HDPA (Greece) - 7/2026
Greek DPA fines energy supplier and call centers €880K for GDPR violations.
The Greek Data Protection Authority (HDPA) has fined DEI, a Greek energy supplier, and four call-center operators a total of €880,000. The violations include inadequate technical and organizational measures, mixed-purpose calls, insufficient oversight of processors, and unauthorized use of a subcontractor. Complaints arose from data subjects receiving promotional calls despite being on the national opt-out register or having previously requested not to be contacted.
AI summary of the linked source. Not reviewed by an editor. How this works
Run HDPA?
Get an email when a new story names HDPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonDEI and its call-center partners violated GDPR by contacting individuals who had registered on the national opt-out list or explicitly withdrawn consent, demonstrating a fundamental failure to honour data subjects' rights. The unauthorized use of a subcontractor compounded the breach, showing that DEI had inadequate contractual and operational control over its processing chain. Insufficient oversight of third-party processors allowed non-compliant practices to persist unchecked, multiplying both the harm to data subjects and the regulatory liability. This case highlights that controllers remain fully accountable for the actions of every processor and sub-processor they engage, regardless of contractual delegation.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- url — https://www.dpa.gr/sites/default/files/2026-07/7_2026%20anonym.pdf