# METRO SA: Insufficient technical and organisational measures to ensure information security

- Type: Enforcement
- Source: Hellenic Data Protection Authority (HDPA)
- Date: 2024-06-27
- Original: https://www.enforcementtracker.com/ETid-2400
- Canonical: https://overview.legal/posts/48515
- Topics: Security, Controllers, Personal Data, Processing Agreement, Privacy by Design & Default, Law Enforcement, Supervisory Authorities, Data Controller

## Summary

The Hellenic DPA has imposed a fine of EUR 50,000 on METRO SA. A former employee had sent text messages to the private mobile phone of a customer who had a user account in the company's online store and had placed orders that had been delivered to them by the employee a few days earlier. The customer then reported the incident to the controller and requested access to and deletion of their personal data. However, the controller did not respond to the incident, arguing that the order was in their

## Full text

The Hellenic DPA has imposed a fine of EUR 50,000 on METRO SA. A former employee had sent text messages to the private mobile phone of a customer who had a user account in the company's online store and had placed orders that had been delivered to them by the employee a few days earlier. The customer then reported the incident to the controller and requested access to and deletion of their personal data. However, the controller did not respond to the incident, arguing that the order was in their husband's name. However, the DPA found that the controller should have complied with the request and that the controller had failed to install appropriate technical and organizational measures to protect personal data in order to avoid such an incident.

GDPR Articles: Art. 15 GDPR, Art. 17 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 33 GDPR
Industry: Industry and Commerce

---
Generated by overview.legal · https://overview.legal/posts/48515 · 2026-08-22