Υπουργείου Υποδομών και Μεταφορών – No Violation (Greece, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Hellenic Data Protection Authority found no violation after investigating complaints about unsolicited SMS messages sent by the Ministry of Infrastructure. The authority determined that the ministry did not properly inform subscribers before sending the messages. This case underscores the need for clear communication when using personal data for public messages.
What happened
The Ministry of Infrastructure sent SMS messages to mobile phone subscribers without prior consent or information.
Who was affected
Mobile phone subscribers who received unsolicited messages from the Ministry of Infrastructure.
What the authority found
The authority concluded that the Ministry did not violate data protection rules, but the complaints raised valid concerns about consent and information.
Why this matters
This case emphasizes the importance of transparency and consent when public agencies use personal data for communication.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 22 September 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA started an investigation, after receiving 83 complaints from data subjects, against the Ministry of Infrastructure and Transportation (the controller). Particularly, regarding the sending of an SMSs, prior to the national holiday on October 28th, to mobile phone subscribers (the data subjects) without prior information or consent. The complaints included: * The violation by the controller of Article 14 GDPR as the data subjects were not priorly informed that their phone numbers would be processed for this purpose, leaving them without information and the subsequent right to object. * The processing of all mobile phone subscriber’s data regardless of whether they are drivers. Contrary to the principle of purpose limitation and data minimisation. * The wrong application by the controller of legal basis, that is, processing for the public interest. Claiming that the controller lacks the jurisdiction for the purpose of raising awareness to also process personal data. * The fact that the controller should have initiated the procedure through the Ministry of Digital Governance, which applies to the citizens which have consented to the sending of messages by public agencies. * The data subjects claimed that the controller actually was the Ministry of Data Governance, and the mobile phone companies which ultimately sent out the message acted as processors. In that regard, such a relationship should have been governed by contract, however the controller (in the present case) was unable to present such to the DPA. The controller clarified that the purpose of this campaign was as a preventative/awareness-raising tool within its broader safety strategy, and based in accident statistics. The transmission of the SMSs was carried out by mobile phone operators, in cooperation with the controller, without disclosing the data to the controller. Such communication was authorised by national law which allowed for processing beyond the purpose for which the data was collect
Outcome
No Violation
The DPA investigated and found no violation.
Related Enforcement Actions (0)
No other enforcement actions found for Υπουργείου Υποδομών και Μεταφορών in GR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Υπουργείου Υποδομών και Μεταφορών - Greece (2026). Retrieved from cookiefines.eu
Last updated: