HDPA orders TEIRESIAS S.A. to ensure data accuracy under Art. 5(1)(d) GDPR

Athens, May 26, 2026 Ref. No. 2369 Decision 4/2026 (Division) The Data Protection Authority met in a Departmental session via teleconference on February 4, 2026, following an invitation from the acting acting Chair, its Deputy Chair, in order to examine the case referred to in the background of this decision. The meeting was attended by Georgios Batzalexis, Vice Chair, and the alternate member, Maria Psalla, as rapporteur, standing in for the regular member, Grigorios Tsolias, who, although had been duly invited in writing, was absent due to a valid reason, and the other alternate member, Demosthenes Vougioukas, standing in for the regular member, Konstantinos Lambrinoudakis, who, although he had been duly invited in writing, was absent due to a valid reason. Present at the meeting as assistant rapporteurs, by order of the Chair, were legal auditor Anastasia Kaniklidou and Irini Papageorgopoulou, an employee of the Authority’s Administrative Affairs Department, served as secretary. The Authority took the following into consideration: A complaint, bearing Authority Ref. No. Γ/ΕΙΣ/1510/28-02-2023, was submitted to the Authority by A (hereinafter the “complainant”), whose debts have been subject to a settlement pursuant to the provisions of Law 3869/2010, in which TIRESIAS S.A. is the respondent. (hereinafter the “Respondent”) for failing to honor his exercised right to rectification and erasure of his personal data. Specifically, in accordance with the allegations, in his requests dated October 4, 2022, and January 29, 2023, he requested the correction and erasure of records/entries concerning him, as 1appear in the Loan Aggregation File (“White List”) of the respondent, specifically as follows: (a) The deletion of the entry regarding the “non-existent loan”/“unknown fictitious loan,” according to the respondent’s allegations, with code … registered in the Loan Central Registry by the company VERALTIS ASSET MANAGEMENT MON. A.E.D.A.P. (formerly B2 KAPITAL) (hereinafter “Veraltis”), given that, regarding said entry, according to his allegations, no supporting document was provided that had been signed by him. (b) The correction resulting from an erroneous classification and “incorrect financial data” related to the loans managed by “Intrum Hellas” with codes … and …, which related to a mortgage and a home improvement/ consumer loan, respectively, that the respondent had received from the Bank of Cyprus and which, according to his account, have been finally settled in court pursuant to Law 3869/2010. According to the respondent, the loans in question have been converted into “interest-bearing debt” pursuant to App court ruling. In his related request to the respondent, he asks the latter to indicate in the “Comments” field that this is a “debt settlement under Law 3869/2010,” omitting the amount owed since it cannot be calculated in the manner specified in the operative part of the decision. As part of its investigation into this complaint, the Authority notified the respondent on May 29, 2023, requesting that it present its views within 15 days, specifically to analyze the records in its files concerning the respondent and to provide documentation regarding the lawfulness and accuracy of the relevant records. On June 13, 2023, the respondent sent its response, ref. no. Γ/ΕΙΣ/4414/14-06-2023, in which it sets forth, among other things, a detailed history and supporting documentation of her communication with the relevant authorities in order to confirm the accuracy of the respondent’s records. Specifically, she states that: 2- On February 8, 2023, the respondent sent an email to the management company Veraltis, asking the latter to clarify whether the respondent had signed the original contract for the loan in question and whether there was an outstanding claim arising from that loan, because, according to his allegations, the entry in question was false. Veraltis, on February 10, 2023, in its response, informed the respondent that the relevant debt arising arose from the contract in question had not been paid, and subsequently, on February 13, 2023, following a new message from the respondent (dated February 10, 2023), it informed her that the respondent had signed the relevant contract. - On February 13, 2023, the respondent sent a request to INTRUM HELLAS and subsequently to Piraeus Bank, which was responsible for cases involving court-ordered settlements under Law 3869/2010, requesting relevant information; at the same time, a similar request was sent to Eurobank. The complainant was informed of the above. - On March 3, 2023, the respondent sent a reminder message to Piraeus Bank regarding INTRUM HELLAS. - On March 15, 2023, INTRUM HELLAS responded to the request by resending the forms, while on March 17, 2023, the respondent sent a follow-up inquiry to Piraeus Bank regarding the accuracy of the entries for the two loans with … and …, which she repeated on April 19, 2023, both to Piraeus Bank Piraeus as well as to Eurobank (regarding loan number …). As the respondent states in its response, these communications with the institutions continued even after the Authority forwarded the complaint, and on May 30, 2023, a new message was sent to Veraltis, INTRUMHELLAS, and Piraeus Bank. Finally, following the responses from Veraltis dated June 2, 2023, and June 7, 2023, Veraltis, as well as the response from INTRUMHELLAS dated June 8, 2023, according to which the data transmitted regarding the two loans is accurate, the respondent stated in its response to the Authority that: a) Following relevant communications with the competent authorities, in order to verify the accuracy of the respondent’s records and in response to his request, on June 8, 2023, a notice was issued to financial unit regarding the inclusion of the relevant loans, managed by INTRUM Hellas, in a court-supervised debt settlement pursuant to Law 3869/2010, stating “the debt arising from the loans approved on January 31, 2013, and approved amounts of 108,967.20 euros and 18,532.80 euros, respectively, has been included in a judicial settlement pursuant to Law 3869/2010,” and the respondent was informed accordingly. (b) Regarding the accuracy of the representation of consumer loan No. … registered in the Loan Registry as granted by Veraltis, the latter, following relevant inquiries from the respondent company, confirmed the accuracy of the entry in question, attaching a relevant excerpt from the Athens Pawnbrokers’ Registry regarding the lawfulness of the transfer of the claim by Eurobank Ergasias Bank. Furthermore, in its letter dated June 7, 2023, Veraltis confirmed that the relevant undertaking agreement bears the debtor’s signature. Finally, in its response to the Authority, the respondent states that the processing purpose for the data held by the company is to minimize the risks arising from the conclusion of credit agreements by recipients with insolvent customers and, in general, from the creation of doubtful receivables, which leads to the protection of commercial credit and the soundness of financial transactions in the public interest. In the above context, in addition to the default data file (SAY), which is primarily intended to assess borrowers’ creditworthiness, has, since 2002, also been processing data regarding obligations assumed by individuals and enterprises toward the banking system arising from all types of financing (Loan Aggregation File—SSH), including those arising from the App debt settlement laws (Law 3869/2010), which aims to assess the creditworthiness of borrowers. Furthermore, as explained in its response , the relevant data (outstanding balances of loans and credits at any given time), concerning the Credit Information System (CIS), are transmitted to the company by the lenders of the 4respective loans or lines of credit, without the prior consent of the data subjects, in accordance with Article 70 of Law 3746/2009, on a monthly basis, so as to ensure that the data is systematically updated and, consequently, accurate. Specifically, the institutions have undertaken the obligation to submit the outstanding balances of grants for the calendar month preceding the submission, and are solely responsible for updating the records. As the respondent further explains, if in any given month there is no update for a particular loan or line of credit, then