GREECE Law and Practice Contributed by: Semina Zavitsanou, Yannis Ragos, Maria Siraga and Panagiota Kelali, POTAMITISVEKRIS
the relevant purpose unless an extension is justified, and must be deleted or properly anonymised upon closure of the investigation, taking into account any applicable appeal or limitation periods. 7.3 Access Regardless of whether they are the subject of an investigation or have initiated it, the employees, as data subjects, fully retain their rights under the GDPR. Under the GDPR and Greek law, any person whose data is processed in an HR investigation typically has a right of access to their own personal data; thus, in principle, the data subject (complainant, respondent, or witness) can obtain their personal data found in notes, emails, logs, documents, CCTV footage, etc, plus the required Article 15 information (purposes, categories, recipients, retention, source, and safe - guards for transfers). However, the right to access is not an absolute right. The employer can invoke the limitations provided by the applicable law and provide extracts or redacted copies if an exception applies: • Protecting the Rights and Freedoms of Third Par - ties: The employer may redact or withhold third- party identifiers, witness statements, or data that would reveal someone else’s identity or privacy (GDPR Article 15 (4), Recital 63) if a disclosure would result in a violation of the rights and free - doms of persons involved. • Ongoing Investigation Integrity: For example, there may be grounds for protecting whistle- blowing confidentiality, protecting the reporting person’s identity and related confidential details under Greece’s whistle-blower framework (Law 4990/2022)). In this case, the rationale and the justification for any temporary or other limitation of access should be documented. • Legal Confidentiality and Proprietary Information/ Trade Secrets: In these cases, the employer may be able to withhold privileged communications and proprietary information, or provide summaries where feasible. • Confidentiality of Telecommunications: The employer can restrict access where disclosure would breach applicable law.
• Regulatory Constraints: Disclosure may be limited where mandated by law. 7.4 AI AI is not very common in HR investigations in Greece yet. However, AI tools may be used to facilitate and expedite evidence review such as AI-assisted review for emails and chats, detection of suspicious activ - ity in logs and transactions, audio transcription and machine translation. Data protection questions arise under the GDPR, Greek Law 4624/2019, and Greece’s Law 4961/2022 on emerging technologies in the employment sector as well as the AI Act. Law 4961/2022 emphasises trustworthy, human-centric AI (transparency, account - ability, risk management, non-discrimination) and promotes governance measures (impact/risk assess - ments, human oversight, documentation). These pro - visions are in alignment with both the GDPR and the AI Act and must be taken into account when using an AI system in HR investigations. • High-Risk Processing: Many AI tool uses (monitor - ing, profiling, video analytics, large-scale review, special categories) would result in a high risk to the freedoms and rights of the employees and thus trigger the need for conducting a DPIA. If residual high risk remains, prior consultation with the HDPA should be obtained. • Automated Decisions: AI systems should not be allowed to take decisions that produce legal or similarly significant effects on employees without Article 22 GDPR safeguards. Human oversight and the involvement of a person in the final decision- making process are legally required. • Transparency: Employees must be informed about the use of AI tools in the investigation in clear but detailed language and in a simple manner. A trans - parency report should be available to all employees if AI systems are involved in HR investigations, explaining the reasoning, the parameters and the criteria used in a determination made by the AI system. • Accuracy and Bias: The employer must document the due diligence performed to ensure that the AI systems used are free of bias and are trained on accurate data.
186 CHAMBERS.COM
Powered by FlippingBook