GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
• the processing is necessary for carrying out the obligations and exercising specific rights of the data controller or the data subject in the field of employment, social security and social protection law, including pensions in accordance with appli - cable law; • the processing is necessary for the protection of the vital interests of the data subject or another natural person, where the data subject is physically or legally incapable of giving his/her consent; • the processing takes place within the legitimate activities of a non‑profit entity/organisation with a political, philosophical, religious or trade union purpose, provided the processing regards only its members or former members and the personal data is not disclosed outside the entity/organisa - tion; • the processing is of personal data that has been manifestly made public by the data subject (eg, online posts, social media, interviews, publica - tions); • the processing is necessary for the establishment, exercise or defence of legal claims, or when courts act in their judicial capacity; • the processing is necessary for reasons of sub - stantial public interest; • the processing is necessary for preventative or occupational medicine; • the processing is necessary for public health pur - poses; or • the processing is necessary for archiving pur - poses in the public interest, scientific or historical Minors enjoy special protection as they are not aware of the risks involved in the processing of their personal data. Minors can consent to the processing of their personal data if they are at least 16 years old and the data controller uses clear, accurate and simple language to inform the minors prior to obtaining their consent. research, or for statistical purposes. Personal Data Relating to Minors When it comes to the internet and the provision of ser - vices to minors, minors can consent to the process - ing of their personal data if they are at least 15 years old. If minors are under this age, the consent must be granted by their legal representative – ie, parent or
legal guardian. Decisions based solely on automat - ed processing are prohibited, where such decisions legally affect or influence significantly minors. Profiling for promotional of marketing purposes is prohibited. Personal Data Relating to Criminal Convictions Greek Law 4624/2019 – which transposes Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natu - ral persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecu - tion of criminal offences or the execution of criminal penalties, and on the free movement of such data – provides the general principles and requirements for the processing of personal data relating to criminal convictions and offences by police, prosecutors and judicial authorities for criminal law enforcement pur - poses. Personal data relating to criminal convictions and offences constitutes a separate category of per - sonal data, which may be processed only under the control of an official authority, when it is absolutely necessary for the performance of the duties of the data controller and with the application of appropri - ate safeguards for the rights and freedoms of the data subjects. 1.4 Processing of Personal Data for Research and Development Purposes Health data is one of the special categories of per - sonal data whose processing can take place under the requirements described in 1.3 Special Categories of Personal Data . According to Article 30 of Greek Law 4624/2019, by derogation to the above, health data can be processed for scientific purposes, including research and development, without the consent of the data subject, provided: • the interest of the controller exceeds the interest of the data subject not to have his/her personal data processed; and • the controller takes appropriate measures for the protection of the legal interests of the data subject, which may include: (a) limiting access to the personal data for the controller and processors;
(b) pseudonymising personal data; (c) encrypting personal data; and
134 CHAMBERS.COM
Powered by FlippingBook