the transmitted displays the most recent details of the loan/credit and the date of the last update by the institution is recorded. In the event the data has not been submitted for a period of three months, the data is marked with a (D) and its transmission to the recipients ceases. Finally, the respondent notes that the information provided to the company by the agencies also includes details regarding the “closure” of the credit facility (e.g., due to the assignment of the claim arising from the credit—as in the case of the respondent). The legal basis for the processing being carried out is the legitimate interest pursued by the data recipient (legal and regulatory obligation to assess credit risk, drafting and operation of contracts under which credit risks are assumed), compliance with legal obligations, and the prevention of borrowers’ over-indebtedness (Article 6( 1(f) of the GDPR). In conclusion, the respondent states in its response that, in the case of the complainant, the company engaged in numerous contacts with the entities, which reported their data in question to the Credit Information System (SSCH). These entities confirmed the existence, correctness, and accuracy of the debt data they transferred, as well as the complainant’s signature on the relevant loan agreement. Finally, in response the complainant’s request, the respondent company issued a statement stating that the complainant’s loans fell under Law 3869/2010, in order to comply with his request submitted for this purpose. Subsequently, the respondent submitted his supplementary document with Authority Ref. No. Γ/ΕΙΣ/4408/13-06-2023, through which he provided the Authority with a payment confirmation issued by EUROBANK, from which, according to his claims, it appears that the amount owed to said Bank and which had been specified in the operative part of the court decision (No. …) of the Single-Judge Court of First Instance of F, claiming that the specific loan should have been permanently erased from the respondent’s records. The Authority, in its letter bearing Authority Ref. No. C/EX/2749/31-10-2023, requested additional clarification from the respondent, asking her to inform the Authority whether she had become aware of the information referred to above (namely, among other things, the relevant payment confirmation issued by Eurobank) either from the data subject or from the competent authorities. In response to the aforementioned document, the respondent sent the Authority its reply, bearing the Authority’s reference number Γ/ΕΙΣ/8132/15-11-2023, in which which, after reiterating that she had made numerous contacts with the competent authorities in order to examine the validity of the complainant’s complainant’s allegations, she noted that the complainant never provided her with a copy of the certificate in question, nor did he provide the appellate court decision itself of the Single-Judge Court of First Instance F regarding his subjection to the provisions of Law 3869/2010. As stated in her response, the respondent was unaware of said decision, while she noted that the granting agencies are solely responsible for the type and content of the information they transmit are the granting agencies, since they possess the complete details of each grant. Furthermore, in her response, the respondent reiterated that, in the event that any information in the file is called into question, it contacts the agencies directly for review and corrective action. As she further explains in her response, in the event that the data subject submits directly to the respondent documents that unequivocally substantiate their claims (such as, for example, a payment receipt, a court decision, etc.), then the respondent will, in exceptional cases, take action without the intervention of the authorities—a situation which, however, as she states, did not occur in this case. 6 In light of the above, on November 1, 2023, the respondent contacted Veraltis and Eurobank again in order to verify the validity of the claim in question. In response to this inquiry, Eurobank, on November 14, 2023, after confirming that the respondent had repaid the amount specified in the decision of the Single-Judge Court of First Instance F, with the final payment made on November 30, 2016, stated verbatim: “There does not appear to be any data breach on the part of the Bank of the rules regarding data protection for Mr. A, given that the Bank has not received any judicial or even extrajudicial confirmation or notification regarding the proper fulfillment of his obligations to all creditors, as as specified in Decision No. 21/2013 of the Single-Judge Court of First Instance of F. This was a prerequisite for the discharge of the entire outstanding balance of his debts. This also applies to the period following receipt of the letter informing him of the impending sale and assignment of the claim on our part.” Furthermore, as stated in its response to the Authority, in order for the asset management company, in cooperation with the bank, to further investigate handling the transfer, the accuracy of the representation of consumer loan no. … in the SSX database, the company proceeded on the same day (November 14, 2023) to temporarily transfer of the information in question to the file of information not transmitted to information recipients until the competent authorities take appropriate measures to inform them. The complainant was also notified of this action by letter. Finally, the respondent stated that regarding the other entries, INTRUM HELLAS, in its messages dated November 6, 2023, November 7, 2023, November 9, 2023, and November 14, 2023, confirmed the accuracy of the entries concerning the respondent, stating verbatim: “The accuracy of the fields in Mr. A’s record dated September 29, 2023.” She also notes that, in order to optimize the accuracy and correctness of the data in the company’s grant aggregation file, steps have already been taken to send a written communication to the granting agencies and the management companies in order to verify the accuracy of the data submitted by them. 7 Subsequently, the respondent submitted a supplementary document with Authority Ref. No. C/EIS/8732/12-07-2023, in which he reiterates that the respondent failed to conduct, as required, a preliminary verification of the accuracy of the information transmitted regarding his active debt settlement plan, pursuant to Law 3869/2010, nor did it carry out the erasure of loans that had been definitively settled with the debt paid off more than 7 years ago, as, according to his allegations, it was required to do. Furthermore, as the respondent notes, TIRESIAS refuses to conduct a substantive and complete review of the calculation of loan debt pursuant to Article 64 of Law 4549/2018, while also recording in the Credit Information System (SSH) a debt under Law 3869/2010 as a mortgage loan. It further states that, although Eurobank has confirmed that the repayment plan was paid off as of November 30, 2016, and has issued a corresponding certificate, it has transferred the claim to a “fund” and, although it has undergone erasure pursuant to Article 64 of Law 4549/2018, TIRESIAS proceeded to register a new fictitious loan at a time when there is an erasure of the debt. Finally, the respondent states that the amounts relating to the second repayment period under Law 3869/2010 are incorrect, while noting that “the debt on all 4 loans has been paid off for more than seven years now.” With the Authority’s reference numbers Γ/ΕΙΣ/5847/10-07-2024 and Γ/ΕΙΣ/5861/11-07- 2024, the respondent submitted to the Authority the decision No. … of the Single-Judge Court of First Instance in F, which, as she states, she received on her own initiative from the issuing Court, as well as a detailed report of data concerning the respondent, in which, as she points out in relation to the two INTRUM debt management loans (to which the complaint under review pertains), the notice regarding admission to a court-supervised settlement (in response to a relevant request by the respondent), while the Veraltis loan is not communicated to the recipients. Furthermore, in the supplementary document bearing Authority Ref. No. Γ/ΕΙΣ/7977/15-10-2024, the respondent stated that, based on a relevant message received from the company Veraltis on October 2, 2024, she proceeded on October 8, 2024, to permanently carry out the erasure of the complainant’s consumer loan No. … consumer loan, which it managed, and informed both the respondent and the managing company accordingly. 