Skip to content
Enforcement · Hellenic Data Protection Authority (HDPA) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

OTE Group: Insufficient technical and organisational measures to ensure information security

€3,200,000 Fine
OTE Group
GREECE
Art. 32 GDPR

How it connects

Full text

The Hellenic DPA has imposed a fine of EUR 3.2 million on Cosmote subsidiary OTE Group. Among other things, OTE Group had contributed to Cosmote's security infrastructure. Cosmote had reported a data breach to the DPA under Article 33 of the GDPR. A hacker had been able to penetrate Cosmote's systems due to a lack of security measures and obtained and subsequently leaked data from customers. The stolen data included sensitive information, from Cosmote subscribers such as age, gender and contract information. Nearly 10 million people were affected by the incident. For this reason, the DPA found that OTE Group had failed to implement adequate technical and organizational measures to ensure a level of security commensurate with the risk to data subjects.

Industry: Media, Telecoms and Broadcasting

Similar Content