On August 13, 2024, the none of your business (NOYB) announced that it had filed a complaint against a Greek supermarket, Alfa Vita, with the Hellenic Data Protection Authority (HDPA). The complaint alleges non-compliance with the General Data Protection Regulation's (GDPR) right to access data when exercised by a data subject.

Background to the complaint

NOYB noted that Alfa Vita had introduced a loyalty card program that collects personal information about its customers, such as their buying habits, the frequency of their visits to the store, the use of offers communicated to them, their home address, the total cost of their purchases, etc. for profiling. A customer requested access to their data collected by Alfa Vita but was only provided with a list of their transactions and contact details, but no other information derived from it nor a list of recipients of such data. NOYB stated that Alfa Vita's lack of compliance with the access request by not providing all the information it held on the customer was illegal under the GDPR.

NOYB also mentioned that Alfa Vita advertises access to data as an exclusive feature for customers who upgrade their status on the loyalty program and even still have to grant consent to the sharing of their data with other third parties before getting access to their data. NOYB stated that this practice does not comply with the GDPR, as companies should facilitate access to personal data and not hold it hostage.

Furthermore, NOYB also recalled that in times of economic downturn and rising food prices, customers might feel no choice but to join the loyalty program that promises discounted prices, thereby allowing companies like Alfa Vita to track, profile, and manipulate them with their data. NOYB alleged that this creates a de facto requirement to join the loyalty card and grants Alfa Vita greater access to their data.

Subsequently, NOYB announced that it has filed a complaint with the HDPA, requesting an investigation of Alfa Vita's processing operations and an order to comply with the complainant's access request. In addition, NOYB suggests that the HDPA impose a fine of up to 4% of Alfa Vita's annual turnover to prevent similar violations in the future.

You can read the press release here.