8 Finally, the respondent, in his supplementary document (ref. no. Authority Ref. No. C/EIS/8076/10-18-2024), states that on October 11, 2024, he was informed by letter from the respondent of the permanent erasure of the aforementioned consumer loan No. … consumer loan, a fact that confirms the validity of his claims, while he once again points out the unjustified delay in the fulfillment of his rights. In light of the foregoing, the Authority summoned him to a hearing before the Authority’s Division via teleconference, pursuant to the Authority’s reference numbers Γ/ΕΞΕ/2347/June 27, 2025 and G/EXE/2346/June 27, 2025, the complainant and the respondent , respectively, on July 9, 2025, a date on which the complainant and his lawyer, Stefanos Vazakas (Bar No. …), and presented his arguments; on behalf of the respondent, Ioannis Mourgelas, lawyer (Bar No. …), while the Data Protection Officer Data Protection Officer for Respondent B (Lawyer Reg. No. …). Furthermore, following the hearing in question, a deadline was set for the submission of briefs to further support their claims by July 18, 2025. Subsequently, the complainant and the respondent submitted, within the deadline, on July 18, 2025, their briefs bearing the Authority’s reference numbers Γ/ΕΙΣ/6758/18-07-2025 and Γ/ΕΙΣ/7101/28-07- 2025, along with the documents attached thereto, in which they state, among other things, the following: First, the complainant, both during the hearing and in his brief, stated that the respondent’s position in the economy is critical, since the data it provides to users determine and significantly influence their transactional behavior toward the data subject or toward legal entities. As noted, the respondent maintains data and financial information which, if inaccurate, can distort economic freedom and free competition, with serious economic consequences for both the data subject and third parties and economic actors. It also notes that the respondent neither verifies verifies the data stored in its database, having granted maximum autonomy in the processing and use of its database to banks and 9loan and credit collection management companies, limiting itself to the role of a mere intermediary, while its shareholders are Greek banks and Therefore it has no instance of independence or operational freedom from the banking system with regard to the rights under the GDPR. According to allegations, the respondent has failed to operate an adequate system for data protection, as it does not exercise any form of preventive control or oversight over the data and information that credit institutions enter into its systems, nor has it established any form of random preventive audit, nor does it maintain adequate reactive audit procedures when the respondent alleges a case of false or inaccurate entry or failure to update data is reported. It states that TIREASIAS limits itself to internal correspondence with the credit institution that entered the inaccurate record and non-existent claim, and does not verify the validity or accuracy of the record, thereby reversing the burden of proof, requiring the data subject to prove the non-existence or inaccuracy of the recorded claim/entry to the credit institution. It notes, however, that the erasure of false entries and the correction of inaccurate entries depend either on the discretion of the credit institution or on a final court decision, with all that this entails regarding the consequences of false and inaccurate credit information for the data subject. Furthermore, he states that there were seven entries concerning him and emphasizes that the entry identifiers cannot be readily with the numbers of the loan agreements that the data subject actually entered into, a practice that hinders the verification and protection of the data subject’s rights. He claims that two of the entries were completely false and were not related to any actual debt, while the remaining five concerned his debts, which were not loans but had been settled pursuant to Law 3869/2010, three of which related to consumer loans (two from Piraeus Bank and one from Eurobank), which had been restructured during the first (four-year) period and had already been paid off by 2017. The remaining two concern a mortgage and a home improvement loan from Piraeus Bank (originally from the Bank of Cyprus), and these were settled by a court decision. Furthermore, he explains that there are three issues at hand: (a) the unlawful entry of a false entry for a non-existent claim, (b) the unlawful entry of three inaccurate entries that had been settled pursuant to a final decision under Law 3869/2010 and paid off as of 2017 and therefore should have been subject to erasure in 2022 upon expiration of the prescribed five-year period; and (c) the unlawful inclusion of two debts settled pursuant to a final court decision under Law 3869/2010 incorrectly as loans. Furthermore, he notes that the incorrect classification as loans rather than restructured debts, together with the other financial data, gives a false impression that the individual continues to be a contracting party with the Banks under specific loan agreements, the breach of which entails specific consequences. However, following the court-ordered settlement, the entire legal relationship between the bank and the over-indebted debtor is governed by the court’s decision and the provisions of Law 3869/2010, which are more favorable to the debtor; they provide for a special procedure for exclusion from the settlement, with guarantees judicial review of the validity of the grounds for exclusion; whereas, when a third party/User of this service has access to this information, which appears as a loan, they do not understand that it is subject to a special legal protection regime and form an incorrect perception of the subject’s financial profile. Subsequently, he reiterates what he stated during the hearing of the case, pointing out that for two years, TIRESIAS ignored the persistent written complaints regarding the non-existence of the entry stemming from contract no. …/account no. … handled by Veraltis, and insisted on support Veraltis’s positions and maintain a false entry, referring the matter to Veraltis for further action. He further reiterated that the respondent had unlawfully recorded a debt against him arising from a non-existent claim, noting that TIRESIAS was unable to identify the issue of the nonexistent debt and to conduct an investigation; instead, it temporarily suspended the specific entry for the non-existent debt. Finally, the complainant states that, according to a letter from the respondent, ref. no. …, it permanently carried out an erasure said loan from the Loan Registry, because it realized the illegality and the violation of his rights, while he states that the false entry in TIRESIA was made based on false and incorrect data held in their own databases by Eurobank and Veraltis. Subsequently, the complainant reiterates what he stated during the hearing, namely that the respondent should immediately take all appropriate measures against the bank (in order to protect the security of the information it processes in its database), while noting that the respondent deliberately, during the hearing of the case, deliberately repeated the claims of Eurobank and Veraltis, thereby demonstrating that it is not conducting any verification and is acting in favor of the banks and to the detriment of the individual. He reiterates that of the five entries, three pertain to three consumer loans and all have been structured with monthly payments of a specific amount during the first period (four years), while noting that Law 3869/2010 does not impose any other prerequisite or require any other procedure, and automatically and without further ado declares the debtor’s full discharge, leaving no doubt as to this matter, nor is there any grounds for disputing the method of calculating the interest rate (as is the case with restructured debts on mortgage/ renovation loans pertaining to his two entries). Furthermore, the complainant notes that the consequences of defaulting on payments for the 20-year period are limited to the restructured mortgage/home improvement loans and do not apply retroactively to consumer loans, for which the discharge