Greek DPA Fines DEI and Call-Center Partners €880K for GDPR Marketing Violations
Written by AI from the linked story. Not reviewed by an editor. How this works
DEI S.A. and its call-center operators failed to implement adequate technical and organizational measures to respect data subjects' opt-out preferences, resulting in unlawful promotional calls to individuals registered on the national do-not-call list. A key failure was the unauthorized engagement of a subcontractor without proper authorization or oversight, violating GDPR's strict processor accountability requirements under Articles 28 and 29. Mixed-purpose calls—combining service and promotional content—further obscured consent boundaries and made it impossible to honor data subjects' objections effectively. This case illustrates that GDPR liability extends across the entire processing chain: controllers cannot delegate compliance responsibility to processors without rigorous contractual and operational controls. The €880,000 fine underscores that consent and objection management failures carry significant financial and reputational consequences.
Tactical Insight
Immediate actions
- Audit all active Data Processing Agreements (DPAs) to ensure processors and subcontractors are explicitly authorized and contractually bound to GDPR obligations.
- Cross-reference contact lists against national opt-out registers and internal suppression lists before any outbound marketing campaign is launched.
- Prohibit mixed-purpose calls (service + promotional) until separate consent mechanisms and call scripts are formally approved.
Long-term improvements
- Establish a Vendor/Processor Risk Management program requiring security and compliance assessments before onboarding any subcontractor.
- Implement a centralized consent and preference management platform that propagates opt-out signals in real time to all processors and subcontractors.
- Conduct annual GDPR training for all staff and third-party operators involved in customer communications.
Detection & Monitoring measures
- Deploy call monitoring and quality-assurance logging to detect non-compliant call scripts or unauthorized promotional content.
- Set up automated alerts when a contact record flagged as opted-out is added to an outbound call queue.
- Perform quarterly audits of processor activity logs to verify compliance with agreed data processing instructions.