GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
the data controller or processor. The First Instance Court freely determines the amount of compensation based on the factual circumstances of the case and taking into account all relevant factors, such as the nature and extent of the violation, the degree of fault, the absence of contributory negligence by the data subject, and the financial and social situation of the parties. Decision No 573/2025 of the Athens Court of Appeal ruled that the unlawful sending of text messages for the purpose of commercial promotion of services established the liability of the sender in his capacity as data controller. Consequently, the data controller was ordered to pay monetary compensation for moral damages to the data subject amounting to EUR10,000 for each text message (SMS). 2.2 Recent Case Law Article 82 (1) of the GDPR provides that any individual who has suffered material or non‑material damage as a result of a GDPR infringement is entitled to com - pensation. Recitals 75 and 85 of the GDPR list exam - ples of non‑material damages, such as loss of control over personal data, restriction of rights, discrimina - tion, identity theft or fraud, unauthorised reversal of pseudonymisation, damage to reputation, loss of data, loss of confidentiality of data and similar harms. Non‑material damages may incur when personal data is disclosed or transferred to third parties without the data subject’s consent. In 2021, the CJEU addressed the concept of non- material damages under Article 82 of the GDPR for the first time, in Case C-300/21. More specifically, the harmful conduct of the company consisted in processing the personal data of an individual, which, combined with social or demographic information, led to the identification of that individual with a spe - cific political party. The CJEU clarified the notion of material damage under Article 82 of the GDPR and emphasised the following three requirements for the establishment of the right to compensation in para - graph 36 of its decision: • the processing of personal data carried out in breach of the provisions of the GDPR; • the damage suffered by the data subject; and
• a causal link between the unlawful processing and the damage. Furthermore, in paragraph 59 of the decision, the CJEU stressed that Article 82 of the GDPR must be interpreted as meaning that, for determining the amount of compensation due on the basis of the right established in that article, national courts must apply the domestic rules of each member state concerning the extent of financial compensation, provided that the principles of equivalence and effectiveness of EU law are respected. The CJEU has issued case law interpreting Article 82 of the GDPR. In particular, in Case C‑655/23, the Court held that Article 82 (1) of the GDPR must be interpreted as meaning that the term “non‑material damage” covers the negative emotions experienced by the data subject due to the unauthorised disclosure of their personal data to a third party, such as fear or distress arising from the loss of control over the data, the risk of their potential misuse, or harm to reputa - tion – provided that the data subject demonstrates that these emotions, together with their negative con - sequences, are causally linked to the infringement of the Regulation. 2.3 Collective Redress Mechanisms Law 5019/2023 transposes the provisions of Directive (EU) 2020/1828 of the European Parliament and of the Council of 25 November 2020 on representative actions for the protection of the collective interests of consumers. Actions may be brought against infringe - ments by traders of the provisions of the GDPR and Law 3471/2006, among others, for the protection of privacy and personal data in electronic communica - tions. Domestic representative actions can be filed by consumers’ unions or organisations, including entities that have been qualified in other member states to bring cross-border representative actions. Consum - ers’ unions or organisations must provide sufficient information about their members/consumers in order for the Court to decide on its jurisdiction and applica - ble law. The representative action may seek injunctive or redress measures. In Greece, there is no case law concerning the col - lective bringing of actions and the awarding of com -
140 CHAMBERS.COM
Powered by FlippingBook