HDPA (Greece) - 7/2026
Greek DPA fines energy supplier and call centers €880K for GDPR violations.
The Greek Data Protection Authority (HDPA) has imposed a total fine of €880,000 on DEI, an energy supplier, and four call-center companies. The penalties stem from violations including inadequate technical and organizational measures, mixed-purpose calls, insufficient oversight of processors, and unauthorized use of subcontractors. Complaints arose from data subjects receiving promotional calls despite being on opt-out registers or having requested no further contact.
AI summary of the linked source. Not reviewed by an editor. How this works
Run DEI S.A.?
Get an email when a new story names DEI S.A., usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDEI and its associated call-center partners violated GDPR by contacting data subjects who had explicitly opted out or requested no further contact, demonstrating a fundamental failure in honoring data subject rights. The root cause spans three interconnected failures: inadequate technical and organizational measures to enforce suppression lists, insufficient oversight of third-party data processors, and unauthorized engagement of subcontractors outside the bounds of lawful data processing agreements. This matters because organizations remain fully accountable for how their processors and sub-processors handle personal data — ignorance of downstream misuse is not a legal defense. The case illustrates that commercial pressure to generate leads must never override individuals' rights to control how their personal data is used.