Hellenic Telecommunications Organization S.A. Rotten Score Breakdown

After investigating the leakage of subscriber call data between 1 and 5 September 2020, the Hellenic Data Protection Authority found that OTE had infringed GDPR Article 32 because of inadequate security measures in infrastructure used in the breach. The authority fined OTE €3.25 million. The same decision separately fined COSMOTE €6 million; that subsidiary fine is not attributed to OTE in this record. Primary source: https://www.dpa.gr/en/enimerwtiko/news/fines-imposed-due-personal-data-breach-and-illegal-data-processing

The Hellenic Data Protection Authority found that, from 2013 onward, a technical error prevented OTE marketing recipients who used an unsubscribe link from being removed and that OTE lacked an organisational procedure capable of detecting the failure. OTE subsequently removed about 8,000 people who had unsuccessfully attempted to opt out. The authority found infringements of the GDPR right to object to direct marketing and data protection by design and imposed a €200,000 fine in Decision 34/2019. Primary source: https://www.dpa.gr/en/enimerwtiko/press-releases/administrative-fines-imposed-telephone-service-provider

The Hellenic Data Protection Authority found that OTE deleted subscribers from its do-not-call register when they requested number portability but lacked a proper process to restore their entries when portability was cancelled. Because OTE's internal customer-service system and the register sent to advertisers diverged, affected subscribers received unsolicited marketing calls. The authority found GDPR accuracy and data-protection-by-design infringements affecting a large number of subscribers and imposed a €200,000 fine in Decision 31/2019. The authority's English notice does not state when the faulty processing began, so the decision date is used as the required event anchor rather than inventing an earlier date. Primary source: https://www.dpa.gr/en/enimerwtiko/press-releases/administrative-fines-imposed-telephone-service-provider