is final and irrevocable, and reiterates that Eurobank was aware as early as 2017 that the repayment plan had been paid off in full and that full discharge was warranted, having even issued a relevant confirmation to that effect. It points out that following the hearing proceedings, the respondent was compelled to carry out the erasure of these three entries, while noting that the same applies to the unlawful listing of two settled debts from a mortgage and a home improvement loan, which the respondent insists on falsely presenting as loans (with only a verbal clarifying addition), even though they constitute a settlement, and complains that the amounts reported are completely inaccurate. The respondent, therefore, according to the complainant’s , repeatedly refused to grant the right to rectification, citing statements from third-party companies (Intrum, Veraltis, Banks), without requesting supporting documentation. The respondent, both during the hearing and in its post-hearing 12-page brief, stated the following: The records maintained by the company include the Loan Aggregation System (LAS), the data for which are sent by the credit and financial institutions (“entities”) that grant the loans, along with the respective balances of those loans, and the company subsequently monitor them, both in terms of the loan agreement’s operation and for accounting purposes. These lenders receive complete and timely updates on the status of the loans they grant and are the sole source of the information recorded in the aforementioned database. According to the respondent’s assertions, “for this activity, credit and financial institutions are, under the Regulation, controllers and have the responsibility and obligation to comply with processing all the processing principles set forth in Article 5 of the GDPR, including the accuracy and completeness of the data transferred to TIRESIAS,” while in addition, they have “the obligation to respond in a timely manner in the event that the data subjects whose data they transmit to TIRESIAS exercise their rights under the Regulation, including the right to rectification.” TIRESIAS, furthermore, asserts that it, “to which the data are sent, upon receipt, becomes the controller responsible for their subsequent management —that is, for recording them exactly as received, their proper classification and categorization, their correction, provided the sender corrections them, and ensuring unimpeded access to them by their lawful recipients.” As TIRESIAS further explains, it cannot address requests for correction because it does not have—nor could it have— access to loan accounts or records, unless the data subject submits irrefutable evidence demonstrating the need for correction (e.g., a court decision discharging the debt). In any other case, upon receiving a request for correction, the only thing it can and is required to do is to notify the lender, who must respond so that the correction can be made and the accuracy of the record restored. Furthermore, the respondent explains that the Financial Behavior does not include any financial or other assessment of those included in it; rather, such assessment is the responsibility of the data recipient, 13 who takes them into account in conjunction with the financial transaction that is to be carried out. Furthermore, the respondent reiterates that, for the purpose of comply with the requirements of the GDPR and, in particular, with the principle of accuracy, it performs various checks at all stages of data processing, while the entities acting as independent data controllers send data files in a specific format, which ensures the completeness and consistency of the input files and the possibility of automated processing. It states that upon receipt of each file, automatic file checks (which perform structural, logical, and quality checks) are triggered, checks by the Directorate of Information and Citizen- Business Services (which include requests from citizens and banks), as well as checks by the Directorate of Banking Relations. Regarding the SSX file, the respondent notes in her response that loans arising under the debt restructuring provisions of Law 3869/2010 or another institutional framework (PEE) must be reported by the competent authority with the relevant designation. She reiterates that the authorities have undertaken the obligation to submit the outstanding balances of loans, as of the calendar month preceding the submission, and are solely responsible for updating the data. If there is no update for a loan in a given month, then the transmitted information file displays the most recent loan/credit details and indicates the date of the last update by the institution; however, if the data are not sent for a period of three months, the data are marked with a “D” and their transmission to recipients ceases (as occurred in this case with the complainant’s two loans, which were ultimately permanently deleted from the SSX Archive on December 14, 2022). He also notes that the information provided to TIRESIAS by the institutions includes details regarding the “closure” of the loan (e.g., due to the transfer the claim from the credit claim—as in the respondent’s case, due to a balance transfer, etc.). It explains that the following checks are performed at various stages of processing the data in the loan consolidation file automatic checks, further checks prior to final entry into the SSX file, while special checks are also performed for 14assigned receivables involving banks and companies that manage receivables from loans and credits, and reiterates the procedure followed for erasure of data from the SSX Registry and correction of SSX Registry data. Furthermore, the respondent explains the procedure for entering and erasure of data in applications for judicial debt settlement (Article 4(1) of Law 3869/2010), as well as the process for entering and erasure of data in court-ordered debt settlement decisions (Article 8 of Law 3869/2010). It states that when entering data into decisions judicial debt settlement (Article 8 of Law 3869/2010), with the notation “settlement settlement debts” or “certification of discharge from remaining debt,” the data entry is made provided that the relevant documents proving the repayment of the debts or a court decision certifying the discharge from the remaining debts, or if the creditor banks/companies notify TIRESIAS of the settlement of the debts owed to each of them. If the original data has transmitted to TIRESIAS by the creditor bank/company, then the bank/company notifies TIRESIAS of the settlement within 2 business from the date of repayment. Furthermore, it states that, for the further protection of the data subject, in the event that the right to restriction of processing is exercised under Article 18 of the GDPR, a relevant indication of the restriction on processing appears, and the company proceeds to investigate the disputed data; furthermore, respondent in this specific case fully and timely complied with the complainant’s right to restriction of processing. The respondent notes that an aspect of the right to restriction of processing is the right to non-disclosure of the data, which may be requested by the data subject. In this case, the data do not appear in the file of transmitted information, but a relevant note appears stating that “the wishes to have the data concerning him or her transmitted,” a notation that is interpreted at the discretion of the recipients. It is explained that, following a joint decision by the General Director, the Deputy General Director, and the Director of Legal Services, data from the TIREAS records, regarding which there is reasonable doubt as to the accuracy 15 and until the accuracy of the information is confirmed by the source, are subject to erasure from the database of transmitted information and are transferred to a database of non-transmitted information. Furthermore, as the respondent company states, as soon as it became aware of the payment confirmation, it placed the disputed Veraltis management loan in the archive of non-disclosed information. Finally, it proceeded with a permanent erasure following further communication with the relevant authorities. The respondent also cites a series of communications and meetings with entities (banks, receivables management companies and their respective DPO) and actions taken in response to the