Hellenic SA fines Debt Management Company for unlawful processing of personal data and non-essential examination of rights to object and erasure

Background information

• Date of final decision: 19 July 2022
• Cross-border case or national case: National case
• Controller: doValue Greece (Loans and credits claims Management Company)    
• Legal Reference: Principle of lawfulness, fairness and transparency of processing of personal data (Article 5.1a). Principle of accountability (Article 5.2).Lawfulness of processing (Article 6). Transparency (Article 12). Right to erasure (Article 17). Right to object (Article 21)
• Decision: Infringement of the GDPR, Administrative fine
• Key words: Unlawful processing, non-essential examination of rights to object and erasure

Summary of the Decision

Origin of the case

A complaint was filed to the Hellenic Supervisory Authority (SA) against a loans and credits claims management company:

1. for unlawful processing of personal data involving continuous telephone calls to a debtor, who had a judicial exemption from the balance of her debt, which was known by the company complained;
2. for, essentially, a non-examination of the rights exercised by the complainant, as a data subject, claiming that it was not possible to identify her.

Key Findings

The Hellenic SA found that in this particular case the company complained of unduly impeded the exercise of the complainant’s rights, in breach of the provision of Article 12(2) of the GDPR, and that the processing in question took place without a legal basis, given that there was already a judicial exemption from the complainant’s debts, in breach of the provisions of Articles 5(1)(a), 5(2) and (6) of the GDPR.

Decision

The Hellenic SA imposed a fine of EUR 10,000 for breach of Article 12(2) of the GDPR and EUR 10,000 for infringements of Articles 5(1)(a), 5(2) and 6 of the GDPR.

For further information: Decision 25/2022 (in Greek)