Vodafone – ΠΑΝΑΦΟΝ Ανώνυμη Ελληνική Εταιρεία Τηλεπικοινωνιών – €30,000 Fine (Greece, 2026)

A data subject filed a complaint against Vodafone – Panafon S.A., a telecommunications provider (the controller), with the Greek Data Protection Authority (HDPA). She had submitted three access requests seeking all recorded phone calls concerning a technical fault she had reported. The first two requests were rejected by the controller as vague, and the third request was only partially satisfied; some recordings were provided, but not all requested calls, and the controller did not inform her within one month about deficiencies in her request or the reasons for not fully complying. The data subject also alleged that the controller obstructed the exercise of the right of access to the recorded conversations in question, resulting in some of them being deleted because the prescribed retention period had expired, a risk which, as alleged, had been pointed out to the controller. In particular, she requested restriction of processing to prevent deletion of recordings after the one-year retention period, but the controller did not properly address this request. Furthermore, the controller provided misleading information through a representative regarding the manner of exercising or satisfying customers' right of access to recorded conversations concerning them. The HPDA upheld the complaint and imposed an administrative fine of €30,000. It also ordered the controller to adopt appropriate technical and organizational measures and improve staff training, with proof of compliance within six months. Specifically, it held that the controller violated Article 12(1), (2), (3), and (4) GDPR, because it failed to inform the data subject within one month of the deficiencies in the application, effectively prevented the exercise of the right and provided contradictory information, amounts to lack of transparency. Moreover, it argued that the controller breached Article 15 GDPR by failing to provide full access to all requested recorded conversations and Article 18 GDPR by not honoring the request to restrict processing, which would have prevented the calls from being deleted before the request was reviewed.