Greek DPA Fines Energy Provider and Bank €110,000 for GDPR Access Request Failures
ZENITH SA and Piraeus Bank both failed to adequately respond to a customer's data subject access requests, violating GDPR's foundational rights of access and data accuracy. ZENITH SA compounded its liability by failing to exercise proper oversight and control over its data processor, a critical controller responsibility under GDPR Article 28. These failures demonstrate that data subject rights are not merely administrative formalities — regulators treat them as enforceable obligations with significant financial consequences. The case highlights that controller-processor relationships require active governance, not passive contractual agreements. Organizations that ignore or inadequately handle access requests risk cascading violations spanning multiple GDPR principles.
Tactical Insight
Immediate actions
- Establish a formal Data Subject Rights (DSR) intake and response procedure with clearly assigned ownership and documented SLAs aligned to GDPR's 30-day deadline.
- Audit all active data processor agreements to confirm Article 28-compliant contracts are in place and that processors are being actively monitored.
Long-term improvements
- Implement a dedicated Data Subject Request management platform or ticketing workflow to log, track, and evidence every request and its resolution.
- Conduct annual reviews of data accuracy practices, including mechanisms for customers to update or correct personal data held across all systems.
- Build processor oversight into vendor management cycles, including periodic audits, compliance attestations, and escalation procedures for processor non-compliance.
Detection & governance measures
- Set automated alerts for DSR tickets approaching the statutory response deadline to prevent inadvertent breaches.
- Assign a Data Protection Officer (DPO) or equivalent role with authority to escalate unresolved access requests and accuracy disputes before regulatory involvement.