any
processing contract in force at the time of the facts (in accordance with Article 28, paragraph 1 of the GDPR) between ZENITH and the
company "Sigma and Kappa Import S.A." referred to in its response.
10 The meeting of 25-02-2026 was attended via videoconference by the
complainant, on behalf of ZENITH, its attorney Konstantinos
Panagos (Registered by the Board of Directors…) and the Head of Retail Sales and Support Operations of company D, while on behalf of Piraeus Bank, E, Business Analysis Manager, F, Payment Products Manager, Z, Head of Retail Payments, H, Product Specialist, Vasiliki Maria Saldari, lawyer
- Legal Director (Registered by the Board of Directors…), Vasiliki Moraiti, Lawyer (Registered by the Board of Directors…), while the Data Protection Officer (DPO) of company,
Θ, for the provision of clarifications. During the meeting, the Authority granted
a deadline until 20/03/2026 for the submission of memoranda and subsequently
ZENIT company submitted the memorandum under no. protocol C/ΕΙΣ/4027/20-03-
2026, and Piraeus Bank submitted the memorandum under no. protocol C/ΕΙΣ/4029/20-03-2026
within the deadline, while the complainant did not submit a memorandum.
During the hearing, the complainant reiterated the statements made in his complaint
. The defendant ZENITH, both through its representatives at the hearing and subsequently in its memorandum, first stated the general personal data protection measures that it has taken and is implementing, provided a detailed history of the case and argued that on 27-5-2020, in the context of concluding an electricity contract through an authorized partner (of "Sigma and Kappa Import S.A."), the complainant disclosed bank account details (IBAN), and expressed his will to activate a standing order for payment, initially for one service (garage) and then, after informing the partner that the choice of a standing order entails avoiding payment of guarantees on household invoices, and for other services, and thus, in June 2020 The three standing orders for bill payment were activated in the ZENITH information system. ZENITH claims that "in the context of a formal
procedure" the relevant confirmation documents and the contractual
forms were sent to the complainant, who, however, signed only one of the three
standing order forms. However, ZENITH claims that "the non-signing of the other
two was not accompanied by any explicit, clear and specific declaration of revocation of the already
expressed intention to activate, nor was a request (oral or
document) made for the immediate deactivation of the relevant orders", while the complainant's subsequent
11 communication on 4-6-2020, in which he expressed his desire
that the standing order should concern only one service, was not submitted through the
provided corporate channels and was not registered as a change request
in the system. In addition, it states that, when the complainant again
applied to the company in August 2020, he stated that he did not want the standing orders to be deactivated
until he received a written response. According to ZENITH,
after an internal audit and communication with the external partner,
it was confirmed that a standing order activation order had been given by telephone for
all three benefits, while on 2-9-2020 the company sent a detailed written
response with a description of the incidents and instructions for the cancellation process.
ZENITH claims that after its response, the complainant did not submit a request for
cancellation, revocation, deletion or correction of data, nor did he further dispute
the situation for approximately two years, while when he returned in 2022,
requesting further explanations, the relevant recorded calls were no longer
available due to the limited record retention policy of the external
partner. At the same time, it claims that it has repeatedly informed
the complainant of the possibility of stopping the standing orders, without receiving
a clear relevant order. According to ZENITH, if the claim that a request for deactivation is not required due to the lack of signature of the standing order forms were accepted, we would be led to the paradox of a regulation remaining permanently active without the practical possibility of its termination by the subject himself and therefore, the inability to revoke due to the alleged failure to sign the relevant form invoked by the complainant cannot, according to ZENITH, establish a claim of inaction or violation on its part, but on the contrary, it highlights the absence of a declaration of will by the complainant to change the existing situation. ZENITH claims that it has a procedure for the registration of standing orders, through its information systems and interbank payment infrastructures, analyzing the service channels through which standing order activation requests can be submitted and in particular the process of transmitting requests through the Sales Back Office that is of interest in this case. It clarifies that,
in this case, the activation of a standing order requires the existence
of appropriate documentation of the customer's relevant will, either in the form of
a handwritten signed standing order request, which indicates the
bank account number (IBAN), the banking institution and the
name and surname of the beneficiary, or in the form of a recorded telephone
communication, in which the customer expressly declares that he accepts the
activation of a standing order, while simultaneously mentioning the IBAN and the name
of the beneficiary of the account. After the data is registered in the company's CRM information system and the request is transferred to the IEBS information system for customer management and billing, a relevant electronic file is created that includes the standing order activation request, which is sent via secure communication protocol (SFTP) to the DIAS S.A. organization system and is then transmitted to the client's relevant credit institution, which checks and approves the order. After receiving approval from the bank, the result is registered in the IEBS system and the customer's CRM record is updated, at which point the standing order is put into an active state, as happened in the case of the complainant after 27/5/2020. Regarding the recorded conversation of 27/5/2020, ZENITH
