[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI7-FgQN4NMptlFOFPalIev37q3pc9MX-qcjlz6S0CPQ":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":62},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"6ba779b8-6f83-4afe-85fb-fe6ad83c94de","HDPA (Greece) - 7\u002F2026","hdpa-greece-7-2026-53d0ed","Fixed link ← Older revision Revision as of 06:41, 23 September 2026 Line 13: Line 13: |Original_Source_Name_1=HDPA |Original_Source_Name_1=HDPA |Original_Source_Link_1=https:\u002F\u002Fwww.dpa.gr\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-07\u002F7_2026%20anonym.pdf |Original_Source_Link_1=https:\u002F\u002Fwww.dpa.gr\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-07\u002F7_2026%20anonym.pdf |Original_Source_Language_1=Greek, Modern (1453-) |Original_Source_Language_1=Greek |Original_Source_Language__Code_1= |Original_Source_Language__Code_1=","The Greek Data Protection Authority (HDPA) has fined DEI, a Greek energy supplier, and four call-center operators a total of €880,000. The violations include inadequate technical and organizational measures, mixed-purpose calls, insufficient oversight of processors, and unauthorized use of a subcontractor. Complaints arose from data subjects receiving promotional calls despite being on the national opt-out register or having previously requested not to be contacted.","Greek DPA fines energy supplier and call centers €880K for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_7\u002F2026&diff=53161&oldid=52532","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-09-23T06:41:24+00:00","2026-09-23T08:00:09.411889+00:00",7,[17,20,22,24,26,28],{"name":18,"type":19},"HDPA","vendor",{"name":21,"type":19},"DEI S.A.",{"name":23,"type":19},"Teleperformance",{"name":25,"type":19},"CQS Customer-Centric Services S.A.",{"name":27,"type":19},"Mediatel Telephone Information Services S.A.",{"name":29,"type":19},"Prelude Group Limited Partnership","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":30,"icon":32,"name":33,"slug":34},null,"Policy","policy",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[54],{"type":55,"value":56,"context":57},"url","https:\u002F\u002Fwww.dpa.gr\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-07\u002F7_2026%20anonym.pdf","Original source link for the decision",[18,21,23],{"controls":60,"vendors":61},[],[],{"slug":63,"title":64,"body":65,"framework_refs":66,"framework_notes":80},"greek-energy-supplier-fined-880k-for-unlawful-marketing-calls-and-processor-oversight--1790151773088","Greek Energy Supplier Fined €880K for Unlawful Marketing Calls and Processor Oversight Failures","DEI and its call-center partners violated GDPR by contacting individuals who had registered on the national opt-out list or explicitly withdrawn consent, demonstrating a fundamental failure to honour data subjects' rights. The unauthorized use of a subcontractor compounded the breach, showing that DEI had inadequate contractual and operational control over its processing chain. Insufficient oversight of third-party processors allowed non-compliant practices to persist unchecked, multiplying both the harm to data subjects and the regulatory liability. This case highlights that controllers remain fully accountable for the actions of every processor and sub-processor they engage, regardless of contractual delegation.",[67,68,69,70,71,72,73,74,75,76,77,78,79],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 6 – Lawful basis for processing","GDPR Article 7 – Conditions for consent","GDPR Article 21 – Right to object (including direct marketing opt-out)","GDPR Article 28 – Processor obligations and Data Processing Agreements","GDPR Article 28(2) – Prohibition on unauthorised sub-processing","GDPR Article 24 – Responsibility of the controller","GDPR Article 83(4)\u002F(5) – Administrative fines","NIST SP 800-53 PT-4 (Consent)","NIST SP 800-53 SA-9 (External System Services \u002F Supply Chain)","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27701:2019 – Privacy Information Management (PIMS)","ITIL Service Design – Supplier Management process",{}]