GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
• the conduct of an algorithmic impact assessment. 3.2 Interaction of Data Regulation and Data Protection Regulation (EU) 2018/1807 of the European Parlia - ment and the Council, adopted on 14 November 2018, establishes the principle of the free flow of non- personal data within the EU. Throughout its text, the Regulation uses the term “data”, which is defined as “data other than personal data”. Such data, which is also referred to as “non-personal data”, is inferred a contrario to personal data, as defined in the GDPR. According to the GDPR, “personal data” includes any information relating to an identified or identifiable nat - ural person – ie, the “data subject”. On the contrary, non-personal data can be categorised by origin as: • firstly, data that originally did not relate to an identi - fied or identifiable natural person, such as data on weather conditions generated by sensors installed on wind turbines or data on maintenance needs for industrial machines; or • secondly, data that was initially personal data but was later rendered anonymous. Mixed Datasets In new technology systems, mixed datasets often appear that consist of both personal data and non- personal data. Mixed datasets represent the majority of datasets used in the data economy and are com - mon because of technological developments such as the IoT (ie, digitally connecting objects), AI and technologies enabling big data analytics. In the case of a dataset composed of both personal and non-per - sonal data, Regulation (EU) 2018/1807 applies to the non-personal data part of the dataset and the GDPR applies to the personal data part of the dataset. Where personal and non-personal data in a dataset are inex - tricably linked, Regulation (EU) 2018/1807 shall not prejudice the application of the GDPR, meaning that: • Regulation (EU) 2018/1807 on the free flow of non- personal data applies to the non-personal data part of the dataset; • the GDPR applies to the personal data part of the dataset; and • if the non-personal data part and the personal data parts are “inextricably linked”, the data protection
rights and obligations stemming from the GDPR apply fully to the whole mixed dataset, including when personal data represents only a small part of the dataset. 3.3 Rights and Obligations Under Applicable Data Regulation Access Right Regulation (EU) 2018/1807 on the free flow of non‑personal data within the EU provides that nation - al competent authorities have the right to request or obtain access to data for the purpose of carrying out their official duties in accordance with EU or national law. Providers are not permitted to refuse competent authorities access to data on the grounds that the data has been processed in another member state. If a competent authority does not obtain access follow - ing a request for access to a user’s data, that author - ity may request the assistance of another competent authority from a different member state. Once access to the data and to any equipment or means of data processing is obtained, such access must comply with fundamental principles and with national and European legislation. Portability Right Regarding the right to data portability, the Commis - sion encourages the development of self‑regulatory codes of conduct at EU level in order to contribute to a competitive data economy in line with the principles of transparency and data interoperability. In particular, Article 6 of the Regulation provides that the following must be ensured: • best practices for facilitating the switching of service providers and the porting of data in a structured, commonly used and machine-readable format, including open standard formats where required or requested by the service provider receiving the data; • minimum information requirements to ensure that professional users are provided – before a contract for data processing is concluded – with sufficiently detailed, clear and transparent information regard - ing the processes, technical requirements, time - frames and charges that apply if a professional user wants to switch to another service provider or port data back to its own IT systems;
143 CHAMBERS.COM
Powered by FlippingBook