Greek Energy Supplier Fined €880K for Unlawful Marketing Calls and Processor Oversight Failures
Written by AI from the linked story. Not reviewed by an editor. How this works
DEI and its associated call-center partners violated GDPR by contacting data subjects who had explicitly opted out or requested no further contact, demonstrating a fundamental failure in honoring data subject rights. The root cause spans three interconnected failures: inadequate technical and organizational measures to enforce suppression lists, insufficient oversight of third-party data processors, and unauthorized engagement of subcontractors outside the bounds of lawful data processing agreements. This matters because organizations remain fully accountable for how their processors and sub-processors handle personal data — ignorance of downstream misuse is not a legal defense. The case illustrates that commercial pressure to generate leads must never override individuals' rights to control how their personal data is used.
Tactical Insight
Immediate actions
- Audit all active data processor agreements to confirm subcontractor usage is explicitly authorized and documented.
- Cross-reference marketing contact lists against national opt-out registers and internal suppression lists before any outreach campaign.
- Suspend any call-center partners that cannot demonstrate compliant data handling practices until a formal review is completed.
Long-term improvements
- Establish a formal Processor Management Program with periodic audits, contractual Data Processing Agreements (DPAs), and mandatory breach notification clauses for all third parties.
- Implement a centralized consent and preference management platform to enforce opt-out statuses automatically across all marketing channels and vendors.
- Define and enforce contractual prohibitions on unauthorized sub-processing, including right-to-audit clauses in all vendor contracts.
Detection & monitoring measures
- Deploy logging and monitoring of outbound call activities to detect patterns of contact with opted-out individuals in near real-time.
- Establish a data subject complaint triage process to identify systemic processor non-compliance early, before regulatory escalation.
- Conduct annual third-party compliance assessments against GDPR Article 28 obligations for all processors handling personal data.