[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnZVvDou_5CiMkRXPBA1YEzEhewAoaBUjzol8AhxDpnY":3},{"article":4,"iocs":51,"watch_terms":52,"solutions":53,"lesson":56},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"2477d5ba-110d-4270-bb18-fa9bdb2ff062","HDPA (Greece) - 7\u002F2026","hdpa-greece-7-2026-535bee","Created page with \"{{DPAdecisionBOX |Jurisdiction=Greece |DPA-BG-Color= |DPAlogo=LogoGR.jpg |DPA_Abbrevation=HDPA |DPA_With_Country=HDPA (Greece) |Case_Number_Name=7\u002F2026 |ECLI= |Original_Source_Name_1=HDPA |Original_Source_Link_1=https:\u002F\u002Fwww.dpa.gr\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-07\u002F7_2026%20anonym.pdf |Original_Source_Language_1=Greek, Modern (1453-) |Original_Source_Language__Code_1= |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language_...\" Show changes","The Greek Data Protection Authority (HDPA) has imposed a total fine of €880,000 on DEI, an energy supplier, and four call-center companies. The penalties stem from violations including inadequate technical and organizational measures, mixed-purpose calls, insufficient oversight of processors, and unauthorized use of subcontractors. Complaints arose from data subjects receiving promotional calls despite being on opt-out registers or having requested no further contact.","Greek DPA fines energy supplier and call centers €880K for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_7\u002F2026&diff=52514&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-07-28T11:59:30+00:00","2026-07-28T12:00:17.578823+00:00",7,[17,20,22,24,26],{"name":18,"type":19},"DEI S.A.","vendor",{"name":21,"type":19},"Teleperformance",{"name":23,"type":19},"CQS Customer-Centric Services S.A.",{"name":25,"type":19},"Mediatel Telephone Information Services S.A.",{"name":27,"type":19},"Prelude Group Limited Partnership","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":28,"icon":30,"name":31,"slug":32},null,"Policy","policy",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21,23],{"controls":54,"vendors":55},[],[],{"slug":57,"title":58,"body":59,"framework_refs":60,"framework_notes":74},"greek-energy-supplier-fined-880k-for-unlawful-marketing-calls-and-processor-oversight-failures","Greek Energy Supplier Fined €880K for Unlawful Marketing Calls and Processor Oversight Failures","DEI and its associated call-center partners violated GDPR by contacting data subjects who had explicitly opted out or requested no further contact, demonstrating a fundamental failure in honoring data subject rights. The root cause spans three interconnected failures: inadequate technical and organizational measures to enforce suppression lists, insufficient oversight of third-party data processors, and unauthorized engagement of subcontractors outside the bounds of lawful data processing agreements. This matters because organizations remain fully accountable for how their processors and sub-processors handle personal data — ignorance of downstream misuse is not a legal defense. The case illustrates that commercial pressure to generate leads must never override individuals' rights to control how their personal data is used.",[61,62,63,64,65,66,67,68,69,70,71,72,73],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 6 – Lawfulness of processing","GDPR Article 7 – Conditions for consent","GDPR Article 17 – Right to erasure \u002F opt-out compliance","GDPR Article 21 – Right to object to direct marketing","GDPR Article 28 – Processor obligations and sub-processor authorization","GDPR Article 32 – Security of processing (technical and organizational measures)","NIST SP 800-53 PT-4 (Consent)","NIST SP 800-53 SA-9 (External System Services \u002F Supply Chain)","CIS Control 3 – Data Protection","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27001 Annex A.18 – Compliance","ISO\u002FIEC 27001 Annex A.15 – Supplier Relationships",{}]