Greece

METRO SA

50,000 €

GDPR enforcement action by Hellenic Data Protection Authority (HDPA) on 2024-06-27.

Rank · Sector

#110

of 597 in Industry and Commerce

Rank · Greece

#19

of 93

Rank · All fines

#740

of 3,050

Case details

Authority: Hellenic Data Protection Authority (HDPA)
Date: 2024-06-27
Controller / Processor: METRO SA
Sector: Industry and Commerce
Quoted Articles: Art. 15 GDPR, Art. 17 GDPR, Art. 24 GDPR, Art. 32 GDPR, Art. 33 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Hellenic DPA has imposed a fine of EUR 50,000 on METRO SA. A former employee had sent text messages to the private mobile phone of a customer who had a user account in the company's online store and had placed orders that had been delivered to them by the employee a few days earlier.

The customer then reported the incident to the controller and requested access to and deletion of their personal data. However, the controller did not respond to the incident, arguing that the order was in their husband's name. However, the DPA found that the controller should have complied with the request and that the controller had failed to install appropriate technical and organizational measures to protect personal data in order to avoid such an incident.

Open original source Links to the regulator's original publication or another source.