GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou, Gavrilis - GKP Law Firm
• Data shall be erased when no longer neces - sary for the agreed purpose unless otherwise agreed with the user in relation to non-per - sonal data. • The exercise of the users’ right to restrict or prohibit accessing, using or further sharing data shall be rendered unduly difficult. • Data shall not be used for profiling, unless it is necessary to provide the service requested by the user. • Data shall not be made available to another third party unless it is made available on the basis of a contract with the user and provided that the other third party takes all necessary measures agreed upon between the data holder and the third party to preserve the confidentiality of the trade secret. • Data shall not be made available to an under - taking designated as a gatekeeper pursuant to Article 3 of Regulation (EU) 2022/1925. • Data shall not be used to develop a product that competes with the connected product from which the accessed data originate or be shared with another third party for that purpose. Also, third parties shall not use any non-personal product data or related service data made available to them to derive insights about the economic situation, assets and production methods of, or use by, the data holder. • Data shall not be used in a manner that has an adverse impact on the security of the con - nected product or related service. • Any specific measures agreed with a data holder or a trade secret holder to preserve their confidentiality will not be disregarded. • The user who is a consumer shall not be prevented from making the data it receives available to other parties. The Data Act provides specific obligations for data holders when they are obliged to make
data available to a data recipient. Among other things, data shall be made available under fair, reasonable, and non-discriminatory terms and conditions, in a transparent manner, and with a reasonable compensation to be agreed upon. The Data Act also includes specific provisions to facilitate switching between data processing services. 3.4 Regulators and Enforcement The HDPA is responsible for applying and enforcing the Data Act in Greece regarding the protection of personal data. The use of cookies is governed by Law 3471/2006 and Recommendation 1/2020 of the HDPA. The basic requirement for the use of cookies is the prior informed consent of the subscriber or user of the terminal equipment. More specifically: • the consent requires a clear positive act (“opt-in”) and cannot be inferred (ie, prese - lected cookies, inferred acceptance by scroll - ing); and • consent must be given after the appropriate information of the subscriber or user, includ - ing the purpose of processing each cookie separately, the term of operation, the identity of the data controller, and the data recipients or categories of recipients. 4. Sectoral Issues 4.1 Use of Cookies As an exception to the above, prior informed consent is not required for cookies, which are technically necessary to connect to the website or obtain the internet service requested by the subscriber or user, for example:
156 CHAMBERS.COM
Powered by FlippingBook