presents as Exhibit 9 its contract dated 1/5/2019 with the company Sigma and
Kappa Introduction S.A., in clause 11 of which the following is defined: “Sigma and
Kappa Introduction S.A. is responsible for the management of the Call Log […] The files created by the collection and transmission of personal data belong exclusively to the Company, which is responsible to the competent authorities for their preservation and/or destruction, Sigma and Kappa Import S.A., operating as a processor on behalf of the company, is also responsible for the processing of the personal data that it collects and/or processes for the needs of this agreement.Sigma and Kappa Import S.A. is obliged to deliver
to the Company the means (electromagnetic or not) by which the records are kept,
without having the right to retain or reproduce copies and to
delete the data from its own records, immediately after transmission to
the Company”, while Annex II of the said contract includes term 6.7.1,
according to which “…the Processor and each Authorized
13 Partner and each Processing Subcontractor is obliged to make available
to the Company, if requested, all necessary information for
proving compliance with this and allows and contributes to audits, by
the Company or an independent body contracted with the Company to ascertain
the manner of Processing of the Company’s personal data”. However,
ZENITH argues (See page 10 of its memorandum) that in practice the technical
system of telephone calls, as well as the system for recording and
storing the recorded files, were operated and maintained by
the same partner, who had direct control of the relevant file, i.e.
recorded files were kept in the information system of the company performing the
processing, and for this reason, as it states, "in order to
more clearly reflect the actual operational operation of the
partnership, the relevant term was amended by agreement of the parties on 1-8-2021,
so that it was expressly provided that the calls made within the
framework of the collaboration are recorded and maintained in a special electronic file (call log) maintained by partner" (see point 3.3.1 of the attached
related file entitled "9. Amendment of T&C 01.08.2021"). Therefore,
according to ZENITH's memorandum, the disputed call of 27/5/2020 had already
been deleted when requested by the complainant in October 2022, at which time
the company had the reasonable belief that the issue had ended. In conclusion,
ZENITH claims that it had responded in a timely and detailed manner to the
complainant's requests as early as 2020, providing information on the telephone
communication, the registration of the IBAN and the activation of the standing orders,
considering that it had thus satisfied the complainant's right of access
in accordance with Article 15 of the GDPR, given that the complainant never submitted a
clear request for rectification, deletion or objection regarding his personal
data, but limited himself to challenging the legality of the activation of the standing orders; that the processing of the personal data, in particular the IBAN,
was carried out exclusively within the framework of the contractual relationship and for the purposes of payment of bills, based on the legal basis of the execution of the contract; that the
data it held were accurate, as the complainant himself had stated in
2020 that he did not wish the standing orders to be deactivated until he received
14 written response; that he did not unlawfully disclose data to third parties and that
he refused to transmit data to a bank without the authorization of the
subject. Finally, he states that he has an organized framework for compliance with
the GDPR, internal procedures for managing GDPR requests and
internal control mechanisms and requests the rejection of the complaint as
unfounded; in the alternative, in the event that a violation is found, he invokes
mitigating factors, such as the absence of intent, cooperation with the Authority, the lack of
previous violations and the isolated nature of the case.
It is noted that the information document to the subjects entitled "Privacy Statement/Notice" and date of amendment 1.12.2025 is presented as Related 8, which states the following: "Data Retention: This data is kept throughout the validity of the Electricity Supply Contract and/or the Natural Gas Supply Contract, as well as for a period of five (5) additional years, from the end of the year of the validity of each Contract, in accordance with the provisions of Civil Law regarding the limitation of any claims". For its part, Piraeus Bank, both during the hearing and in its memorandum, explained in detail how the SEPA Direct Debit direct debit system operates, which is governed by the current European Regulatory Framework (Regulation 260/2012, as incorporated by Law 4537/2018, the SEPA Direct Debit Rulebooks (Core & B2B) and the operating specifications of the DIAS interbank system (DIAS Direct Debit), according to which the primary debit mandate is maintained exclusively by the beneficiary organization and not by the payer's bank. It argues that it only receives standardized electronic data through the DIAS system, based on which it executes the debits, without having access to the content of the mandate and without knowing the contractual relationship between the organization and the customer, therefore the Bank is not responsible. processing for the primary content of the assignment orders, but the beneficiary organization - in this case ZENITH - as the Bank
does not intervene in the collection, formation or modification of the assignment order,
nor does it retain copies of the primary orders, but only limited
data transmitted to it via DIAS for the execution of payments.
