GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
granted by their legal representative – ie, parent or legal guardian. Profiling for promotional of marketing purposes is prohibited for minors. Advertising communications must: • state clearly and precisely the identity of the sender; • include instructions for the recipient to object to and stop receiving further advertising communica - tions; and • state their “commercial” nature in the message’s subject matter, if any. The HDPA has issued Guideline 2/2011 with examples and best practices for obtaining the data subject’s consent electronically. 4.3 Employment Privacy Law The organisation and management of work and the observance of the employer’s legal obligations require the processing of employees’ personal data. The pro - visions applicable to processing employees’ personal data (included in the GDPR and Law 4624/2019) are outlined below. • The legal basis for the processing of the per - sonal data of the employees is the performance of the employment contract (Article 6 par 1 (b) of the GDPR). The legal basis for the processing of special categories of employees’ personal data is the exercise of rights or the performance of legal obligations deriving from employment law, social security law and social protection law (Article 9 par 2 (a) of the GDPR). • The legal basis of consent (Article 6 par 1 (a) of the GDPR) should be used only when there is no other legal basis for the processing of personal data of employees, taking into account the clear inequality between the data subject (employee) and the data controller (employer). • The basic legal principles governing the processing of personal data – namely the principles of lawful - ness, fairness and transparency, purpose limitation, data minimisation, and accuracy (Article 5 of the GDPR) – also apply to the processing of employ - ees’ personal data. If any of the above principles
is breached, the processing should be considered illegal. • The processing of employees’ personal data by means of CCTV in the workplace, whether publicly accessible or not, is permitted only if it is neces - sary for the protection of persons and property. Data collected through CCTV may not be used to assess employee efficiency and performance, nor to track working hours. Employees must be informed in advance in writing of the installation and operation of any CCTV system in the work - place. The HDPA has issued many guidelines and deci - sions on the processing of employees’ personal data, including Guideline 115/2001 on the protection of employees’ personal data and Guidelines 1/2021 and 2/2020 on the protection of personal data in remote working (telework). 4.4 Data Protection in M&A In business mergers and acquisitions, as well as dur - ing due diligence, where the exchange of information is necessary for the completion of the transaction, there is no specific legislation that sets out special requirements regarding the privacy and security of personal and non-personal data. On the contrary, the general legislation applies, including the GDPR and Law 4605/2016 on the protection of trade secrets, along with the provisions set by the parties in the Non- Disclosure Agreement, which usually deals with such issues. In addition, Law 3959/2011 on free competi - tion provides for the cases that require notification of the merger to the Hellenic Competition Authority, which assesses the nature of the exchanged informa - tion as confidential.
5. International Considerations 5.1 Restrictions on International Data Transfers
The transfer of personal data from an EU member state to another EU member state may take place freely (Article 44 of the GDPR), provided the other provisions of the GDPR are met. The transfer of per - sonal data from an EU member state to a non-EU country or international organisation may take place
146 CHAMBERS.COM
Powered by FlippingBook