Individuals – €150,000 Fine (Greece, 2022)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
In Greece, individuals were fined for unauthorized access to mobile subscriber data. This case matters because it highlights the risks of poor security measures and the need for companies to protect user information from malicious attacks.
What happened
Individuals were found responsible for incidents of unauthorized access to mobile subscriber data through SIM swap fraud.
Who was affected
Mobile subscribers whose data was accessed without permission were affected by these incidents.
What the authority found
The authority imposed a fine due to violations of data protection laws related to unauthorized access and inadequate security measures.
Why this matters
This case underscores the importance of strong security practices for protecting personal data. Companies should implement robust measures to prevent unauthorized access to user information.
Entities Involved
Source checks
Linked-source text retrieved.
Review needed — 8 October 2026.
Processing notes: articles corrected, national law identified, entity split needed.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A number of complaints and notifications of incidents were submitted to the Authority of personal data breaches related to incidents of non-compliance with the unauthorised replacement of a subscriber's sim card (sim swap) and other procedures (e.g. call diversion, issuance of new telephone numbers) by third parties not holding the connections in question. The Authority, following complaints and related notifications, has become aware of incidents of unauthorised access by malicious third parties to mobile subscriber data. The access took place following requests to change the SIM card of subscribers and was due to problems with the identification process of subscribers when submitting such requests, either as a result of inadequate security measures or after defective implementation of existing measures. The Authority assessed the number of incidents, as well as the actions taken by the controller to address them, and imposed a fine of EUR 150,000 for the above violations of the provisions of Article 12 of Law No. 3471/2006.
Related Enforcement Actions (1)
Other enforcement actions involving Individuals in GR
Details
Fine Date
21 July 2022
Authority
Hellenic Data Protection Authority
Fine Amount
€150,000
GDPRhub ID
gdprhub-5518About this data
Cite as: Cookie Fines. Individuals - Greece (2022). Retrieved from cookiefines.eu
Last updated: