GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou, Gavrilis - GKP Law Firm
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy- Related Laws The fundamental provisions for privacy and data protection in Greece are the following in order of priority: The Treaty on the Functioning of the EU (TFEU) and Regulation (EU) 2016/679 Regulation (EU) 2016/679 of the European Par - liament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the free move - ment of such data (GDPR) is the main legislation for the protection of personal data. The GDPR is directly applicable in Greece and supersedes any provision of national law, including the Con - stitution. The GDPR provides for the imposition of penalties (Article 83), as well as the obligation to compensate for damages incurred (Article 82) in case of violation of its provisions. Constitution The Greek Constitution sets out the basic princi - ples for the privacy of communications and the protection of personal data. The articles regard - ing fundamental individual rights are included in the chapter. More specifically: Article 9A of the Constitution establishes protec - tion from the processing, collection and use of personal data and provides for establishing an independent authority to safeguard such rights. In 1997, the Hellenic Data Protection Author - ity (HDPA) was established according to Law 2472/1997. Article 19 of the Constitution establishes the privacy of correspondence (namely post/mail, which is the oldest form) and the freedom of
communications in general and provides for establishing an independent authority to safe - guard such rights. In 2003, the Hellenic Authority for Communications Security and Privacy was established according to Law 3115/2003. Civil Code Articles 57-59 of the Greek Civil Code include fundamental provisions for protecting the indi - vidual’s personality. An offence to the individu - al’s personality may substantiate civil claims for injunction, compensation, and moral damages. Laws Law 4624/2019 provides the necessary measures for the implementation of the GDPR and trans - poses the provisions of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the pre - vention, investigation, detection or prosecution of criminal offences or the execution of criminal pen - alties, and on the free movement of such data. Moreover, Law 4624/2019 includes provisions for the operation of the HDPA. • Law 2472/1997 transposes Directive 95/46/ EC on the protection of individuals with regard to the processing of personal data applies to the extent that a few of its articles remain in force. • Law 3471/2006 provides for the protection of privacy and personal data in electronic com - munications. • Law 3674/2008 provides for the necessary measures that the providers of electronic communications networks and services must apply to safeguard the safety and privacy of communications. • Law 3917/2011 transposes the provisions of Directive (EU) 2006/24/EC of the European
150 CHAMBERS.COM
Powered by FlippingBook