[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJz8XiUKzsZq8n5hQF5YEHrwi12bFj4wz1Zo3fxt_rJk":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":105},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"02cc77b3-f9b6-4913-9c52-b397f5f0d303","HDPA (Greece) - 7\u002F2026","hdpa-greece-7-2026-ed9319","insert missing language code ← Older revision Revision as of 09:41, 5 October 2026 Line 14: Line 14: |Original_Source_Link_1=https:\u002F\u002Fwww.dpa.gr\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-07\u002F7_2026%20anonym.pdf |Original_Source_Link_1=https:\u002F\u002Fwww.dpa.gr\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-07\u002F7_2026%20anonym.pdf |Original_Source_Language_1=Greek |Original_Source_Language_1=Greek |Original_Source_Language__Code_1= |Original_Source_Language__Code_1=EL","The Greek DPA has fined DEI S.A. and four call-center operators a total of €880,000 for violating GDPR. The violations included inadequate technical and organizational measures, mixed-purpose calls, insufficient processor oversight, and unauthorized use of a subcontractor. Complaints arose from data subjects receiving promotional calls despite being on the national opt-out register or having previously requested not to be contacted.","Greek DPA fines energy supplier and call centers €880,000 for GDPR violations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_7\u002F2026&diff=53288&oldid=53161","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-10-05T09:41:03+00:00","2026-10-05T10:00:08.719374+00:00",7,[17,20,22,24,26,28],{"name":18,"type":19},"DEI S.A.","vendor",{"name":21,"type":19},"Teleperformance",{"name":23,"type":19},"CQS Customer-Centric Services S.A.",{"name":25,"type":19},"Mediatel Telephone Information Services S.A.",{"name":27,"type":19},"Prelude Group Limited Partnership",{"name":29,"type":30},"Air Miles programme","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":31,"icon":33,"name":34,"slug":35},null,"GDPR","gdpr",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21,23],{"controls":57,"vendors":104},[58,87],{"slug":59,"name":60,"problem":61,"products":62},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"slug":88,"name":89,"problem":90,"products":91},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[92,98],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":93,"product_name":94,"url":96,"description":97},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":99,"product_name":100,"url":102,"description":103},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":106,"title":107,"body":108,"framework_refs":109,"framework_notes":123},"greek-dpa-fines-dei-and-call-center-partners-880k-for-gdpr-marketing-violations","Greek DPA Fines DEI and Call-Center Partners €880K for GDPR Marketing Violations","DEI S.A. and its call-center operators failed to implement adequate technical and organizational measures to respect data subjects' opt-out preferences, resulting in unlawful promotional calls to individuals registered on the national do-not-call list. A key failure was the unauthorized engagement of a subcontractor without proper authorization or oversight, violating GDPR's strict processor accountability requirements under Articles 28 and 29. Mixed-purpose calls—combining service and promotional content—further obscured consent boundaries and made it impossible to honor data subjects' objections effectively. This case illustrates that GDPR liability extends across the entire processing chain: controllers cannot delegate compliance responsibility to processors without rigorous contractual and operational controls. The €880,000 fine underscores that consent and objection management failures carry significant financial and reputational consequences.",[110,111,112,113,114,115,116,117,118,119,120,121,122],"GDPR Article 6 – Lawfulness of processing","GDPR Article 7 – Conditions for consent","GDPR Article 17 – Right to erasure \u002F objection handling","GDPR Article 21 – Right to object to direct marketing","GDPR Article 28 – Processor obligations and contracts","GDPR Article 29 – Processing under authority of controller or processor","GDPR Article 32 – Security of processing (technical and organizational measures)","NIST SP 800-53 PT-3 – Personally Identifiable Information Processing Purposes","NIST SP 800-53 SA-9 – External System Services \u002F Supply Chain Controls","CIS Control 3 – Data Protection","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27001 Annex A.18.1 – Compliance with legal and contractual requirements","ITIL Service Design – Supplier Management Process",{}]