ONE WAY PRIVATE COMPANY: Non-compliance with general data processing principles

The Greek DPA has imposed a fine of EUR 80,000 on ONE WAY PRIVATE COMPANY. The fined entity is the processor of Thessaloniki–Thessaly Gas Supply Company S.A. (ETid-3016). The processor, a call center involved in direct marketing activities, had implemented a system to check whether consent had been given to contact a specific person. However, this system could be bypassed or ignored by the operator, resulting in data subjects being contacted without their consent. Furthermore, the controller had been promoting third-party products without being instructed to do so, resulting in personal data being processed without a sufficient legal basis.

GDPR Articles: Art. 5 GDPR, Art. 6 GDPR, Art. 7 GDPR, Art. 29 GDPR, Art. 32 GDPR
Industry: Media, Telecoms and Broadcasting