Edited by Elvira Krithari
“He’s right-wing, he has a good relationship with the Region of Central Macedonia, he seems to be in control of the situation.”
“He’s an extremist and a populist, he openly denounces Hellenic Petroleum.”
“He’s affiliated with PASOK, is relatively conservative.”
“A minor player, observes the logic of KKE (the capital is to blame for everything, and so is Hellenic Petroleum, which, however, gives people jobs, so that’s why we maintain a balance).”
These references to the political views of members of the Municipal Council of the Municipality of Kordelio-Evosmos are included in a study by the marketing and consulting agency ONE-TEAM, entitled “The stink in Western Thessaloniki – Record of current situation – May 2017” on behalf of the Hellenic Petroleum Group.
This is a study that was discovered in September 2017 and proved to be an unprecedented case in Greece, where those who spoke against environmental pollution and pointed to Hellenic Petroleum as the culprit, were recorded and put on file. The pollution and stench from the refinery has plagued the residents of western Thessaloniki for years. However, despite the seriousness of the issue, due to the extensive collection and processing of sensitive personal data used to compile the study, the vast majority of the media made no mention of it.
The case remained almost obscure even when the Personal Data Protection Authority imposed a fine of €30,000 on Hellenic Petroleum for violating relevant legislation. The news was reported in the media but was limited to the press release issued by the Personal Data Protection Authority, but without the slightest reference to the content of the report or what had transpired before the fine was imposed. And, above all, the media did not publish the reasoning behind the Personal Data Protection Authority’s decision, which was issued last April and hence, a fine was imposed on Hellenic Petroleum, but there was no disciplinary action towards the company ONE-TEAM.
The Personal Data Protection Authority’s ruling
Although it was not published by the media in Greece, the reasoning behind the Personal Data Protection Authority’s decision in this case is particularly interesting, as it reveals how the two companies first exposed the situation, (the contradictions that the Authority found in the companies’ allegations and their explanations), in order to prove that they operated within the law. In other words, what transpired from when the Authority began investigating the case, until the conclusion that “no legal basis has been established for the processing of citizens’ data, and no security measures were taken for the unlawful leak on the Internet.”
According to what the Authority describes in its reasoning, initially ONE TEAM accepted the fact that they were hired to undertake various projects for Hellenic Petroleum, which, however, did not include the sensitive personal data of citizens. For their part, Hellenic Petroleum accepted that there was a private agreement with the company to implement a public opinion strategy. The Authority requested clarification from ONE TEAM again, as its response that it never processed personal data on behalf of Hellenic Petroleum did not seem to be correct.
According to ONE TEAM, the project included “the gradual collection of data, information and opinions that had been expressed and exposed in public and online (websites, social media, blogs, etc).” The outline of the study was emailed to specific recipients at Hellenic Petroleum in May 2017, with a link to the electronic document of the study. The company also claimed that the collection of data and information was absolutely necessary, but also lawful, as sources were public websites and social media, free access, where the people involved expressed their views themselves.
On February 27, 2018, the Authority summoned the two parties involved. ONE TEAM added additional, supplementary information, and admittedly (as the Authority points out) stated that “on the references to names, in some parts of the study, there is an indicative mention of individual reactions, with the aim to record the reason behind the protests and to substantiate the scientific nature of the study. In the context of these reports and in order to substantiate the scientific findings, a specific reference is made to the name, as well as indicatively, the occasional mention of the person’s profession. There are also references to ideologies or political parties, regarding people who were appointed council members.”
For their part, Hellenic Petroleum insisted that it had never instructed ONE TEAM to process personal data and, regarding the creation of the file, they argued that it “is outside the scope of the agreement.”
The findings of the Authority
In its reasoning, the Personal Data Protection Authority, among other things, notes that the collection of information regarding natural persons and their political views, participation in trade unions and associations constitutes processing of personal data (ie sensitive). And that, in order for such processing to be lawful, permission should have been previously requested and obtained from the Authority. Furthermore, authors of the report must take appropriate measures for data security.
According to the Authority:
- ONE TEAM has processed personal data, including sensitive personal data
- ONE TEAM executed the processing, while Hellenic Petroleum was responsible for the processing
- The allegation of Hellenic Petroleum that ONE TEAM did not act on their behalf, but acted voluntarily and independently of any corresponding intention by Hellenic Petroleum, is unfounded. The available data does not indicate the acceptance and refusal of approval by Hellenic Petroleum of the study, nor its implied rejection
- ONE TEAM proceeded to collect personal data, both “standard” and sensitive. As for the collection of sensitive personal data, Hellenic Petroleum, as the body in charge of processing, should have obtained permission from the Authority, which they neither requested nor, consequently, received
- ONE TEAM’s assertion that the disputed personal data collected from publicly available sources, such as’ websites, social media, blogs, etc’, in no case may it make the processing lawful, as the purpose of the original posting-publication of such information and data is other than the purpose for which it was ultimately collected by ONE TEAM. Therefore, the processing carried out by ONE TEAM on behalf of Hellenic Petroleum constitutes illegal processing
- There is no establishment of vested interest of Hellenic Petroleum for the disputed personal data. Hellenic Petroleum had claimed that “the study undertaken to examine public opinion, and how it is effected by the operation of the refinery, in order for Hellenic Petroleum to determine and receive the necessary scientific and environmental measures (…) is a matter of vested interest.”
