[co-authors: Polyvios Panayides and Christos Malikkidis, Chrysses Demetriades & Co.]
Q1/ Applicable legislation
Q2/ Personal data of deceased persons
Q3/ Legal bases for processing
Q4/ Consent of children
Q5/ Processing of sensitive personal data
Q6/ Data relating to criminal offences or convictions
Q8/ Restrictions on data subjects’ rights
Q9/ Joint controllership
Q11/ Data protection Impact Assessments
Q12/ Prior authorisation and public interest
Q14/ International data transfers
Q16/ Claims by not-for-profit bodies
Q17/ Administrative fines, penalties and sanctions
Q18/ Freedom of expression and information
Q19/ National identification numbers
Q20/ Processing in the context of employment
Q21/ Other material derogations
Q22/ Current legal challenges
Q24/ Regulatory Guidance
(a) Have the requirements of the GDPR been addressed by introducing a new law, or by updating existing legislation?
New legislation has been passed.
(b) Relevant legislation includes:
(c) What is the status of national pre-GDPR data protection law?
The relevant pre-GDPR legislation has been repealed in full.
Does national law make specific rules regarding the processing of personal data of deceased persons?
There are no specific rules governing this issue.
(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?
(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?
There are no specific rules governing this issue
(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?
(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?
There are no specific additional criteria governing this issue.
At what age can a child give their consent to processing in relation to ISS?
14 years of age.
(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?
Genetic and biometric data cannot be processed for the purposes of obtaining medical and life insurance, even if the data subject has consented.
b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:
(i) Employment, social security and/or social protection law
There are no specific rules on processing this category of data.
(ii) Substantial public interest
(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services
(iv) Public interest in the area of public health
(v) Archiving purposes, scientific or historical research purposes or statistical purposes
The controller may not use personal data obtained from processing for archiving purposes, scientific or historical purposes, or statistical purposes to make a decision which has legal effects on the data subject or similarly significantly affects him or her.
(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?
Processing genetic and biometric data for the purposes of obtaining medical and life insurance is prohibited.
Under what conditions does national law permit the processing of personal data relating to criminal convictions?
(a) Does national law specify exemptions to a data subject’s right to erasure?
There are no specific exemptions to the right to erasure.
(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?
The right to be provided information applies to the extent that it does not impair the right to freedom of expression and information and journalistic secrecy when processing (of all categories of personal data) is carried out for journalistic or academic purposes or for purposes of artistic or literary expression.
(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?
There are no specific exemptions to the right to not be subject to automated individual decision-making.
Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?
Where an Impact Assessment and prior consultation with the DPA have been carried out, a controller or processor may implement measures to restrict, wholly or partly, the rights referred to in Arts. 12, 18, 19 & 20 GDPR.
Furthermore, where a data breach has taken place, provided that an Impact Assessment and a prior consultation with the DPA have been carried out, a controller may be exempt from the obligation to communicate a personal data breach to the data subject, wholly or partly, for one or more of the purposes referred to in Art. 23(1) GDPR.
Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?
There are no additional rules on apportionment of liability between joint controllers.
In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?
There are no additional pieces of legislation.
Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?
An Impact Assessment and consultation with the DPA must be carried out in the following circumstances:
Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?
Prior authorisation from the DPA is only required in accordance with the provisions of the GDPR as well as under the circumstances set out in Q11 above.
(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?
The DPA may establish and make public a list of additional processing operations and cases requiring the designation of a DPO. At present, no such list appears to have been published.
(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?
The DPO is bound by obligations of professional secrecy or confidentiality in the performance of his or her duties, subject to the provisions of any law regulating issues of professional secrecy or confidentiality. However, these obligations do not affect the DPA’s investigative powers.
(a) Does national law make specific rules about transfers of personal data from public registers?
Data transfers from public registers are not subject to specific rules.
(b) Does national law restrict the transfer of specific categories of personal data to third countries?
Data transfers are subject to the following additional restrictions:
(a) Details of the DPA(s).
(b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?
Not applicable as there is only one DPA.
(c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?
(d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?
The DPA has the right to obtain access, without necessarily informing the controller or the processor or their representative in advance, to any premises of the controller or the processor (including means of transport), with the exception of residences.
In the exercise of its investigative powers, the DPA may seize documents or electronic equipment by virtue of a search warrant in accordance with criminal legal procedure.
With regard to authorisation and advisory powers, the DPA has the power to:
The DPA must notify the Attorney General of the Republic and/or the police of any infringement of the provisions of the GDPR or the national law which may constitute a criminal offense in accordance with provisions of the national law.
(e) What national appeals process exists to enable parties to challenge the decisions of the DPA?
The decisions of the DPA may be appealed before the Administrative Court.
(f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?
The DPA has access to all the personal data and to all the information required for the performance of its tasks, including confidential information, except where information is covered by legal professional privilege.
Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?
There are no not-for-profit bodies that are specifically mandated to bring such claims.
(a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?
An administrative fine imposed on a public authority carrying out not-for-profit activities must not exceed €200,000.
(b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?
The following additional penalties or sanctions are available:
(a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?
The processing of personal data, sensitive personal data or personal data relating to criminal convictions and offenses, when carried out for journalistic or academic purposes or for purposes of artistic or literary expression, is permitted provided that those purposes are proportionate to the aim pursued and the data subject’s ECHR rights. Furthermore, the provisions of Arts. 14 & 15 GDPR do apply to the extent that they do not impair the right to freedom of expression and information and journalistic secrecy.
(b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?
There are no specific provisions governing this issue.
Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?
(a) For what purposes can employees’ personal data in the employment context be processed under national law?
There are no specific provisions governing the processing of employee data.
(b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?
There are no specific safeguards of this nature.
Are there any other material derogations from, or additions to, the GDPR under national law?
Without prejudice to the provisions of Art. 6(1)(e) GDPR, the processing of personal data is permitted and is lawful when it is carried out by:
In relation to the Courts’ decisions, the processing of sensitive data is permitted and lawful in the following situations:
Personal data in official documents held by a public authority or entity performing a task in the public interest must be disclosed in accordance with the specific provisions relating to access to information from public authorities.
Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?
There are no current legal challenges ongoing.
Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?
The DPA has taken enforcement action for breaches of the GDPR, including:
Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?
The DPA has issued the following guidance on the application of the GDPR and/or GDPR implementation law: