GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
1.6 Data Breach Requirement A personal data breach (Article 4 (12) of the GDPR) is defined as a security breach that results in the acci - dental or unlawful destruction, loss, alteration, unau - thorised disclosure of or access to personal data transmitted, stored or otherwise processed. Accord - ing to the Guidelines 18/2018 of the Article 29 Work - ing Party (now the European Data Protection Board) on personal data breach notification (“Guidelines on Personal Data Breach Notification under Regulation 2016/679”, WP 250 rev.1), one category of personal data breach is based on the security principle of con - fidentiality, which occurs when there is unauthorised access to personal data (“confidentiality breach”). A breach may potentially have various significant adverse effects on individuals, which may lead to physical, material or non-material damage. The GDPR explains that such damage may include loss of con - trol over personal data, limitation of rights, discrimina - tion, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, reputational harm, or loss of confidentiality of personal data protected by professional secrecy, among others. In the case of a data breach, the data controller must comply with the following obligations. Assess the Data Breach Without Undue Delay The data controller must determine: • what happened and when; • which data was affected; • how many data subjects are impacted; • the likely consequences; and • whether the breach poses a risk or high risk to data subjects. The above assessment must be documented. File a Notification With the HDPA If the breach is likely to result in a risk to the rights and freedoms of the individuals, the data controller must notify the breach to the HDPA within 72 hours of becoming aware of such breach. The HDPA has an online form, which must be completed and filed by the data controller, including information on the nature of the breach, the categories of personal data affected,
sors stemming from EU or national law on the protection of personal data insofar as the design, development or use of AI systems involves the processing of personal data; nor • the rights and guarantees awarded to data sub - jects by such EU law, including the rights related to solely automated individual decision-making, including profiling. On the contrary, the AI Act should facilitate the effec - tive implementation and exercise of the data subjects’ rights and other remedies guaranteed under EU law on the protection of personal data. There are no specific laws regarding AI in Greece that relate to or affect the protection of personal data. The reliance of AI technologies on large datasets can create significant privacy risks. AI systems are often trained on vast amounts of personal information, sometimes collected without proper consent, or used in ways that individuals might not expect. This can lead to unintended consequences, such as expos - ing sensitive personal details or allowing for intrusive profiling. For example, an AI model used to predict consumer preferences might draw on data from social media, shopping history or even biometric informa - tion, potentially leading to privacy violations, if such data is mishandled or shared without adequate safe - guards. To address the above risks and harness the benefits of AI responsibly, the EU has embarked on regulatory initiatives aimed at balancing innovation with the pro - tection of fundamental privacy rights. Personal data protection legislation plays a vital role, as AI systems are often built on personal data and rely on it. There - fore, personal data principles and requirements help to address some of the above risks. To support data protection professionals, the HDPA provides relevant training material developed by external experts of the EDPB under the supervision of the HDPA’s specialised scientific staff, which con - sists of two complementary training programmes, each accompanied by interactive comprehension and self‑assessment questions about the use of AI systems.
136 CHAMBERS.COM
Powered by FlippingBook