With this in mind, the Personal Data Protection Authority has decided to impose a fine of €20,000 on the Hellenic Petroleum Group (as the body responsible for processing the information) for illegal processing, as well as a fine of € 10,000, for failing to obtain proper security authorization which led to a personal data breach.
The Authority’s response to Solomon MAG regarding “punishment”
With this decision, the competent Authority:
- Acquits the company ONE TEAM, despite that ONE TEAM accepts that it has processed personal data, as well as sensitive data, and that it was the executor of the above-mentioned processing
- Places the responsibility for the illegal processing on Hellenic Petroleum, considering that they initiated the processing
However, this decision seems to set aside the extent of the security breach and, in a way, underestimate it, even in regards to the amount of the fine (€ 20,000) for the illegal processing, despite the Group’s sound financial strength.
Given these concerns, we approached the Authority with questions (a) regarding the non-penalties for ONE TEAM, even though they conducted the research and collection of data in regards to “mapping citizens”, and also wrote the study, and (b) in regard to the amount of the fine imposed by the Authority and whether this is consistent with the extent of the illegal collection of sensitive personal data.
In its response to Solomon MAG (dated July 12, 2019) the Authority stated:
“With regard to your first question, the case was examined on the basis of the laws concerning General Regulation on Data Protection) ie law 2472/1997, according to which, penalties could be imposed on “those responsible for processing” (which, as it turned out, during the examination of the case, was Hellenic Petroleum) and not in the “executor of the processing” (in this case ONE TEAM). In addition, according to said law, sanctions are imposed on both the responsible body and the executor.
Regarding the second question, the Authority concluded that the amount of the fine was based on specific criteria, “one of which was the fact that it had not received any complaints about the specific processing from data subjects.” That is, from the people whose personal data was collected and made public, in absentia.
“The need for further investigation”
For the record, most of ONE TEAM’s controversial report focuses on the massive “mapping” (as it is subtly called) of those who reacted against the pollution and the odor that plagues western Thessaloniki, for which they consider Hellenic Petroleum’s refinery to be responsible.
Its scope of the “mapping” includes politicians, local officials, members of associations and environmental organizations. This 104-page “study” also includes their CVs, their political activity, whether they are members of Facebook groups created by residents of western Thessaloniki in regards to the pollution in the area, the degree of each’s reaction, phone records and addresses, and even phone calls to complain to Hellenic Petroleum have been recorded.
Among other things, there is a complete record of a community environmental group made up of citizens from Kordelio – Evosmos called “Breathing clean air is a right” -even their Facebook posts were included in the study. The study also notes that two of the women in the group “need further investigation.”
“Managing a Crisis with Communications”
However, the report is not limited to the “mapping” of those opposed to the pollution. The study clarifies that “the local community does not consider Hellenic Petroleum an integral part of the community, but regards the Group as a ‘foreign body’ that may pose a serious risk to the public health and safety of the locals.” The study suggests a strategy for the communication management of the crisis between Hellenic Petroleum and the community of western Thessaloniki, in general and specific goals.
One goal is to “promote Hellenic Petroleum’s role in the Greek economy and society,” and specifically regarding the area of western Thessaloniki, another goal is to “restrict and control reactions (isolate those who are speaking out)”.
The “actions and communications approach” proposed by the study include the creation of Allies and Supporters (official and unofficial) and the development of alternative channels of dissemination and communication. Creating “supporters” of Hellenic Petroleum will include mobilizing refinery employees, representatives of Parents’ Associations, students from the area who have received scholarships from the Group and parents who send their children to Hellenic Petroleum’s summer camps. Regarding the “creation of positive cores” in the scientific community, the study suggests recruiting a meteorologist, an environmentalist and a doctor, who will deliver an opinion that air flows are responsible for pollution, as well as the disposal of chemicals in sewers and that the unpleasant odor does not necessarily endanger public health.
An end that never came
This incomprehensible case was discovered during a routine internet search of pollution levels by members of “Network 50” for emissions of the TITAN cement industry, Waste Transfer Station and Hellenic Petroleum. A member of the “Network 50” group, a resident of the Kordelio area, stumbled upon this – until then – classified report that had been posted as an internal document.
About a week after this revelation (September 14, 2017), the head of the Thessaloniki Prosecutor’s Office, Lambros Tsogas, ordered a preliminary examination, which he assigned to the Cybercrime Prosecution, to investigate which citizens had their personal data “collected, stored and processed”, in accordance with Article 22 of Law 2472/97 on Personal Data. However, to date, about two years later, the outcome of this investigation remains unknown.
At the end of last February, the preliminary results of the report on the odor which covers the west side of the city, (based measurements over a six-month period by the Region of Central Macedonia and the Aristotle University of Thessaloniki), were presented. According to the atmospheric measurements, high concentrations of the compounds that cause the odor were detected inside the refinery of Hellenic Petroleum. And, in fact, the levels inside the refinery were 10 times higher than the levels found on the exact same day, in samples taken in Kordelio.
Nevertheless, the scientists were reassuring: “the compounds are not included in the list of carcinogens. They are not toxic. We have respiratory symptoms and secondary symptoms in the central nervous system – nausea, insomnia, vomiting, headaches” they reported. Even so, residents of western Thessaloniki are still waiting for the final results of the final measurements, which should have been made public several months ago.