Fine on a telecommunications provider by the DPAA

Decision 7:

The Authority examined a complaint from a Vodafone subscriber who, following a request for access to her recorded conversations with Vodafone's call centre, received through a processing company a CD containing conversations of another subscriber. However, although Vodafone was immediately notified by the complainant, it did not take any action to investigate in order to confirm or deny the incident, but was initially satisfied with the response of the processor that it had not traced the complainant to the telephone, and then invited her in writing through the Consumer Advocate to return the CD, thus shifting the responsibility for investigating the possible incident to the subject.

Vodafone was ordered to satisfy the right by sending the correct file and fined EUR 40,000 for breach of the complainant's right of access under Article 15 of the GDPR and the obligation to disclose the incident under Article 33 of the GDPR.

Decision 5:

The Authority investigated a complaint by a subscriber who, following his request for a new Vodafone connection, received a parcel containing samples of consumer products from an advertising company cooperating with Vodafone, despite his objection to the use of his data for marketing purposes. According to Vodafone, the sending of the parcel did not constitute a promotional activity, but was an ancillary provision of the telecommunications service contract already concluded between the parties, which is sent to all new subscribers without exception who register via the website www.vodafonecu.gr, irrespective of their choices concerning promotional activities, and information is provided by means of a banner posted on that website.

The Authority considered that the transfer to an advertising company and the related processing of the complainant's data was carried out for the purpose of promotion, in breach of the principle of lawfulness, objectivity and transparency of processing, because it was not necessary for the purpose of the contract nor was it reasonably expected by the data subject, who had expressly objected to the use and transfer of his data for promotional purposes, while it was not proven that the complainant had been fully informed in accordance with Article 13 GDPR about the processing in question. Vodafone was fined €10,000 and ordered to adapt its practice in relation to these additional benefits appropriately to provide data subjects with full information and the possibility to object.