complaint in order to ensure the quality of the data sent and the accurate representation of such data, specifically reiterating issues regarding the submission of products subject to Law 3869/2010 and placing particular emphasis on the obligation under Art 5 of Law 3816/2010. According to the respondent, these actions include the following: (i) interbank meetings that took place in July and December 2023 with executives with whom the company maintains an ongoing working relationship, during which the respondents informed the parties involved regarding the quality (accuracy and completeness) of data sent on behalf of the banks and the Hellenic Data Protection Authority (HDPA) and reiterated the importance of ensuring the quality and the correct representation of the data submitted, (ii) meetings with the Internal Audit Department of the respondent, the banks, and the largest EADAPs in February 2024 and 2025 on the same topic, (iii) an interbank meeting in April 2024, during which the accuracy and correctness of the transmitted data, and guidance was provided with an emphasis on the obligation under Article 5 of Law 3816/2010; (iv) electronic letters were sent to the permanent liaison officers representing banks, other institutions, and loan and credit receivables management companies, with the option access to the SSX Archive; (v) meetings on the same topic were held on October 1, 2024, with particular emphasis on data quality and the management of loans under Law 3869/2010, with a special presentation on how to manage loans restructured under Law 3869/2010, both in the Default Registry (SAY) and in the Grant Consolidation Registry (SSX), (vi) meetings in May 2025 with all permanent liaison officers from the Agencies, during which 16an update regarding the revision of the SSC specifications and the addition of additional indicators and fields via a special annex to Law 3869/2010, emphasizing the importance of accurately recording the information in the file. Furthermore, as stated by the respondent, additional entries and fields were added to the monthly loan aggregation file via a special annex referencing Law 3869/2010, and a presentation was also held a relevant manual. Finally, the respondent points out the following: TIREASIAS maintains the Default Registry and the Loan Aggregation Registry Grants in its capacity as the controller, and it immediately and thoroughly examined the requests submitted by the complainant, despite the fact that it was never provided with any supporting documentation substantiating the allegations raised, and engaged in numerous communications with the relevant authorities, while reiterating that the information in the respondent’s possession (namely the March 9, 2017, regarding the payments he made, as well as the appellate decision of the Single-Judge Court of First Instance F) were not submitted, but were attached for the first time to the supplementary complaint. He points out that he has communicated with the credit institutions’ designated liaison officers, requesting that they take corrective action regarding any errors appearing in the Loan Centralization File, regarding loans that appear to have been transferred at a time subsequent to the repayment of the relevant debts to EDAD as the sole competent authority. As the respondent explains, compliance with the court decision by the debtor must be comprehensive, vis-à-vis all credit institutions to which he owes money, and in order for the debtor to be released from the respective debt, either a court decision must be issued certifying the debtor’s discharge from the remaining debts, or the submission of certifications by the debtor himself attesting to compliance with the court decision and from the other credit institutions.Furthermore, as stated in the respondent’s brief submitted after the hearing, following the complaint, a revision work has been carried out, with the agencies and the EDAAP adding additional information to the monthly SSX file, specifically regarding Law 3869/2010. Finally, it concludes that any problems that have arisen in connection with Law 3869/2010 and the transfer of the relevant claims are isolated cases, noting that TEIRESIAS is obligated to make available to credit institutions financial behavior data so that they can achieve accuracy in assessing credit risks and deciding on financing requests, while it should not be overlooked that the submission of an application for a court-ordered debt settlement under Law 3869/2010 and the issuance of a decision granting eligibility constitute highly significant in assessing the applicant’s creditworthiness by the relevant competent authority. The assessment of credit risk leads to a reduction in bad debts and over-indebtedness. The Authority, having taken the above into account, after reviewing the information in the case file and having heard the rapporteur and the clarifications provided by the assistant rapporteur, who was present without the right to vote, following a thorough discussion HAS DECIDED IN ACCORDANCE WITH THE LAW

It follows from the provisions of Articles 51 and 55 of the GDPR and Article 9 of Law 4624/2019 (Government Gazette A’ 137), it follows that the Authority has the competence to supervise the implementation of the provisions of the General Data Protection Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (hereinafter referred to as the GDPR), this law, and other regulations concerning the protection of individuals with regard to the processing of personal data. Specifically, it follows from the provisions of Article 57(1)(f) of the GDPR and Article 13(1)(g) of Law No. 4624/2019, it follows that the Authority has the authority to address the complaint filed by A against the company TIRESIAS S.A. and to exercise, respectively, the powers conferred upon it by the provisions of Article 58 of the General Data Protection Regulation and Article 15 of Law 4624/2019. 2. “Processing” of personal data, as defined in Article 4( 2) of the GDPR, means any operation or set of operations performed, with or without the use of automated means, on personal data or on sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, searching, use, disclosure by transfers, dissemination, or any 18other form of disclosure, the linking or combination, the restriction, erasure, or destruction. Furthermore, pursuant to Article 4(7) of the GDPR, the controller is defined as “the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing personal data; where the purposes and means of processing are determined by Union law or the law of a Member State , the controller or the specific criteria for its designation may be laid down by Union law or the law of a Member State.”

Article 5(1) of the GDPR sets forth the principles that must govern the processing of personal data. These include the principle of accuracy (subparagraph (d)), according to which personal data must be accurate and, where necessary, kept up to date; all reasonable measures must be taken to ensure the prompt erasure or rectification of personal data that are inaccurate, in relation to the processing purposes (“accuracy”). Furthermore, according to Recital 39, “every reasonable measure should be taken to ensure that data that are not accurate are rectified or subject to erasure.” Moreover, in accordance with the principle of accountability introduced by the second paragraph of the aforementioned Article 5, it is expressly stated that the data controller “is responsible and is able to demonstrate compliance with paragraph 1 (“accountability”). This principle, which constitutes a cornerstone of the GDPR, entails the obligation of the data controller to design, implement, and generally adopt the necessary measures and policies to ensure that data processing complies with the relevant legal provisions and, furthermore, to be able to demonstrate, on their own and at any time, their compliance with the principles of article 5(1) of the GDPR.

In accordance with the provisions of Article 24(1) of the GDPR: “1. Taking into account the nature, scope, context, and purposes of the processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons, the controller 19shall implement appropriate technical and organizational measures to ensure and be able to demonstrate that the processing is carried out in accordance with this Regulation. These measures shall be reviewed and updated whenever deemed necessary.”

