GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
is inaccurate or incomplete, and/or the deletion of his/her personal data, provided the request is law - ful and there are no overriding legitimate grounds for the processing; • Article 18 establishes the right to the restriction of processing, meaning that the data subject may request the suspension of processing, provided the request is lawful; • Article 20 establishes the right to data portability, meaning that the data subject may request and receive a copy of their personal data in a struc - tured, commonly used and machine‑readable for - mat, and/or request their transmission to another data controller; and • Article 21 establishes the right to object, meaning that the data subject may object to the process - ing of their personal data, provided the request is lawful. Compliance Checklist for Data Controllers The GDPR and Greek Law 4624/2019 set out the con - ditions under which entities/organisations may pro - cess personal data. Entities/organisations acting as data controllers must meet the following compliance requirements. • Mapping processing activities. • Providing information to data subjects regarding: (a) the type and nature of personal data collected and processed; (b) the purposes of the processing of personal data; (c) the legal basis on which the processing of per - sonal data is carried out; (d) the retention period of the personal data; (e) the rights of data subjects and how these rights may be exercised; (f) whether the data subject is subject to automat - ed decision‑making (profiling); and (g) the recipients or third parties to whom personal data are transferred. • Drafting and publishing privacy policies (employee privacy policy, CCTV policy, website cookies policy, vendors’ privacy policy, etc). • Collecting consent from data subjects where required (eg, sending newsletters for marketing purposes, cookies, processing special categories of data).
• Concluding data processing agreements with processors or third parties to whom personal data is transferred, in order to ensure transparency and the lawfulness of processing by third parties. • Performing a Data Protection Impact Assessment (DPIA) when there is a high risk to the rights and freedoms of data subjects or when processing is carried out on a large scale. • Implementing appropriate technical and organisa - tional security measures, such as: (a) access control; (b) encryption; (c) pseudonymisation; (d) data back-ups; (e) strong password policies; (f) security incident management; (g) incident response plan for personal data breaches; and (h) procedure for notifying the HDPA and data subjects of personal data breaches. • Training staff and raising awareness on the basic principles of the GDPR, the secure handling of personal data and the application of the privacy policies adopted. • Continuously monitoring legislation and regularly reviewing and updating the privacy policies and technical and organisational security measures adopted. 1.3 Special Categories of Personal Data According to Article 9 of the GDPR and Law 4624/2019, special categories of personal data include data relat - ing to: • racial/ethnic origin; • political opinions; • religious/philosophical beliefs; • trade union membership; • genetic data; • biometric data for identification; • health data; and • sex life or sexual orientation. Processing the special categories of personal data is prohibited, and is permitted only if: • the data subject has given his/her explicit consent for the processing;
133 CHAMBERS.COM
Powered by FlippingBook