GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
tors and IoT operators. In addition, manufactur - ers, importers and distributors of IoT devices are required to comply with the NCSA’s instructions by taking any corrective action necessary to achieve compliance. For the operator using the device, such measures may extend to the suspension of the device’s use. • Given the high risk of disruption to the operation of an IoT device and its potential impact, the law establishes a specific obligation for manufactur - ers to maintain a process for managing security incidents or vulnerabilities, for each device. • IoT operators are required to provide users with information about the devices so that each user – regardless of their familiarity with new technolo - gies – can understand basic issues related to the safe installation, configuration and operation of the device. • Finally, because the processing of personal data within IoT environments may pose a high risk to the rights and freedoms of individuals, IoT opera - tors are required to conduct a DPIA for the planned processing activities related to the operation of IoT devices, in accordance with Article 35 (1) of the GDPR. Cloud Computing Cloud computing technology, through which entities and individuals can process and store large volumes of data, creates serious threats to data security and privacy. Law 4727/2020 establishes the government cloud for the public sector (G Cloud) as a set of digital infrastructures managed by the General Secretariat of Information Systems. Government cloud infrastruc - tures also exist in specific public sectors, such as Research and Education (RE Cloud) and the Health Government Cloud (H Cloud). All central electronic applications and central information systems main - tained by Ministries, independent authorities and the Information Society are connected to the G Cloud, and they relate to transactions with natural persons, legal entities and public administration. Although the G Cloud offers significant advantages in terms of flexibility and efficiency, it simultaneously creates serious threats to privacy and personal data protection, because a large volume of citizens’ data is stored therein, such as health data. This raises con -
cerns regarding security and confidentiality, especially in the event of a cyber-attack, data breach or viola - tions of personal data. AI Regulation (EU) 2024/1689, commonly referred to as the AI Act, establishes harmonised rules on AI and represents the first comprehensive legal framework for AI worldwide. It covers AI systems’ develop - ment, marketing, deployment and use. In Greece, Law 4961/2022 includes provisions on the use of AI systems in the public sector for decision‑making pro - cesses that affect the rights of natural persons and legal entities. Public entities that use AI systems are required to carry out a DPIA in accordance with Article 35 of the GDPR and to take the following into account: • the intended purpose, including the public interest served through the use of the AI system; • the capabilities, technical characteristics and oper - ating parameters of the AI system; • the type and categories of decisions made or acts issued with the involvement of the AI system, or supported by it; • the categories of data collected, processed or entered into the system, or generated by it; • the risks that may arise for the rights, freedoms and legitimate interests of the natural or legal persons to whom the decision relates or whom it affects; and • the expected benefit for society as a whole in relation to potential risks and impacts that may result from the use of the AI system, particularly for racial, ethnic, social or age groups and categories of the population such as persons with disabilities or chronic conditions. Every public entity that uses AI systems must pro - vide specific information to natural persons who are subject to decision‑making based on such systems, such as: • the date on which the AI system began operating; • the operating parameters, capabilities and techni - cal characteristics of the AI system; • the categories of decisions made or acts issued with the involvement of the AI system or supported by it; and
142 CHAMBERS.COM
Powered by FlippingBook