GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
• the manner in which the HDPA became aware of the violation, particularly whether and to what extent the controller or processor notified it; • compliance with measures previously ordered under Article 58 (2) concerning the same subject matter; • adherence to approved codes of conduct or approved certification mechanisms; and • any other aggravating or mitigating factors appli - cable to the circumstances of the case, such as financial benefits gained or losses avoided, directly or indirectly, as a result of the infringement. The HDPA has recently issued decisions imposing significant administrative fines for violations of data protection legislation. • Decision No 44/2025 imposed an administrative fine of EUR10,000 and EUR80,000 upon an energy provider and call centre in its capacity as data pro - cessor, for making telephone calls promoting prod - ucts and services to individuals who had expressly requested not to receive such calls. • Decision No 42/2025 imposed an administrative fine of EUR30,000 on an energy services company for violating data subjects’ rights of access, rectifi - cation and erasure of their personal data. • Decision No 38/2025 imposed an administrative fine of EUR10,000 on a Municipality for operating a CCTV surveillance system at a vehicle depot with - out proper notification to the data subjects. Criminal Penalties Greek Law 4624/2019 provides for imprisonment and criminal penalties ranging between EUR100,000 and EUR300,000 for the violation of the legislation for the The current most significant enforcement trends in Greece revolve around the following three pillars. Ex Officio Audits of Surveillance Systems The HDPA has initiated an audit ex officio on the soft - ware developed and installed by the Ministry of Migra - tion and Asylum at the reception and hospitality struc - tures for third-country nationals located at the borders of Greece. The software programs provided for: protection of personal data. 1.9 Enforcement Trends
• digital management of the electronic and physi - cal security of the above structures with the use of CCTV, drones and artificial intelligence behavioural analytics; and • control of the persons entering and exiting the above structures, including personnel, third-coun - try nationals seeking asylum and representatives of NGOs, with the use of RFID in combination with two-factor authentication processing biometrical data. The HDPA attested many violations, including: • failure to define an appropriate legal basis for the processing of personal data, much of which belongs to the special categories; • providing deficient information to data subjects prior to the processing; • inadequate and deficient data processing agree - ments with the data processors; • failure to keep a registry of processing activities; and • failure to perform an appropriate DPIA. The HDPA imposed an administrative fine of EUR175,000 on the Ministry of Migration and Asylum (Decision No 13/2024). Implementation of Appropriate Technical and Organisational Measures and Data Breaches The HDPA has imposed administrative fines for fail - ure to apply appropriate technical and organisational measures, resulting in data breaches from an insider thread (Decision Nos 7/2025, 33/2025). Violation of Data Subjects’ Rights The HDPA steadily reviews complaints and applies administrative penalties in case of violation of data subjects’ rights to access, rectification, erasure and restriction of their personal data (Decision No 1/2025).
2. Privacy Litigation 2.1 Privacy Litigation Overview
The violation of privacy legislation may cause dam - ages, and the affected party has the right to request compensation for material or moral damages from
139 CHAMBERS.COM
Powered by FlippingBook