METRO SA – €50,000 Fine (Greece, 2024)

The Hellenic DPA has imposed a fine of EUR 50,000 on METRO SA. A former employee had sent text messages to the private mobile phone of a customer who had a user account in the company's online store and had placed orders that had been delivered to them by the employee a few days earlier. The customer then reported the incident to the controller and requested access to and deletion of their personal data. However, the controller did not respond to the incident, arguing that the order was in their husband's name. However, the DPA found that the controller should have complied with the request and that the controller had failed to install appropriate technical and organizational measures to protect personal data in order to avoid such an incident.