Noyb: ‘Greek supermarket chain violates customers’ privacy rights with loyalty programs’

Greek supermarket chain Alfa Vita not only collects and processes a wide range of personal information of its customers, it also ignores their privacy rights. Therefore, the Austrian privacy organization Noyb has filed a complaint with the Greek data protection authority (DPA).

To collect as much personal information of its customers as possible, Alfa Vita has two loyalty programs: AB Plus Personal and AB Plus Unique. With it, the supermarket chain processes customers’ buying habits, the frequency of their visits to an Alfa Vita store, how often people buy products on discount, the total cost of their purchases, their contact information and home addresses, and so on.

A consumer with an AB Plus Personal card tried to exercise her right to see what data the supermarket chain had collected from her. Alfa Vita however only gave her a list of her transactions and her contact details, but no other information that it has derived from it.

Unacceptable, says Kleanthi Sardeli, data protection lawyer at Noyb. “The GDPR clearly states that a company’s reply to an access request must include all the information it holds on a customer. The Court of Justice clarified that this also includes all recipients that got your personal data. The fact that Alfa Vita deliberately withholds vast amounts of said data is clearly illegal.”

If a customer wants to know how much money it has saved by using their loyalty card, he has to participate in the AB Plus Unique loyalty program. However, upgrading means that a consumer would have to consent to sharing hus personal information with other third parties.

According to Noyb, that's absurd and unlawful. “Companies must ‘facilitate’ the access to personal data, not hold it hostage. Overall, this case shows that even operations that rely heavily on personal data, such as a loyalty program, are still failing to comply with the basics of the GDPR,” the advocacy group says.

Because food is one of the biggest expenses for any household due to rapidly increasing prices, Greek consumers may feel they have little to no choice but to agree to share their personal information with the supermarket chain and third parties.

That doesn’t however give Alfa Vita the right to disregard people’s fundamental right to privacy. Noyb has therefore filed a complaint with the Hellenic Data Protection Authority (DPA), requesting an investigation into Alfa Vita’s data processing operation.

The privacy group also wants the Greek DPA to impose a fine of up to 4 percent of Alfa Vita’s annual turnover in order to prevent similar violations in the future.