«ΚΑΡΙΕΡΑ Α.Ε.» – €5,000 Fine (Greece, 2021)

The complainant requested to stop receiving promotional emails by the company. The promotional emails didn't stop even after he followed all the directions on the company's website and even after he submitted a request of erasure of his personal data held by the company, for which he received a confirmation email stating that all his data we deleted by the company's servers. The company stated that due to technical errors and duplicate registration of the data subject's email address, the process of the deletion of the complainant's data was not successful. The personal data processed by the company were recorded electronically in a database referred to as the ‘Master Database'. All changes to personal data, such as deletions from email lists or requests submitted by data subjects are initially entered in the Master Database, and are then integrated/ copied into the individual databases that connect to the Main Database through a synchronization process which takes place automatically on a daily basis. One of these such databases linked to the Main Database is also the Email Database. Due to a technical error in the computer systems, there was a double registration of the email address of the complainant in the Email Database. This double entry error was detected and corrected immediately so as not to be repeated in the future. However, the duplicate address file remained in the E-mail Database, with the result while the first address file was deleted, the address file remained in the E-mail Database. Thus, when the complainants requested deletion from the E-mail Database using the delete / unsubscribe link, the request was recorded successfully in the Master Data Sheet, but the synchronization process failed to replace / delete the duplicate entry of the email address of the complainant in the E-mail Database. This is the reason why the complainant continued to receive emails about jobs offered by the company. After examination of the facts of the case and after examination of 79 other data subjects data which were not successfully deleted from the company's data base, the authority decided that the company failed to implement the appropriate procedural and security measures to detect the error and to secure the deletion of the users' data. In the light of these violations the authority fined the company 5.000€.