GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
• approaches to certification schemes that facilitate the comparison of data processing products and services for professional users, taking into account established national or international norms, to facilitate the comparability of those products and services – such approaches may include quality management, information security management, business continuity management and environmen - tal management; and • communication roadmaps taking a multidiscipli - nary approach to raise awareness of the codes of conduct among relevant stakeholders. The GDPR and Regulation EU 2018/1807 refer to data portability and the aim to make it easier to port data from one IT environment to another – ie, to another provider’s systems or to on-site systems. This pre - vents vendor lock-in and fosters competition between service providers. However, the above Regulations differ in their approach to portability when it comes to the relation between the targeted interest groups and the legal nature of the provisions. The right to portability of per - sonal data under Article 20 of the GDPR focuses on the relation between the data subject and the control - ler. It concerns the right of the data subject to receive personal data which they have provided to the con - troller, in a structured, commonly used and machine- readable format, and to transmit such data to another controller or to their own storage capacities without hindrance from the controller to which the personal data has been provided. Typically, the data subjects in this relation are consumers of various online services that wish to switch between these service providers. Article 6 of Regulation EU 2018/1807 does not provide for a right for professional users to port data, but has a self-regulatory approach, with voluntary codes of conduct for the industry. At the same time, it targets a situation where a professional user has outsourced the processing of its data to a third party offering a data processing service. In accordance with Article 3 (8) of Regulation EU 2018/1807, a “professional user” can include “both natural and legal persons, including public authorities or bodies governed by public law, using or requesting a data processing service for pur - poses related to their trade, business, craft, profes -
sion or task”. In practice, the portability under Article 6 of the Free Flow of Non-Personal Data Regulation concerns business-to-business interactions between a professional user (which may qualify as a “con - troller” in accordance with the GDPR in cases that include the processing of personal data) and a service provider (similarly, to be qualified in some cases as a “processor”). 3.4 Regulators and Enforcement The Ministry of Digital Governance is responsible for matters of data governance, such as cloud infrastruc - tures and interoperability. The National Cybersecurity Authority is the competent body for the security of information systems and access to data. Although the Regulation on the free flow of non‑personal data does not establish a new supervisory authority, its imple - mentation often interacts with the HDPA, particularly when datasets are mixed and include both personal and non‑personal data. The Hellenic Competition Commission also plays an important role, especially in relation to the enforce - ment of the Digital Market Act (DMA). In Greece, the authority responsible for ensuring compliance with the DMA is the Competition Commission, particularly regarding the obligations imposed on gatekeepers, such as: • the prohibition on combining personal data for advertising purposes unless the user consents (Article 5 (2) of the DMA); • the prohibition on using non‑public data generated or provided by the gatekeeper’s business users to compete against them (Article 6 (2) of the DMA); • the obligation to provide access to data (Article 6 (10) of the DMA); and • the obligation to provide access to search data (Article 6 (11) of the DMA).
4. Sectoral Topics 4.1 Use of Cookies
The use of cookies is governed by Law 3471/2006 and Recommendation 1/2020 of the HDPA. The basic requirement for the use of cookies is to obtain the
144 CHAMBERS.COM
Powered by FlippingBook