- Enforcing jurisdiction
- Greece · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Party A (anonymized) – Complaint Upheld (Greece, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Hellenic Data Protection Authority upheld a complaint against a member of Parliament for sending an email without consent. This is important because it emphasizes the need for consent when communicating with individuals.
What happened
A member of Parliament sent a press release via email to a person without their consent.
Who was affected
The person who received the email without consent.
What the authority found
The authority warned the member of Parliament to use the BCC field in mass emails to protect recipients' privacy.
Why this matters
This case serves as a reminder for organizations to respect privacy by obtaining consent before sending emails, especially in bulk.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Linked-source text retrieved.
Automated check recorded — 20 March 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The data subject complained to the Greek DPA (the HDPA) about having received a press release via email by a member of the Hellenic Parliament (the latter being considered the data controller in the context of this decision), without the data subject's consent. Furthermore, the data subject's email address was visible to other recipients (the "To" field was used instead of BCC). The HDPA issued a warning towards the data controller, recommending the use of the BCC field in order for mass email communication to remain compliant with Article 32 GDPR. No other measures were deemed necessary, because of the data controller's stance that the inclusion of the subject's email was made by mistake (more particularly, the controller had wrongly thought the data subject was a journalist, and that the data processing would thus be in accordance to Article 6(1)(f) GDPR), and because the controller took corrective measures by removing the data subject's personal details from the mailing list.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for Party A (anonymized) in GR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Party A (anonymized) - Greece (2021). Retrieved from cookiefines.eu
Last updated: