GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou - GKP Law Firm
5.2 Government Notifications and Approvals In Greece, no authorisation is required for the inter - national transfer of data, meaning that no specific registrations, notifications or approvals from national authorities are necessary for such transfers. Please see 5.1 Restrictions on International Data Transfers regarding international transfers of personal data. However, the data controller or processor must enter the transfers of personal data in the records of pro - cessing activities (Article 30 of the GDPR), stating at least the recipient and the documentation proving the existence of appropriate safeguards. Such records, including records of transfers, should be made avail - able to the HDPA upon request. 5.3 Data Localisation Requirements In general, Regulation (EU) 2018/1807 promotes the free flow of non-personal data across EU member states. EU member states can only impose localisa - tion requirements for non-personal data if doing so is justified on grounds of public security, in compliance with the principle of proportionality. In the above context, there are laws that require the localisation of non-personal data in sectors such as: • specific sectors of the government regarding the Ministry of National Defence, the Ministry of Citizen Protection, the Ministry of Foreign Affairs, the Coast Guard of the Ministry of Shipping, the General Secretariat of Citizenship of the Ministry of Interior, the National Intelligence Service and the services of Criminal Records of the Ministry of Justice. Please see 5.1 Restrictions on International Data Transfers regarding whether or not remote access to data is considered a transfer. • taxation and social security; • customs; cybersecurity; and
5.4 Blocking Statutes There are no “blocking” statutes in Greece, mean - ing there are no Greek laws or statutes that prohibit compliance with EU regulations. Every international transfer of personal and non‑personal data must com - ply with EU transfer rules. Requests for data trans - fers originating from third countries cannot be fulfilled unless they are consistent with these rules. Article 48 of the GDPR provides that any judgment of a court or decision of an administrative authority of a third country requiring a data controller or processor to transfer or disclose personal data may be recognised or enforced in any way only if it is based on an inter - national agreement, such as a mutual legal assistance treaty, that is in force between the requesting third country and the EU or a member state, without preju - dice to other grounds for transfer. 5.5 Recent Developments Greece is steadily investing in improving data gov - ernance, data protection and cybersecurity, and in upgrading its digital infrastructure. These initiatives align with the EU’s digital decade objectives and help to create the conditions for future developments and legal frameworks. As Greece’s digital maturity contin - ues to grow, it is likely that new measures or further clarifications in the area of data international transfers will emerge in the coming years.
148 CHAMBERS.COM
Powered by FlippingBook