Public Power Corporation S.A. (DEI)

Summary

The Greek DPA has imposed a fine of EUR 320,000 on Public Power Corporation S.A. (DEI). The controller is a Greek electricity supplier. The controller hired four call centres for marketing purposes; these centres acted as processors for the controller. The authority found that, in all four cases, the controller had failed to implement measures to ensure the security of processing personal data. Consequently, customers received unsolicited calls from the processors. The authority found that DEI had failed to implement an automated, unified opt-out register and had relied on manual supervision without an auditable trail. Furthermore, the processor contracts were inadequate in that they did not document periodic audits or approve sub-processors, and encryption was only implemented when required. The authority also fined all the processors.