GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
the number of the individuals affected, the mitigation measures implemented, the contact details of the data controller, etc. Any delay in filing the above notification with the HDPA must be justified. Communicate the Breach to Affected Individuals If the breach is likely to result in a high risk to the rights and freedoms of the individuals, the data controller must inform the individuals about such breach imme - diately and without undue delay, in clear and plain language, explaining: • the nature of the breach; • the potential consequences; • the contact details of the data controller; and • the mitigation measures implemented or sug - gested. Communication may be avoided only in limited cases – eg, where data was encrypted and not readable to third parties without authorisation, or if any risk has been fully mitigated. Maintain an Internal Breach Register All breaches – even those not notified – must be recorded with details of facts, effects and remedial actions. 1.7 Regulators The Hellenic Data Protection Authority (HDPA) The HDPA has control powers, as well as correc - tive, advisory and licensing powers, as specified and described in Article 58 of the GDPR and Article 15 of Law 4624/2019. Analytically, the HDPA: • monitors the implementation and enforcement of the GDPR, Law 4624/2019 and other regulations concerning the protection of individuals from the processing of personal data; • contributes to the consistent application of the GDPR throughout the European Union and, for this purpose, co-operates with the supervisory authori - ties of the EU member states and with the Com- mission; • promotes public awareness of personal data protection issues and the obligations of controllers and processors;
• provides opinions on any regulation to be included in a law or regulatory act concerning data process - ing; • issues instructions and makes recommendations on any matter concerning data processing; • provides, upon request, information to data sub - jects regarding the exercise of their rights; • handles complaints submitted for violation of the provisions of the GDPR; • conducts investigations or audits regarding the implementation of personal data protection legisla - tion; • encourages the development of codes of con - duct and approves codes of conduct that provide adequate safeguards; • encourages the establishment of data protection certification mechanisms and data protection seals and marks, and approves certification criteria; • co-operates with other supervisory authorities through the exchange of information, aiming for a more consistent application of the GDPR through - out the EU; and • contributes to the activities of the EDPB. The Hellenic Authority for Communication Security and Privacy (ADAE) The ADAE is responsible for monitoring the implemen - tation of all legislation relevant to the lawful intercep - tion of communications. Analytically, the ADEA: • issues regulations regarding the assurance of the confidentiality of communications; • performs audits on communications network/ service providers, public entities and the Hellenic National Intelligence Service, and holds respective hearings; • investigates relevant complaints from members of the public; and • collects relevant information using special investi - gative powers. The Hellenic Cybersecurity Authority (NCSA) The NCSA aims to organise, co-ordinate and imple - ment a comprehensive framework of strategies, measures and actions for achieving and maintain - ing a high level of prevention, protection, deterrence, response and recovery from cyber-attacks. Analyti - cally, the NCSA:
137 CHAMBERS.COM
Powered by FlippingBook