[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqYsEzm0aT-1cnXrtFZwu0VfLsx8g2vzGJd1lAtmxCN4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":25,"status":26,"created_at":27,"published_at":28,"article":29,"tags":33,"podcasts":52,"controls":53},"d77bde80-4962-433d-bc38-82638cbbdd51","greek-energy-supplier-fined-880k-for-unlawful-marketing-calls-and-processor-oversight-failures","2477d5ba-110d-4270-bb18-fa9bdb2ff062","Greek Energy Supplier Fined €880K for Unlawful Marketing Calls and Processor Oversight Failures","DEI and its associated call-center partners violated GDPR by contacting data subjects who had explicitly opted out or requested no further contact, demonstrating a fundamental failure in honoring data subject rights. The root cause spans three interconnected failures: inadequate technical and organizational measures to enforce suppression lists, insufficient oversight of third-party data processors, and unauthorized engagement of subcontractors outside the bounds of lawful data processing agreements. This matters because organizations remain fully accountable for how their processors and sub-processors handle personal data — ignorance of downstream misuse is not a legal defense. The case illustrates that commercial pressure to generate leads must never override individuals' rights to control how their personal data is used.","**Immediate actions:**\n- Audit all active data processor agreements to confirm subcontractor usage is explicitly authorized and documented.\n- Cross-reference marketing contact lists against national opt-out registers and internal suppression lists before any outreach campaign.\n- Suspend any call-center partners that cannot demonstrate compliant data handling practices until a formal review is completed.\n\n**Long-term improvements:**\n- Establish a formal Processor Management Program with periodic audits, contractual Data Processing Agreements (DPAs), and mandatory breach notification clauses for all third parties.\n- Implement a centralized consent and preference management platform to enforce opt-out statuses automatically across all marketing channels and vendors.\n- Define and enforce contractual prohibitions on unauthorized sub-processing, including right-to-audit clauses in all vendor contracts.\n\n**Detection & monitoring measures:**\n- Deploy logging and monitoring of outbound call activities to detect patterns of contact with opted-out individuals in near real-time.\n- Establish a data subject complaint triage process to identify systemic processor non-compliance early, before regulatory escalation.\n- Conduct annual third-party compliance assessments against GDPR Article 28 obligations for all processors handling personal data.",[12,13,14,15,16,17,18,19,20,21,22,23,24],"GDPR Article 5(1)(a) – Lawfulness, fairness and transparency","GDPR Article 6 – Lawfulness of processing","GDPR Article 7 – Conditions for consent","GDPR Article 17 – Right to erasure \u002F opt-out compliance","GDPR Article 21 – Right to object to direct marketing","GDPR Article 28 – Processor obligations and sub-processor authorization","GDPR Article 32 – Security of processing (technical and organizational measures)","NIST SP 800-53 PT-4 (Consent)","NIST SP 800-53 SA-9 (External System Services \u002F Supply Chain)","CIS Control 3 – Data Protection","CIS Control 15 – Service Provider Management","ISO\u002FIEC 27001 Annex A.18 – Compliance","ISO\u002FIEC 27001 Annex A.15 – Supplier Relationships",{},"published","2026-07-28T12:20:20.572486+00:00","2026-07-28T12:20:20.459+00:00",{"id":7,"url":30,"slug":31,"title":32},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_7\u002F2026&diff=52514&oldid=0","hdpa-greece-7-2026-535bee","HDPA (Greece) - 7\u002F2026",[34,40,46],{"id":35,"name":36,"slug":37,"description":38,"color":39},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":41,"name":42,"slug":43,"description":44,"color":45},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":47,"name":48,"slug":49,"description":50,"color":51},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[]]