- Enforcing jurisdiction
- Greece · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
METRO SA – €50,000 Fine (Greece, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
METRO SA was fined €50,000 by the Hellenic Data Protection Authority for mishandling a customer's request for access and deletion of personal data. This case highlights the importance of responding properly to customer data requests.
What happened
The Hellenic DPA imposed a €50,000 fine on METRO SA for failing to respond to a customer's data access and deletion request.
Who was affected
A customer who had their personal data mishandled by METRO SA was affected.
What the authority found
The authority found that METRO SA did not comply with the customer's request and failed to implement adequate data protection measures.
Why this matters
This ruling underscores the necessity for companies to have effective processes in place for handling customer data requests. It serves as a reminder that neglecting these responsibilities can lead to significant fines.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 12 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Hellenic DPA has imposed a fine of EUR 50,000 on METRO SA. A former employee had sent text messages to the private mobile phone of a customer who had a user account in the company's online store and had placed orders that had been delivered to them by the employee a few days earlier. The customer then reported the incident to the controller and requested access to and deletion of their personal data. However, the controller did not respond to the incident, arguing that the order was in their husband's name. However, the DPA found that the controller should have complied with the request and that the controller had failed to install appropriate technical and organizational measures to protect personal data in order to avoid such an incident.
Related Enforcement Actions (0)
No other enforcement actions found for METRO SA in GR
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
27 June 2024
Authority
Hellenic Data Protection Authority
Fine Amount
€50,000
Enforcement Tracker ID
ETid-2400
About this data
Cite as: Cookie Fines. METRO SA - Greece (2024). Retrieved from cookiefines.eu
Last updated: