GREECE Law and Practice Contributed by: Natasha Mezini, Lambros Katsiamagkos and Jenny Georgountzou, Psarras, Georgountzou, Gavrilis - GKP Law Firm
interest of the data subject between the data controller and another natural or legal person; • the transfer is necessary for important rea - sons of public interest; • the transfer is necessary for the establish - ment, exercise or defence of legal claims; • the transfer is necessary to protect the vital interests of the data subject or of other per - sons where the data subject is physically or legally incapable of giving consent; or • the transfer is made from a register which, according to EU or member state law, is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate a legitimate interest, but only to the extent that the conditions laid down by EU or member state law for consul - tation are fulfilled in the particular case. Transfers of Personal Data by Public Authorities Law 4624/2019 transposes Directive (EU) 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or pros - ecution of criminal offences or the execution of criminal penalties and on the free movement of such data. Article 75 Law 4624/2019 sets out the following additional requirements: • the recipient authority or international organi - sation is competent for the purposes of the prevention, investigation, detection or pros - ecution of criminal offences or the execution of criminal penalties; and • the European Commission has adopted an adequacy decision, meaning that the non-EU state in question provides adequate protec -
tion for personal data, or in the absence of an adequacy decision, appropriate safeguards have been provided, or in the absence of such appropriate safeguards, one of the fol - lowing specific derogations applies: (a) the transfer is necessary to protect the vital interests of the data subject or another person; (b) the transfer is necessary to safeguard the legitimate interests of the data subject; (c) the transfer is necessary for the preven - tion of an immediate and serious threat to public safety; or (d) the transfer is necessary in certain indi - vidual cases. The prior authorisation of the competent data protection authority of the EU member state is required. Exceptionally, such prior authorisation may be omitted if the transfer of personal data is necessary to prevent an immediate and serious threat to the public safety of a member state or a non-EU country, and the prior authorisation cannot be obtained in a timely manner. The transfer of personal data is not permitted, despite the existence of an adequacy decision and the need to safeguard the public interest, if the protection of the fundamental rights and interests of the data subject cannot be ensured in the specific case. The data controller assess - es the level that would ensure the protection of the above rights of the data subject based on the guarantees for the protection of the personal data offered by the recipient authority or inter - national organisation of the personal data in the non-EU country. 5.2 Government Notifications and Approvals Transfers of personal data to an EU Member State, a third country or an international organi -
160 CHAMBERS.COM
Powered by FlippingBook