ZENITH SA (ΖΕΝΙΘ ΑΕ) – €110,000 Fine (Greece, 2026)

On 27 May 2020, a data subject entered into an electricity supply contract by telephone with the Greek energy provider ZENITH (controller A) for three service connections. The contract was concluded through controller A’s processor, Sigma and Kappa Import S.A. During the call, the data subject provided his bank account number (IBAN), at least for the purpose of paying one of the services by direct debit. On 4 June 2020, during a subsequent phone call with the processor, the data subject stated that he did not want the other two services to be paid by direct debit. When the relevant contract documents were later sent to him for signature, he signed only one of the three direct debit mandate forms. However, the data subject subsequently noticed that all three electricity bills were being paid by direct debit. On 13 August 2020, he contacted controller A to complain about the matter. Controller A replied on 2 September 2020 that two additional direct debit mandates had been activated inadvertently because its processor had failed to take the necessary steps. The data subject then repeatedly requested copies of the signed direct debit mandates, but claimed that controller A did not properly respond to those requests. The data subject also contacted his bank, Piraeus Bank (controller B), since the disputed payments were being made from his bank account. He argued that he had never authorised the two additional direct debit payments and made an access request on 16 February 2023, requesting copies of the direct debit mandates and information concerning their activation. Controller B replied that it acted only as an intermediary in the execution of payments and had a merely administrative role in the process. It did not provide copies of the mandates or access to the relevant electronic records held in its systems. On 22 October 2023, the data subject lodged two separate complaints with the Greek DPA (HDPA) against controller A and controller B, arguing that both controlle