As early as 1999, the Authority issued Decisions No. 109/31-03-1999 and 523/10-19-1999, which are decisions that define the conditions for maintaining a database of adverse financial behavior records by TEIRESIAS S.A. and the rules for categorizing such data (which constitute the Default System, “blacklist”). In 2004, the Authority reiterated the above decisions (Decisions Nos. 24 and 25/2004) so that, as regulatory acts, to be published in the Government Gazette (GG B 684/May 11, 2004). Specifically, in accordance with the Authority’s aforementioned decisions, the retention of adverse financial behavior data by TIRESIAS S.A. is permitted even without the consent of the data subject(s), pursuant to Article 5, para 2, subparagraph (e) of Law 2472/1997 (overriding legitimate interest, which consists in minimizing the risks arising from entering into credit contracts with insolvent customers and, in general, from the creation of doubtful debts, in the protection of commercial credit, and in the soundness of financial transactions).In these decisions, it was held that “the processing is indeed ‘absolutely necessary’ to fulfill this purpose, while the protection of commercial good faith, when weighed against the interests of the data subjects, may be considered to “clearly prevail,” within the meaning of Article 5(para 2)(e).” Furthermore, the categories of data that TEIRESIAS S.A. is permitted to retain for this specific purpose and the retention period for such data depending on their type, the recipients of the specific file, etc. 1 Through these Decisions, the Authority determined, among other things, the type of data that TEIRESIAS S.A. may lawfully retain in the Default System. This data pertains to the default on specific financial obligations, namely bounced certified checks, unpaid bills of exchange and promissory notes, complaints about loan and credit agreements, bankruptcy complaints, declared bankruptcies, payment orders, auction schedules, auction schedules and summaries of seizure reports, seizures and warrants under Law 1923, administrative sanctions by the Ministry of Finance, mortgage pre-notations, and mortgages. 20 Furthermore, since 2002, the Authority has issued a decision regarding the requirements for maintaining a “risk concentration or white list” file by TIRESIAS S.A. Specifically, the Authority, in Decision 86/2002, ruled that, unlike the file of adverse financial data (“blacklist”), the creation of the aforementioned database (“white list”) by TIRESIAS S.A., without the consent of the data subject, was contrary to the law and exceeded the processing purpose. It was therefore held that the database in question (“white list”), which contains current debts and delinquent debts—without these, however, being assessed and due (as in the case of the “blacklist”), may be created and operated solely on the basis of the consent of the data subject. Subsequently, the legislature, through the provision of Article 40 of Law 3259/2004, regulated the operation of TIRESIAS’s “blacklist” database in a manner that is essentially identical to the content of the Authority’s Decision No. 109/31- 03-1999 (which permitted TIRESIAS to create the database in question without the consent of the data subject) and amended the specific categories of data, which the Authority had defined in its Decision No. 523/19-10-1999 and the decision on the retention period for such data. Subsequently, the provision of Article 70 of Law 3746/2009 replaced the aforementioned provision of Article 40 of Law 3746/2009. Specifically, this provision not only amended the conditions and retention periods for specific categories of data (adverse data) (see para 1 and 3, as these were subsequently replaced by Article 4, para 1 and 2, of Law 3816/2010; see also Articles 3–5 of Law 3816/2010), it was explicitly stipulated that: “2. Credit and financial institutions are permitted to conduct data transfers, for registration, regarding the outstanding balances of loans and/or credits—including existing ones—that they grant to natural or legal persons or associations of persons, to a financial behavior database that operates lawfully for their benefit, without the condition set forth in Article 5, para 1, of Law 2472/1997 (Government Gazette 50 A). 21 Access by credit and financial institutions to the aforementioned data is permitted only under the terms and conditions of Law 2472/1997, as currently in force and applied. The period during which credit institutions or financial behavior data files operating lawfully on their behalf may retain and use such data may not exceed five years.”

Furthermore, TIRESIAS, as the controller, must comply with all the principles governing the lawful processing of personal data, including, 2 among others, the principle of accuracy. In accordance with the Authority’s Decision No. 60/2009, as also defined in the Authority’s Decision No. 24/2004 regarding the conditions for maintaining records by TIRESIAS S.A., personal data that is detrimental to the The data subject must be accurate and up-to-date at the time of transmission to the recipient. The accuracy and up-to-date nature of the data is, in principle, the responsibility of the controller. From the two decisions cited above, in conjunction with 3 Article 4(1)(c) of Law 2472/1997, it follows that TIRESIAS, as the controller, is responsible for the accuracy of the data contained therein . Furthermore, the verification that must be carried out by the banks regarding the accuracy of the data—since they themselves are the sources of the data—does not exempt TIRESIAS from the duty to verify and ensure that the legal requirements for lawful data processing are met. Within the framework of the principle of accuracy, it is understood that during processing, the necessary precautions and diligence must be exercised to avoid errors as well as potential confusion, e.g., due to homonyms. However, in cases where the relevant facts (e.g., payment) are not made made public, the relevant information must be submitted by the parties concerned or by the institutions to TIRESIAS, given that the 4 latter does not have direct access to the banks’ data. 2Available on the Authority’s website, www.dpa.gr 3Furthermore, under the GDPR, the principle of accuracy is defined in Article 5(1)(d) of the GDPR. 4See Authority Decision 104/2001, available on the Authority’s website at www.dpa.gr, and Supreme Court Decision 1923/2006, published in NOMOS, in which it was ruled that “in view of the fact that repayment does not take effect 22

The sources of the file in question (SSCH) are credit and financial institutions and the data subjects. Subsequently, loan and credit receivables management companies were also included, since, in many cases, these companies have now taken the place of credit and financial institutions have, under the current regulatory framework, been replaced by these companies (E.D.A.D.P.) for the receivables they manage. The data must be sent to TIRESIAS directly from the sources, and in accordance with TIRESIAS’s Data Processing Regulation, or by the 5th day of each month, or if the 5th falls on a holiday, by the next business day, and pertain to the status of loans as determined during the last processing of the calendar month preceding the dispatch.

Furthermore, credit and financial institutions (and now also the companies in question—EDADP) that have submitted the corresponding initial report of financial data to inform TIRESIAS regarding the repayment of the debt; furthermore, according to Article 5 of Law 3816/2010 on “the settlement of business and professional debts to credit institutions, provisions on the processing of financial behavior data, and other provisions,” the credit institution and, more generally, the financial institution that has conducted data transfers regarding debts to financial behavior databases operating lawfully is required, within two business days from the receipt of such information, which proves the settlement of the debt, to notify, at no cost to the debtor, the Controller of the aforementioned records.

