GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
pensation for privacy violations. However, the issue has been addressed by the CJEU, which held in para - graph 32 of Case C‑757/22, Meta Platforms Ireland , that Article 80 (2) of the GDPR must be interpreted as not precluding national legislation that allows a con - sumer protection association to bring legal proceed - ings – without a mandate granted to it for that purpose and irrespective of the existence of an infringement of specific rights of an individual data subject – against an alleged infringer of data protection rules, relying on the violation of the prohibition of unfair commer - cial practices, the breach of consumer protection legislation or the violation of the prohibition on the use of unfair contract terms, provided that the data processing at issue is capable of affecting the rights conferred on identified or identifiable natural persons by the GDPR. 3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation Regulation (EU) 2018/1807 of the European Parlia - ment and the Council, adopted on 14 November 2018, establishes the principle of the free flow of non-per - sonal data within the EU. Regulation (EU) 2023/2854 of the European Parliament and the Council, adopted on 13 December 2023 and commonly referred to as the Data Act, establishes harmonised rules for fair access to and usage of non-personal data, and sets the rights and obligations of data users, data holders and data processing services. The main objective of the Data Act is to safeguard the fair allocation of the value of the data created from the use of connected products and related services for the benefit of all factors of the digital economy and the promotion of access to data and its use. The Data Act aims to facili - tate access to data and the users’ open use of data to create a well-functioning internal market for data. The expanding Internet of Things (IoT), AI and machine learning represent major sources of non-personal data – for example, as a result of their deployment in automated industrial production processes. Specific examples of non-personal data include aggregate and anonymised datasets used for big data analyt - ics, data on precision farming that can help to moni -
tor and optimise the use of pesticides and water, or data on maintenance needs for industrial machines. If technological developments make it possible to turn anonymised data into personal data, such data is to be treated as personal data, and the GDPR is to apply accordingly. IoT In Greece, Law 4961/2022 introduces for the first time a regulatory framework for the secure use of IoT devices by operators of critical infrastructure in both the public and private sectors. Specifically, the law sets out obligations and compliance declarations for IoT device manufacturers, including the following. • Cybersecurity measures to be embedded in IoT devices are defined according to their use and the associated security risks, in order to ensure an appropriate level of cybersecurity. • The minimum content of the manufacturer’s declaration of conformity for IoT devices is speci - fied, and such declaration must accompany every device intended to be made available to IoT opera - tors. The law also establishes the manufacturer’s obligation to inform all parties involved and the NCSA if the manufacturer becomes aware, by any means, of non‑compliance. • The obligations of importers and distributors of IoT devices are defined, particularly their duties to: (a) verify that the device is accompanied by the declaration of conformity; (b) inform other parties involved and the NCSA if they themselves become aware, by any means, of non‑compliance; and (c) maintain a record of notification actions and communicate such record to the NCSA. • The obligations of IoT operators are set out, includ - ing the requirement to appoint an IoT Security Officer, who is responsible for implementing and properly monitoring the technical and organisation - al measures adopted by the IoT operator to man - age risks related to the security of the IoT devices used, and for informing other involved parties and the NCSA if a risk associated with the device’s use arises. • The responsibilities of the NCSA are further speci - fied regarding the assessment and monitoring of compliance by manufacturers, importers, distribu -
141 CHAMBERS.COM
Powered by FlippingBook