15 Furthermore, the Bank states that it responded immediately to the
complainant's requests for copies of the direct debit orders and
information regarding their origin, which were submitted as early as
October 2022 and again in 2023, providing all the information and
data it had regarding the charges in question and the manner operation of the system. In particular, it informed him that on 27/05/2020 it had received from ZENITH, via DIAS, the electronic files containing the details of the three direct debit orders, provided him with a description of all the details that it knew from the standard electronic messages, stated that the relevant assignment codes were already known to him through his account transactions, while claiming that it could not provide copies of the signed orders, as they were not in its possession, and therefore referred the complainant to ZENITH to search for them. According to the Bank, the complainant was informed of the rights to dispute unauthorized payment transactions and refund money provided for by the regulatory framework for payment services, however, he did not exercise any of the the
provided rights, with the result that the charges continue
to be made to this day. Finally, the Bank claims that it did not violate
the complainant's right of access, since it provided all the data that
it itself maintained, nor the principle of accuracy, since it had neither
the actual nor the regulatory possibility to check or modify the
content of the primary orders.
The Authority, after examining the information in the file and after hearing the
rapporteur and the clarifications from the co-rapporteur, after a thorough discussion
HAS DECIDED IN ACCORDANCE WITH THE LAW
1. From the provisions of Articles 51 and 55 of the General Data Protection Regulation (Regulation (EU) 2016/679 – hereinafter, GDPR) and Article 9 of L.
4624/2019 (Government Gazette A' 137) states that the Authority has the competence to supervise the
16implementation of the provisions of the GDPR, the above laws and other regulations
regarding the protection of individuals from the processing of personal data.
In particular, from the provisions of articles 57 par. 1 letter f' of the GDPR and 13 par.
1 letter g' of L. 4624/2019 it follows that the Authority has the competence to handle
complaints filed by A against ZENITH and Piraeus Bank and
to exercise, respectively, the powers granted to it by the provisions of
articles 58 of the GDPR and 15 of law 4624/2019.
2. In accordance with Article 5(1)(a) and (d) of the General Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data (hereinafter referred to as the GDPR), “personal data: (a) shall be processed lawfully and fairly in a transparent manner in relation to the data subject (“lawfulness, objectivity and transparency”), […] (d) shall be accurate and, where necessary, kept up to date; all reasonable steps shall be taken to ensure that personal data which are inaccurate, having regard to the purposes of the processing, are erased or rectified without delay (‘accuracy’)”. 3. The term “controller” (Article 4(7) GDPR) means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for his or her designation may be provided for by Union or Member State law. Furthermore, the term “processor” (Article 4(8) GDPR) means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. As stated in the EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR - Version
172.0 (7 July 2021), “The determination of the purposes and means amounts to the decision-making on the reason and the means of the processing respectively:
14 in the light of a specific processing activity, the controller is the factor that has determined the reason for the processing (i.e. the “purpose” or “purposefulness”) and the means by which the specific objective will be achieved (i.e. the means that will be used to achieve the objective). A natural or legal person who influences the processing of personal data in this way participates in the determination of the purposes and means of the processing in question in accordance with the definition in Article 4(7) of the GDPR (§35), while a specific example is given (p. 18) regarding the execution of payments (salary) by a bank, according to which, in the context of achieving the purpose of performing banking activity, the bank decides independently of the employer which data will be processed for the provision of the service, the duration of their retention, etc. and therefore the bank should be treated as an independent controller in relation to the employer for the specific processing. Furthermore, according to Article 29 GDPR “The
processor and any person acting under the supervision of the
controller or the processor who has
access to personal data shall process such data
only on instructions from the controller, unless required to do so by
Union or Member State law”.
4. According to Article 15(1) and (3) of the GDPR, “1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and the following information: […]. 3. The controller shall provide a copy of the personal data which are being processed. […] If the data subject submits the
1
Available on the EDPB website https://www.edpb.europa.eu/our-work-tools/our-
documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en
18request by electronic means and unless the data subject requests something
different, the information shall be provided in an electronic format
that is usually used. As pointed out in the WP29 Guidelines on
Transparency (WP260 rev.01, 22.08.2018), the rule of transparent information
in clear, simple and definitive terms stemming from the provision of Article 12
paragraph 1 GDPR should also govern the information that subjects receive in
response to a request for access under Article 15 GDPR.