The Authority, in its Decision No. 50/2011, ruled that the financial conduct data related to the proceedings under Law 3869/2010 may be lawfully retained. Specifically, pursuant to Article 16 of Law 3869/2010, “the period during which credit institutions or third parties acting on their behalf may retain financial behavior data relating to the procedure under this law, may not exceed a period of three years from the date of discharge from debts in accordance with the first sentence of paragraph 1 of article 11.” From this rule regarding the retention period for financial conduct data, it follows indirectly that such data may indeed be lawfully retained; while the law does not list the specific data that may be retained, but defines them in general terms; as for determining the data covered by this provision, the actions included therein must be clarified. Specifically, and in accordance with the Authority’s Decision 50/2011, “The law distinguishes the actions required for the settlement of debts of over-indebted natural persons into two phases. The first phase is governed by article 2 of the law and is titled ‘Out-of-Court Settlement Procedure.’ The second phase concerns the proceedings before the competent Court and is governed by Articles 3 et seq. of the law. The distinction between the two phases of the procedure for settling critical debts does not imply a legislative intent to treat the debtors’ circumstances differently in each phase of the procedure. The separate regulation of these two phases of the same procedure is justified by the need to establish a preliminary out-of-court phase to explore possibilities for resolving the consequences 6 See Recital 2 of the Authority’s Decision 50/2011, available on the Authority’s website at www.dpa.gr 24of the permanent inability to pay debts to them. Compliance with this preliminary stage is a prerequisite for initiating judicial proceedings (article 2 para. 1), without, however, constituting a separate procedure in itself. This is also why Article 16 does not distinguish between the two phases of the debt settlement procedure, but refers to the overall “procedure under this law.” Consequently, from the letter and purpose of the relevant provision, it follows that it applies to cases involving both the out-of-court settlement procedure and the Court-based procedure for the debt settlement of over-indebted natural persons. Furthermore, the decision in question held that data relating to the filing of an application for out-of-court settlement pursuant to Article 2 of Law 3869/2010 are lawfully collected by TIRESIAS S.A. without the consent of the data subjects, in accordance with paragraph 2(b) of Article 5 of Law 2472/1997, in order to be registered in the Credit Information System (White List) and ordered their erasure from the Default Registry (Black List).

Pursuant to the provision of Article 11 of Law 3869/2010, as amended by Article 64(1) of Law 4549/2018: “1. The regular fulfillment by the debtor of the obligations imposed by the decision issued in pursuant to paragraphs 2, 4, and 5 of article 8 results, subject to the provisions of paragraph 6 of article 4 and paragraph 2 of article 9, the automatic discharge of the debtor from any existing balance of debt toward all creditors, even those who have not filed their claims. The debtor may request the Magistrate’s Court, by means of a petition is served on the creditors and heard under the voluntary jurisdiction procedure, for certification of his discharge from the balance of his debts.” Furthermore, according to the explanatory memorandum of Law 3869/2010, paragraph 1 now makes the Magistrates’ Court’s decision certifying certifies the debtor’s discharge, and the debtor’s discharge occurs automatically upon the proper fulfillment of his obligations under the 7 decision debt settlement, without any additional procedure being required. The provision 7 See the Explanatory Memorandum to Law 4549/2018, which amended Law 3869/2010. 25However, the debtor retains the right to request a decision confirming his discharge, a step that each in order to certify their legal standing and safeguard their legitimate interests. Furthermore, a prerequisite for the debtor’s discharge is his compliance with the debt settlement arrangement with respect to all creditors whose claims are covered by the court-ordered arrangement; and it is not sufficient for the debtor to merely comply with the regular performance of his obligations toward a single creditor. Verification of the above condition—namely, the proper fulfillment of the debtor’s obligations to all creditors— is established by the debtor’s submission of proof of payment from the other creditors whose claims are governed by the court decision, certifying that the debtor has complied with his obligations toward them, as regulated by the relevant court and that no installment remains outstanding from those specified in the court decision. The submission of these certificates is not required when the discharge is certified by a court decision. The debtor’s discharge takes effect regardless of compliance with the provisions of Article 9, paragraph 2, of Law 3869/2010 (regarding the preservation of the debtor’s primary residence ), which may not proceed smoothly. In this case, the debtor does obtain discharge under Article 11, para 1 of the law, but may , however, face the complaint regarding the arrangement by the creditor and the initiation of enforcement proceedings against his primary residence if they fall behind on at least four monthly installments (Article 9, para. 3 of the law). Consequently, in order for the debtor to be released from any outstanding balance of debt pursuant to Article 11 of Law 3869/2010, as amended by Article 64(1) of Law 4549/2018, if they do not wish to apply to the relevant Magistrates’ Court to have their discharge certified 8See also pp. 686 ff. Iakovos Venieris, Theodoros Katsas, “App of Law 3869/2010 regarding over-indebted natural persons,” Legal Library 9 See, in this regard, Athens Magistrates’ Court 30015/2025, 1st publication in NOMOS, Ermionida Magistrates’ Court 24/2018, Atalanti Magistrates’ Court 60/2024, First Publication in NOMOS. 26of the remaining debts (a procedure which, although now optional, it nevertheless provides the necessary legal certainty), the debtor must submit to TIRESIAS complete documentation supporting his request, including the corresponding certificates of completion and compliance with the court-approved payment plan for the first period, pursuant to Article 8 para. 2 of Law 3869/2010, from all creditors whose claims are covered by the court-approved settlement. Notwithstanding the foregoing, credit and financial institutions and loan and credit receivables management companies are required to promptly update the relevant data under their control and are recorded in TIRESIAS’s files, providing updates, among other things, regarding the completion of installment payments included in the first period of the court-approved repayment plan.0

Regarding the retention period for the relevant data, article 16 of Law 3869/2010 stipulates that “the period for which credit institutions or third parties acting on their behalf of financial behavior data referred to in the proceedings under this law may not exceed a period of three years from the date of discharge from debts in accordance with the first clause of paragraph 1 of article 11.” Furthermore, according to article 40 of Law 3259/2004, as amended by Article 70 of Law 3746/2009, “The period during which credit institutions or economic behavior data files behavior that operate lawfully for the purposes of such data may not exceed five years.” However, in this specific case, the provision of Article 16 of Law 3869/2010, which regulates the retention period for data from the date of debt discharge in accordance with the first sentence of paragraph 1 of Article 11, is a more specific article than that of Article 70 of Law 3746/2009. In this regard, the Greek legislature provided for a more specific rule in relation to Article 70 10 See also the above Supreme Court decision 1923/2006, First Publication in NOMOS, in which it was held that “in view of the fact the fact that the repayment is not made public, the relevant evidence must be produced by the appellant or the Bank since, after all, as the Court of Appeals has repeatedly held, the respondent did not have direct access to the records of the specific bank and, as a logical consequence, was not in a position to conduct the aforementioned verification, a fact that means the respondent was unaware, through no fault of her own, of the repayment…[…]…» Section 27 of Law 3746/2009, which provides that information regarding the occurrence of debt discharge under Article 11(1) of Law 3869/2010 shall be retained for 11 three years from the date the discharge takes effect. Consequently, the Greek legislature determined that after the three-year period has elapsed, the rights and interests of the data subject take precedence over the rights and interests of the recipients to have access to that specific information. 12

