GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
• monitors and supervises the implementation of the EU Directive on measures for a high common level of cybersecurity across the EU (NIS2) in Greece; • sets the regulatory framework for the operation of critical infrastructure digital systems in Greece; • supports scientific research, innovation and invest - ments in cybersecurity, contributes to the develop - ment of national and international standards, and promotes education and awareness in the field; • is the designated single point of contact for report - ing security incidents and may intervene to assist in the management of such incidents; and • co-operates with national and international authori - ties to exchange information and best practices. 1.8 Enforcement Proceedings and Fines Enforcement Proceedings Enforcement proceedings before the HDPA are governed by the provisions of Law 3051/2002 and the Code of Administrative Procedure. Decision No 9/2022 of the HDPA, as amended, includes the Rules of Operation of the HDPA and provides that every case must follow these basic procedural steps: • case file preparation before the hearing; • hearing before the HDPA – the hearings are not open to the public; and • in the event of reprimand or the imposition of penalties, the HDPA issues its decision only after having heard the parties involved, who may file submissions before the hearing, attend the hearing in person or with an attorney, provide clarifications upon request during the hearing and file closing submissions. The HDPA examines complaints and conducts inves - tigations or audits either ex officio or following a com - plaint, in order to ensure compliance with applicable legislation regarding the protection of personal data. In exercising its powers, the HDPA may dismiss appli - cations, inquiries or complaints that are deemed to be manifestly vague, unfounded, abusive or anony - mous. The HDPA informs the person who has filed a complaint, and all parties involved, about the actions it takes. Without prejudice to the deadlines set by the GDPR, the prioritisation of applications, inquiries and com -
plaints is assessed by the HDPA based on the impor - tance and broader public interest of the matter. The HDPA may issue decisions on the merits of the case and provisional decisions with measures applicable until the issuance of its decision on the merits of the case. The HDPA’s decisions are binding on its addressees, while its enforceable acts are subject to appeal before the Administrative Courts and to annul - ment by the Council of State. Administrative Fines • For individuals and private entities: according to Article 83 of the GDPR, the HDPA may impose administrative fines of up to EUR10 million on pri - vate entities or, in the case of an undertaking, up to 4% of the total worldwide annual turnover. • For public entities: according to Article 39 of Law 4624/2019, administrative fines imposed by the HDPA upon public entities are limited to the amount of EUR10 million. In 2023, 1,414 recourses/complaints were filed with the HDPA, and penalties totalling EUR637,000 were imposed by way of 27 decisions. According to Article 83 of the GDPR, when imposing an administrative fine and determining its amount, the HDPA takes the following factors into account: • the nature, gravity and duration of the violation, considering the nature, scope or purpose of the processing concerned, as well as the number of data subjects affected and the level of damage suffered; • the intentional or negligent character of the viola - tion; • any actions taken by the controller or processor to mitigate the damage suffered by data subjects; • the degree of responsibility of the controller or processor, taking into account the technical and organisational measures implemented; • any relevant previous violations by the controller or processor; • the degree of co-operation with the HDPA to remedy the infringement and mitigate its possible adverse effects; • the categories of personal data affected by the violation;
138 CHAMBERS.COM
Powered by FlippingBook