5. Access requests must be satisfied in principle within a period of
one month from receipt of the request, as stipulated in Article 12(3) of the
GDPR: “The controller shall provide the data subject
with information on the action taken on a request pursuant to
Articles 15 to 22 without delay and in any case within one month from
receipt of the request. That period may be extended by two
further months, where necessary, taking into account the complexity of the
request and the number of requests. The controller shall
inform the data subject of any such extension within one month from
receipt of the request, as well as of the reasons for the delay. (…)”.
Moreover, as pointed out in the Guidelines 01/2022 of the European Data Protection Board (EDPS) on the right of access 2 “….the purpose of the right of access does not lend itself to being analysed as a condition for the exercise of the right of access by the controller in the context of its assessment of access requests. Therefore, controllers should not check “why” the data subject requests access, but only “what” the data subject requests” (§13).
6. Furthermore, the aforementioned Guidelines clarify that the
obligation to provide a copy in accordance with paragraph 3 of Article 15 GDPR should not
2Guidelines 01/2022 on the rights of data subjects —
Right of access, Version 2.0 (28 March 2023), available at
https://www.edpb.europa.eu/system/files/2024-
04/edpb_guidelines_202201_data_subject_rights_access_v2_el.pdf
19be understood as an additional right of the data subject, but as
a way of providing access to the data. However, if access to the data
within the meaning of Article 15(1) is provided by providing a copy, the obligation to provide a copy referred to in Article 15(3) is complied with. The
obligation to provide a copy serves the objectives of the right of
access, which consist in enabling the data subject
to be aware of and to verify the lawfulness of the processing (Article 63 GDPR). To achieve these objectives, the data subject should
in most cases be able to see the information not only
temporarily. Therefore, the data subject should
gain access to the information by obtaining a copy of the personal
data. (Guidelines 1/2022 EDPB, §§ 23, 24). In addition,
the following are noted: “152. It is up to the controller to
decide on the appropriate form in which the
personal data will be provided. The controller may, although not necessarily obliged, provide the documents containing personal data
about the data subjects making the request, in their original form. The controller could, for
example, where appropriate, provide access to a copy of the medium,
given the need for transparency (for example, to verify the
accuracy of the data held by the controller in the event of a
request for access to medical records or to an audio recording the transcription of which
is disputed). However, the CJEU, in its interpretation of the right of access under Directive 95/46/EC, stated that “[f]or the exercise of [the right of access], it is sufficient to provide the applicant with a complete overview of those data in an intelligible manner, that is to say, in a manner that enables the data subject to ascertain the accuracy of those data and their processing in accordance with the Directive, so that he may exercise the rights conferred by that Directive, if necessary.” In contrast to the Directive, the GDPR expressly provides for the obligation to provide the data subject with a copy of the personal data being processed. However, this does not mean that the data subject always has the right to obtain a copy of the documents containing the personal data, but an unaltered copy of the personal data processed in those documents (…). 153. Without prejudice to the form in which the controller provides the personal data, e.g. by providing the documents containing the personal data themselves or by compiling the personal data, the information complies with the transparency requirements set out in Article 12 of the GDPR. The establishment of some kind of compilation and/or the extraction of the data in a way that facilitates the understanding of the information could, in certain cases, be a way of complying with those requirements. In other cases, the information is better understood by providing a copy of the document containing the personal data. Therefore, the most appropriate form should be decided on a case-by-case basis. 155. In some cases, the personal data themselves determine the requirements as to the form in which the personal data should be provided. For example, where the personal data consist of handwritten information from the data subject, the data subject may need to be provided with a photocopy of the handwritten information, since the handwriting itself is personal data. This could be the case in particular where the handwriting is relevant for the processing, e.g. analysis of a handwritten text. The same is generally true for sound recordings, since the data subject's own voice is personal data. However, in
certain cases, access may be granted by providing
a transcript of the conversation, for example, if this is agreed between
the data subject and the controller”.
7. According to the provisions of paragraphs 1 and 2 of Article 32 GDPR on the security
of processing, “1. Taking into account the latest developments, the cost of
implementation and the nature, scope, context and purposes of
processing, as well as the risks of varying likelihood and
severity for the rights and freedoms of natural persons,
the controller and the processor shall implement appropriate
technical and organisational measures to ensure an appropriate level of
security against the risks, including, inter alia, where
the following: (…), (b) the possibility of ensuring the confidentiality, integrity,
availability and reliability of the systems and services
processing on a continuous basis, (c) the possibility of restoring
the availability and access to personal data in due time
in the event of a natural or technical incident, (…).
8. When processors are used, who process personal data on behalf of the controller, the provision of Article 28 GDPR shall apply, according to which:
"1. Where processing is to be carried out on behalf of a controller, the controller shall only use processors who provide sufficient assurances that appropriate technical and organisational measures will be implemented in such a way that the processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. […] 3. Processing by the processor shall be governed by a contract or other legal act governed by Union or Member State law, which binds the processor in relation to the controller and specifies the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and the categories of data subjects and the obligations and rights of the controller. Such a contract or other legal act shall provide in particular that the processor shall: (a) process personal data only on the basis of recorded instructions from the controller, […] (c) take all necessary measures pursuant to Article 32, […] (e) take account of the nature of the processing and assist the controller by implementing appropriate technical and organisational measures, to the extent possible, to fulfil the controller’s obligation to respond to requests for the exercise of the data subject’s rights set out in Chapter III, (f) assist the controller in ensuring compliance with the obligations arising from Articles 32 to 36, taking into account the nature of the processing and the information available to the processor […]”.
9. In the present case, after hearing the parties and examining
the entire case file, the following factual
facts emerged:
A. Complaint against ZENITH
On 27/5/2020, the complainant concluded an electricity contract with ZENITH for three services by telephone, through the processor “Sigma and
Kapa Import S.A.”. During the call, the complainant stated his bank account number (IBAN) for the purpose of using it to pay at least one service via standing order. On 4/6/2020, in a later telephone conversation between the complainant and the same company, the complainant stated that he did not wish the other two services to be paid via standing order, while when the relevant contractual forms were sent to him for signature, the complainant signed only one of the three standing order forms. When the complainant found that all three electricity services were being paid via standing order, he contacted ZENITH on 13/8/2020 to complain about this. Furthermore, clause 11 of the ZENITH Agreement dated 1/5/2019 with the processor “Sigma and Kappa Imports S.A.” stipulated that the data collected by the processor are mandatorily transmitted to ZENITH as the controller and not simply that “the recorded files could be delivered to the company”, as ZENITH states on page 10 of its memorandum. Specifically, clause 11 of the agreement stipulated the following: “Sigma and Kappa Imports S.A. is
responsible for the management of the Call Log […] The files
created by the collection and transmission of personal data,
belong exclusively to the Company, which is responsible to
the competent authorities for their preservation and/or destruction, and Sigma and Kappa
23Eisagogiki S.A., operating as a processor on behalf of
the Company, is also responsible for the processing of personal data
that it collects and/or processes for the needs of this contract.
Sigma and Kappa Eisagogiki S.A. is obliged to deliver to the Company the means
(electromagnetic or otherwise) on which the files are stored, without having the right
to retain or reproduce copies and to delete the data from
its own files, immediately after transmission to the Company”). However, ZENITH
claimed during the hearing that the above condition was not met in practice
and for this reason its contract with the processor
was amended as of 1/8/2021 in order to “more clearly reflect
the actual operational functioning of the cooperation” (see page 10 of its
memorandum). In any case, at the time of the actual
incidents (June – August 2020), when the complainant first questioned ZENITH about the content of the 27/5/2020 telephone call
to the processor, the call was available, as ZENITH
itself states (see page 12 of the memorandum). Therefore, at that time, ZENITH should have and could have obtained primary access to the content of the call in question in order to ascertain its content and respond to the complainant with full awareness of it and not simply “relying on the control” of the company performing the processing. Moreover, in its response to the complainant dated 2/9/2020, ZENITH referred to the facts, not as “claims of the authorized partner” but as established facts, for which it even assumed responsibility and apologized to the complainant for the inconvenience caused to him: “You then informed the authorized sales partner that you wish to activate a Standing Order only for the payment of the bills of provision
with number…. However, by mistake the authorized partner did not
proceed with the necessary actions. We apologize for the inconvenience and
the disruption caused to you”. It is noted that ZENITH did not
provide any evidence to document its communication with the aforementioned
processor, regarding the investigation of the actual
circumstances of the case, nor does it appear that it checked for any non-compliance of
the processor with its instructions, as controller.
