GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou, Gavrilis - GKP Law Firm
• state clearly and precisely the identity of the sender; • state instructions for the recipient to object to and stop receiving further advertising com - munications; and • state their “commercial” nature in the mes - sage’s subject matter, if any. The HDPA has issued Guideline 2/2011 with examples and best practices for obtaining the The organisation and management of work and the observance of the employer’s legal obliga - tions require the processing of the employees’ personal data. Provisions applicable to process - ing employees’ personal data (included in the GDPR and Law 4624/2019) are outlined below. • Legal basis for the processing of personal data of employees: The legal basis for the processing of the personal data of the employees is the performance of the employ - ment contract (Article 6 par 1 (b) of the GDPR). The legal basis for the processing of special categories of employees’ personal data is the exercise of rights or the perfor - mance of legal obligations deriving from employment law, social security law and social protection law (Article 9 par 2 (a) of the GDPR). data subject’s consent electronically. 4.3 Employment Privacy Law • The legal basis of consent (Article 6 par 1 (a) of the GDPR) should be exceptionally used only when there is no other legal basis for the processing of personal data of employ - ees, taking into account the clear inequality between the data subject (employee) and the data controller (employer). • Legal principles for the processing of per - sonal data of employees: The basic legal prin - ciples governing the processing of personal
data, namely the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, and accuracy (Article 5 of the GDPR), also apply to the processing of personal data of employees. In the event that any of the above principles is breached, the processing should be considered illegal. • Prohibition of monitoring employees by CCTV: The processing of personal data of employees by means of closed-circuit visual recording systems (CCTV) at the workplace, whether publicly accessible or not, is permit - ted only if it is necessary for the protection of persons and property. Data collected through CCTV may not be used to assess employee efficiency and performance. Employees must be informed in advance in writing of the installation and operation of any CCTV system at the workplace. The HDPA has issued various guidelines and decisions on the processing of employees’ per - sonal data, including Guideline 115/2001 on the protection of employees’ personal data and Guidelines 1/2021 and 2/2020 on the protection of personal data in remote working (telework). 4.4 Transfer of Personal Data in Asset Deals Asset deals involve, in general, the sale and/or transfer of large volumes of personal data that are considered to constitute a separate asset. The law does not provide special requirements for asset deals; therefore, the requirements for transferring personal data also apply to asset deals. The HDPA, when asked by the First Instance Court whether the CD-ROM with the clients of a bankrupt company could be included in the bankruptcy assets and be legally divest - ed to a competitor of the bankrupt company, opined as follows: “ The transfer of the personal data of the clients of a company to another com -
158 CHAMBERS.COM
Powered by FlippingBook