Infinity Pack – Complaint Upheld (Greece, 2022)

The data subject, a pharmacist, received several emails advertising pharmaceutical products from the company Infinity Pack, the controller. The data subject filed a complaint with the Hellenic DPA, claiming that they had agreed to receive promotional content at some personal email addresses. However, they stated that they never had any commercial relationship with the controller through that other specific email, which was used exclusively for communications with public bodies. The DPA notified the controller asking for clarifications on how it became aware of that specific email address. The controller responded that it could not determine the source of the information, but admitted that its representatives travel to many regions in Greece and collect 'market information' such as business cards and contact details of potential clients. Although the data subject withdrew the claim during the course of the procedure, the Hellenic DPA decided to continue with ex officio investigations. The DPA highlighted that Article 5(1) GDPR establishes that personal data must be processed lawfully, fairly and in a transparent manner, while also being collected for specified, explicit and legitimate purposes. Moreover, Article 5(2) provides that the controller is responsible for demonstrating compliance with these obligations. The DPA then reffered to the Greek national law. It clarified that, although the law authorizes controllers to send advertising messages to emails legally obtained in the context of their commercial transactions, even without prior consent, it requires that an easy way to object the data processing be made available. In the case under analysis, the DPA held that the controller was not able to demonstrate the source of the data and, therefore, cannot claim that they were obtained in the context of its commercial activities. Similarly, the controller did not demonstrate that it had obtained the consent of the data subject. For these reasons, DPA found a viol