According to the company's memorandum dated 20/3/2026 (p. 4), when the confirmation documents and the contractual forms were sent to the
complainant, the
complainant
signed only one of the three standing order forms. The relevant statement
included in the ZENITH's reply letter dated 17/4/2024 to the
Authority ("In a subsequent communication that he had with our external partner
on 4-6-2020, after he had signed and consented to the payment of his
services bills via standing order, the
Complainant clarified that
he wishes this payment method to apply only to the service corresponding to
the garage … and not to the household ones, as he prefers to deposit the
guarantees”) appears contradictory in relation to the following mentioned in the memorandum
and does not correspond to reality. Furthermore, ZENITH's claim
that "the non-signature of the other two was not accompanied by any explicit, clear and
specific declaration of revocation of the already expressed intention to activate" is
manifestly unfounded; the signing of the forms documents the consent of the
client and is not simply a "formal procedure" but an essential condition
for the valid activation of the standing orders by him, especially in the
critical case in which not even the recorded
telephone call of 27/5/2020 is preserved. Based on the above, it follows that ZENITH was already aware
as of 2/9/2020 that the registration of standing orders for the payment of two of the three benefits of the complainant had taken place by mistake
and did not correspond to his actual will. Therefore, at
that point in time, as the controller, ZENITH was obliged,
based on the principle of data accuracy (Article 5, paragraph 1, point d of the GDPR), to take the
necessary actions to correct the inaccurate data it held about
the complainant. ZENITH's claim that "the complainant stated that he did not wish to deactivate the standing orders until he received a written response" cannot be interpreted as a desire to continue the existing situation, given that the complainant was primarily requesting documentation for ZENITH's claim that he had given three standing orders, which he was essentially disputing. Nevertheless, it is established that ZENITH continued to maintain the above inaccurate data, shifting the burden of correcting them to the 25th party, i.e. asking the complainant to take additional actions to cancel (revoke) the orders, which, to its knowledge, he had not given validly. It is also noted that the complainant's complaints regarding the issue could be considered in essence as requests for the rectification of his data (Article 16 GDPR), since the complainant specifically stated that he "has not given the orders". Therefore, a violation of the principle of data accuracy by ZENITH as the controller is established. Furthermore, it is established that following the 11/10/2022 access request submitted by the complainant via e-mail, ZENITH responded with the 3/3/2023 electronic letter, i.e. after five (5) months, simply referring the complainant to its previous letter of 2/9/2020 and without providing him with accurate and complete information, in particular a) regarding the fact that the only signed standing order activation form is not kept for the complainant and b) regarding the fact that his recorded telephone conversation with the processor on 27/5/2020 had also been deleted. Therefore, it is established that ZENITH, as the controller, has violated the obligation to respond to the rights of the GDPR within the deadline provided for under Article 12, paragraph 3 of the GDPR, as well as a failure to respond to the right of access under Article 15, paragraph 1, in conjunction with Article 12, paragraph 1 of the GDPR. Finally, it is established that the processor “Sigma and Kappa Introductory S.A.” does not comply with the instructions of ZENITH as the controller. In particular, the processor in question does not appear to have transmitted the data (recorded telephone calls) to ZENITH, in accordance with the terms of the agreement between them dated 1/5/2019, did not keep them in accordance with ZENITH's data retention policy as a data controller (5 years after the end of the customer's agreement), but on the contrary, as ZENITH states in its memorandum, it applied a different data retention period on its own initiative;
with regard to the case at hand, the processor failed to register the request for correction submitted by the complainant on 4/6/2020 "by mistake" (see also page 17 of the memorandum), while as it appears from the
C/ΕΙΣ/3580/17-04-2024 response document of ZENITH, the processor did not even keep the only signed form that
concerned him
“in August of the same year, it was found that, by mistake and
later, the specific standing order activation form had not
been attached to the contract, resulting in only an oral standing order
for payment” (see also p. 13 of ZENITH’s memorandum: “the complainant
insisted […], to be given “a paper that he has signed for the activation”
which could not be satisfied, for the simple reason that such
document, for the specific benefits, did not exist in the company’s archives”).
Nevertheless, ZENITH does not appear to have taken any action to control
the aforementioned processing company or to call on it to comply
with the instructions of the controller. On the contrary, ZENITH
proceeded to amend the contract between them on 1/8/2021, in order to
“conventionally reflect the existing operational reality” (see p.
10 of the company memorandum), in order to subsequently approve a
practice contrary to both its policies and instructions as controller,
and to the information provided to the data subjects regarding the retention period
of their data (up to 5 years after the end of their contract). Following the
above, it is established that ZENITH violated its obligation under
the provision of Article 28, paragraph 1 GDPR to use only processors who provide sufficient assurances for the implementation of appropriate
technical and organizational measures, in such a way that the processing meets
the requirements of this regulation and ensures the protection of
the rights of the data subject.
B. Complaint against Piraeus Bank
In response to the complainant’s request for access dated 16/2/2023
requesting information on the method of activating standing orders and
the provision of any relevant document, the Bank replied that it “acts as
an intermediary for the payment of payments, maintaining an operational role
in the process” and did not provide him with any information or any document.
Subsequently and before the Authority, the Bank claimed that the reason for not
responding to the complainant’s request for access was the fact that
it does not
receive and does not keep the standing order documents, therefore it does not
have the documents requested by the complainant. However, in accordance with what is set out above in paragraph 3 of this decision, the Bank is an autonomous controller with regard to the processing of data carried out in the context of achieving the purpose of carrying out banking activities, including the execution of direct debit payments, in accordance with the relevant regulatory framework. The fact that it only receives standardised electronic data via the DIAS system, on the basis of which it executes the debits and does not keep copies of the primary orders, does not change the finding of its role as controller, as it is only provided with limited data via the DIAS system for the execution of payments. Since the specific data included in electronic files relate to an order given by the complainant for the execution of payments, and subsequently, based on them, the Bank maintains a certain electronic record, which certifies the transmission of the order on his behalf, taking into account the provisions of Law 4537/2018 on the provision of payment services, the relevant information concerns the complainant and therefore constitutes his personal data within the meaning of the GDPR. Therefore, and regardless of the provisions of articles 45 and 48 of Law
4537/2018, following the submission of an access request by the complainant
based on article 15 GDPR, the Bank was obliged to provide him with any relevant
information that it holds as a data controller, either by providing
a copy of the electronic record it maintains in its systems or in any other way that it deems appropriate, so that the complainant, as a data subject, is aware of and in a position to verify the lawfulness
of the processing (see Request. Section 63 GDPR). Therefore, in this case, a
violation of the complainant's right of access by the
Bank is established.
28 Furthermore, it should be noted that even if the Bank is not required, at the stage of collecting the above data, to verify the correctness of the orders transmitted to it via DIAS by third parties, because the regulatory framework for payments applies more specifically to the collection of this data (see Law 4537/2018, SEPA Regulation, etc.), since the Bank is an independent data controller, as mentioned above, it bears the responsibility to ensure compliance with the basic principles of processing, including the principle of data accuracy (Article 5, paragraph 1, point (d) GDPR) throughout the processing. Since
the Bank, as controller, was initially informed by
the data subject that the data transmitted to it by a third-party
in relation to certain standing orders and which it maintains are inaccurate,
the Bank should have at least investigated the relevant claim, seeking
further information from ZENITH to document the accuracy of the
data in order to ensure the above basic principle of processing.
The Bank's inaction in this case, limited to referring
the data subject to their source of origin, namely ZENITH,
a violation of the basic principle of accuracy based on Article 5, paragraph
1, d’ is also established on the part of the Bank.
10. Based on the above, the Authority considers that it is appropriate to exercise its corrective powers under
Article 58, paragraph 2 of the GDPR in relation to the
infringements identified.
i. With regard to the established violations of Article 5, paragraph 1, point d’, Article
15 in conjunction with Article 12, paragraph 1 and paragraph 3, and Article 28, paragraph 1 GDPR
by ZENITH, in accordance with the provisions of Section 9.A of this decision,
the Authority considers that, based on the circumstances established, an effective, proportionate and dissuasive administrative fine should be imposed, in accordance with the provisions of Article 58, paragraph 2, point i’, in accordance with Article 83 of the GDPR, both to restore compliance and to sanction the illegal
29conduct, as referred to in the operative part of this decision.
