ZeniΘ (Thessaloniki-Thessalia Gas Supply Company S.A.)

Summary

The Greek DPA has imposed a fine of EUR 100,000 on ZeniΘ (Thessaloniki-Thessalia Gas Supply Company S.A.). In a complaint logged in 2023, a data subject stated that they had concluded a contract with a sales partner of the controller acting as processor in May 2020. The contract covered three supply mandates. The data subject opted to pay for one of these via direct debit, providing their IBAN for this purpose and signing only one of the mandates. However, the supplier (Zenith) then debited payment for all three supply mandates via direct debit from a joint account at Piraeus Bank. In August 2020, the data subject complained to the controller, who apologised and told them to cancel the direct debit mandates themselves. In October 2022, the data subject requested the signed direct debit mandates and call recordings. The controller replied to this request in March 2023. It subsequently emerged that neither the signed mandate nor the recordings had been stored. The call recordings should have been provided to the controller by the processor but had been deleted, contrary to the controller's own policy, which contained a retention span of 5 years. Piraeus Bank was fined by the Greek DPA aswell (ETid ).