meta_id 3306505

On June 5, 2026, the Hellenic Data Protection Authority (HDPA) issued Decision 8/2026, imposing financial penalties on an electricity provider and a bank for breaches of the General Data Protection Regulation (GDPR). The HDPA examined two complaints filed by the same individual against ZENITH (the electricity provider) and Piraeus Bank regarding violations of the right of access to personal data. The complaints concerned standing orders for direct debit payments on three electricity accounts that the complainant disputed. The investigation revealed that ZENITH, through its data processor, incorrectly recorded personal data regarding the complainant's declaration and actual intention. Critical supporting documentation—including recorded telephone calls and the standing order form—was not retained in accordance with ZENITH's data retention policy. Consequently, direct debits were processed not only for the account the complainant had authorised, but also for two additional accounts. ZENITH failed to respond to the access request with sufficient clarity and completeness. The authority independently determined that ZENITH violated the accuracy principle by failing to correct the inaccurate data and breached its obligation to select appropriate data processors. ZENITH received a combined fine of €100,000 for violations of Article 5(1)(d) (accuracy principle), Article 15 (right of access) in conjunction with Articles 12(1) and 12(3), and Article 28 (processor requirements) of the GDPR. Piraeus Bank received a fine of €10,000 for violating the right of access. Additionally, the bank received a formal reprimand for its failure to ensure data accuracy. The HDPA's decision underscores the importance of maintaining accurate personal data, implementing robust data retention policies, and responding promptly and comprehensively to data subject access requests.