Furthermore, the Authority took into account the criteria for measuring fines, which are
defined in article 83 par. 2 of the GDPR, paragraph 5(b) of the same
article, which are applicable to the present case, the
Guidelines
on the application and setting of administrative fines for the purposes of
Regulation 2016/679, issued on 03-10-2017 by the
Article 29 Working Party (WP 253), the
European Council
Data Protection Guidelines on the calculation of administrative fines under
Article 4
GDPR, as well as the actual facts of the case under examination and
in particular:
a) that the violations found in this case, although they concern a
data subject (the complainant), nevertheless demonstrate a systemic
problem of ZENITH, as controller; In particular, the fact that
ZENITH does not maintain any evidence to document active standing orders,
shifts the burden of responsibility for correcting the inaccurate data it holds to the subject and appears to be indifferent to the non-compliance of the
processor with its orders, is indicative of its inadequate
compliance with its obligations under the GDPR, with regard to all
subjects who are its customers;
b) that the violations are considered to be of moderate severity, as they concern
transaction data and have a long duration (6 years) while they are still being committed
to this day
c) that no special categories of data were affected;
d) the degree of responsibility of the company, taking into account its size and that, despite the fact that it appears to have established organizational measures and appropriate procedures for handling data subjects' requests, in practice it does not appear that these procedures were followed in this case, since ZENITH
3See OE 29, Guidelines on the application and setting of administrative fines for the purposes of Regulation 2016/679 WP253, p. 6.
4See ΕDPB, Guidelines 04/2022 on the calculation of administrative fines under the GDPR, version 2.1,
adopted on 24 May 2023..
30never treated the complainant's requests as requests for correction of
inaccurate data that it knowingly holds about him;
e)the fact that the company did not respond immediately to the Authority's initial document,
but had to send the no. prot. C/ΕΣΕ/1134/12-04-2024 memorandum
document in order to provide its views on the complaint, as well as
the contradictory allegations made to both the complainant and
the Authority during the examination of the case (initial apology for the
mistake, later invocation of the complainant's "peculiar behavior",
and conflicting information regarding the signing or not of the standing orders)
are taken into account as aggravating factors;
f) the fact that, according to the published financial statements of 2025
in GEMI 5, ZENITH had an annual turnover of €606,593,288.08.
ii. With regard to the established violation of the principle of accuracy (Article 5, paragraph 1, point d of the GDPR) by Piraeus Bank, in accordance with the provisions of Paragraph 9.B of this decision, the Authority considers that this is a minor violation, taking into account the specific regulatory framework governing the operation of banks with regard to payments, and that it is appropriate to address a reprimand to the Bank, based on Article 58, paragraph 2, point b) (see also Recital 148 of the GDPR). iii. With regard to the established violation of Article 15 of the GDPR by Piraeus Bank, in accordance with the provisions set out in Section 9.B of this decision, the Authority considers that, based on the circumstances established, an effective, proportionate and dissuasive administrative fine should be imposed in accordance with Article 83 of the GDPR. For the calculation of the fine, the criteria provided for in Article 83(2) of the GDPR were taken into account, in particular the following: a) that the infringement affected a data subject; b) that the processing does not concern special categories of data; c) that the infringement is attributable to the Bank's negligence, as the complainant's request appeared to concern the provision of copies of signed orders, which it does not keep; d) as a mitigating factor, the fact that the Bank responded to the complainant's request by providing certain information on the method of transmitting standing orders, while it made efforts to resolve the issue by contacting National Bank, as bank
in cooperation with ZENITH;
e) the fact that in 2025 the global turnover of Piraeus Bank
amounts to €2,713,000,000.6
FOR THESE REASONS
THE AUTHORITY
1. Orders GAS SUPPLY COMPANY OF THESSALONIKI THESSALIA
S.A. (“ZeniΘ”), as data controller, pursuant to article 58 par. 2 subs.
i’ of the GDPR, an administrative fine of: a) twenty-five thousand euros
(€25,000), for the established violation of the provision of Article 5 para.
1 d’ GDPR, b) twenty-five thousand euros (€25,000), for the established
violation of the provision of Article 15 GDPR in conjunction with Articles 12
para. 1 and 12 para. 3 GDPR, and c) fifty thousand euros (€50,000), for the
established violation of the provision of Article 28 para. 1 GDPR, in accordance
with the provisions set out in paragraphs 9.A and 10 i) above.
2. Addresses a complaint to Piraeus Bank S.A., as controller,
based on Article 58, paragraph 2, b of the GDPR for the established violation of the
principle of accuracy (Article 5, paragraph 1, d of the GDPR), in accordance with the provisions set out in
paragraphs 9.B and 10 ii) above.
3. Imposes on Piraeus Bank S.A., as controller, based on
Article 58, paragraph 2, subparagraph θ of the GDPR, an administrative fine of ten thousand
6
https://publicity.businessportal.gr/company/157660660000
32 (€10,000) euros, for the established violation of the provision of Article
15 GDPR, in accordance with what is mentioned in paragraphs 9.B and 10 iii) above.
The acting President The Secretary
Deputy President
Georgios Batzalexis Irini Papageorgopoulou
33