In this case, based on all the evidence in the case file, the oral proceedings, and the submitted submissions, the following emerged: The complainant filed with the respondent on January 29, 2023: (i) a request for the erasure of the entry registered in the SSX database by the company Veraltis under consumer loan code … and (ii) a request to correct the “incorrect financial data” related to the loans managed by INTRUM Hellas, (mortgage and home improvement/ consumer loan, respectively), which the respondent had received from Bank of Cyprus and which, according to his statement, have been finally settled by a court ruling pursuant to Law 3869/2010. It should be noted, however, that the complainant, when submitting the request to the respondent controller, did not provide all the necessary supporting documents to substantiate his request; that is, he did not submit either the relevant decision classifying him under the provisions of Law 3869/2010, nor a decision by the competent Magistrates’ Court certifying his discharge from the remainder of his debts, nor (in lieu thereof) corresponding certificates of compliance with the first settlement period issued by all creditors, whose claims are settled by the court decision, in which 11 See also the Explanatory Memorandum to Law 3816/2010, which states that “the processing financial information is an essential factor in assessing the solvency and creditworthiness of contracting parties. The retention in these records and the transfers to credit institutions of information that is outdated or does not justify, based on prevailing social and economic conditions, the severity of the assessment may have adverse consequences for citizens and enterprises, undermining, without sufficient justification, their creditworthiness and, by extension, their economic freedom.” See also paragraphs 97–98 of the CJEU decision of December 7, 2023, in the joined cases C-26/22 and C-64/22, https://curia.europa.eu/juris/document/document.jsf?text=&docid=280428&pageIndex=0&doclang= el&mode=req&dir=&occ=first&part=1. 28 certifies that the applicant-debtor has fulfilled his obligations in respect thereof, as set forth in the court decision, and that any installment is outstanding, thereby establishing his discharge from the remaining debts (as provided for in Article 11(1) of Law 3869/2010). As for the respondent’s assertion that the amounts relating to the second settlement period under Law 3869/2010 are incorrect, this is inadmissible raised before the Authority, since the competent courts to resolve this 13 dispute are the relevant civil courts. The respondent, following the request filed by the complainant, engaged in repeated communications with the competent authorities in order to verify the accuracy of the respondent’s records, and on June 8, 2023, it submitted a notice/comment to the financial unit of the relevant file regarding the inclusion of the relevant loans managed by Intrum Hellas in a court-supervised debt settlement under Law 3869/2010, stating verbatim: “The debt arises from the loans approved on January 31, 2013, with approved amounts of 108,967.20 and 18,532.80 euros, has been subject to a judicial settlement under Law 3869/2010,” and that the respondent was informed accordingly. Furthermore, regarding the accuracy of the recording of consumer loan No. … in the Loan Registry, as it turned out, the said loan was restructured pursuant to Law 3869/2010, as stated in Eurobank’s response to the respondent. In its response, the bank clarifies that the complainant has yet to pay the amount determined to be due to the bank pursuant to No. 21/2013 decision of the Single-Judge Court of First Instance of F, paying the total amount of 1,731.84 euros. For this purpose, a letter dated March 9, 2017, was also sent to the respondent, which merely confirms the 13th Authority had issued the dismissal order dated January 14, 2022, which was forwarded to the complainant via the Authority’s cover letter No. Γ/ΕΞΕ/188/20-01-2022, had closed the complaint bearing ref. no. Γ/ΕΙΣ/8116/December 13, 2021 against INTRUM, as falling outside the Authority’s jurisdiction, on the grounds that the Authority lacks the authority to assess the handling of requests for the correction of financial data, particularly when an an audit, noting that the—according to the respondent’s allegations—incorrect calculation of the aforementioned financial data concerning him constitutes an issue that gives rise to a private law dispute, which does not fall within the Authority’s jurisdiction. 29payment of the installments to the Bank in question pursuant to the aforementioned court decision. However, as Eurobank states in its response, because a prerequisite for the debtor’s discharge, pursuant to Article 11(1) of Law 3869/2010, as currently in force, the debtor’s discharge is compliance with the debt settlement arrangement with all creditors whose claims are covered by the court-ordered settlement; the claim was included in the loans sold to Hellas 2P Investment Designated Activity Company, initially managed by FPS and subsequently by B2K (and now Veraltis). Following the above, on November 14, 2023, the respondent proceeded with the temporary transfer of the relevant information from its database to a non- transmitted to the information recipients, until the competent authorities take appropriate steps to inform it. Finally, the respondent company, in its supplementary document bearing Authority Ref. No. C/EIS/7977/15- 10-2024, stated that based on a relevant message it received from Veraltis on October 2, 2024, it carried out the permanent erasure of the complainant’s consumer loan account No. … and informed both the complainant and the managing company accordingly. It follows from the above that the respondent, as the controller, who must comply with all principles governing the lawful processing of personal data—including, among others, the principle of accuracy, sought confirmation and clarification from the competent authorities regarding the information brought to its attention by the data subject data subject; however, the response from these authorities was not immediate, and there were delays in updating the data on file related to Law 3869/2010, with the result that the maintained record is not accurate and up-to-date. Consequently, in light of the foregoing, The Authority finds a violation of the principle of accuracy under article 5(1)(d) of the GDPR on the part of the respondent controller. The Authority reserves the right to examine any broader issues with the data providers in the relevant Tiresias database, if deemed appropriate.

Based on the foregoing, the Authority finds that there are grounds to exercise its corrective powers under Article 58(2) of the GDPR. Specifically, the Authority 30considers that, based on the violation found, it must, pursuant to pursuant to Article 58(2)(b) of the GDPR, issue a reprimand to the respondent for the established violation of Article 5(1)(d) of the GDPR and issue an order to the respondent pursuant to Article 58(2)(d) to ensure the development of an improved procedure so as to ensure compliance with the principle of accuracy, through the correct and timely response of the relevant entities to the data held in its records, including information pertaining to them.3869/2010, given that only if the information provided to the data recipients is up-to-date and accurate the purpose of maintaining the record in question is fulfilled. The Authority finds that, based on the circumstances established, the sanctions referred to in the operative part must be imposed on the respondent, which which constitute an effective, proportionate, and deterrent measure both for restoring compliance and for punishing the unlawful conduct. FOR THESE REASONS The Authority a) Issues to the respondent, the public limited company “TEIRESIAS S.A.,” in its capacity as the controller, a reprimand pursuant to Article 58(2)(b) of the GDPR for the established violation of Article 5(1)(d) of the GDPR, b) Orders, pursuant to Article 58(2)(d), the respondent corporation company “TEIRESIAS S.A.,” as the controller, to ensure the development of a procedure that will strengthen compliance with the principle of accuracy, in a manner that ensures the correct and timely response of the relevant entities to the data held in its records, including information pertaining to Law No. 3869/2010, by providing the Authority with relevant documentation within six months of the notification of this decision. 31 Acting Chairperson The Secretary Deputy Chairperson Georgios Batzalexis Irini Papageorgopoulou 32