Greek Energy Supplier Fined €880K for Unlawful Marketing Calls and Processor Oversight Failures
Written by AI from the linked story. Not reviewed by an editor. How this works
DEI and its call-center partners violated GDPR by contacting individuals who had registered on the national opt-out list or explicitly withdrawn consent, demonstrating a fundamental failure to honour data subjects' rights. The unauthorized use of a subcontractor compounded the breach, showing that DEI had inadequate contractual and operational control over its processing chain. Insufficient oversight of third-party processors allowed non-compliant practices to persist unchecked, multiplying both the harm to data subjects and the regulatory liability. This case highlights that controllers remain fully accountable for the actions of every processor and sub-processor they engage, regardless of contractual delegation.
Tactical Insight
Immediate actions
- Audit all active marketing lists against the national opt-out register and internal suppression lists before any outbound campaign is launched.
- Suspend any subcontractor or processor that was not formally authorised under a signed Data Processing Agreement (DPA) until compliance is verified.
- Issue a documented opt-out and consent review for all existing contact databases to remove non-consenting individuals immediately.
Long-term improvements
- Establish a formal third-party processor onboarding process that requires written authorisation, DPAs, and GDPR compliance assessments before engagement.
- Implement a contractual clause mandating prior written approval for any sub-processor appointment, with automatic notification obligations.
- Create a centralised consent management platform that synchronises in real time with national opt-out registers and internal do-not-contact lists.
Monitoring & oversight measures
- Schedule quarterly compliance audits of all call-centre operators and processors, including review of call scripts, consent records, and suppression list adherence.
- Deploy logging mechanisms that record the lawful basis used for each outbound contact attempt, retaining records for the duration required by applicable law.
- Assign a dedicated Data Protection Officer (DPO) oversight role to review processor activity reports monthly and escalate anomalies to senior management.