Today, on 30.05.2019, our organisation lodged a complaint (reference number CHAP201901564) before the European Commission against Greece for non-compliance with the EU law on the protection of personal data (Directive 2016/680 and GDPR).

The complaint is related to Directive 2016/680, which regulates the processing of personal data by the national law enforcement authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. According to article 63 of this Directive, Member States shall adopt and publish, by 6 May 2018, the laws, regulations and administrative provisions necessary to comply with this Directive. They shall forthwith notify to the Commission the text of those provisions.

However, Greece has not transposed and adopted such law provisions yet, one year and twenty four days after the end of this deadline. Therefore, Greece breaches the mentioned Article 63

The provisions of the Directive 2016/680 are of the utmost importance for the protection of Democracy and the Rule of Law, as they provide a high level of protection for data subject’s rights against the processing of such data by the police or other national law enforcement authorities. This Directive replaces a very poor legal framework, the Council Framework Decision 2008/977/JHA, which unfortunately had an extremely limited scope (cross-border data exchange between the law enforcement authorities of Member States) and was not striking the right balance between law enforcement authorities’ needs in the course of their investigations and the rights of the people that are at the center of these investigations. As a result the legal principles around the processing of personal data were not respected and data subjects’ rights were noticeably weakened. 

Thereby, for the first time, a single European framework that regulates the way the policeman of the neighbouring department, the border guard etc. can process our personal data and clearly provides how we shall exercise our rights to the police or other law enforcement authorities. You can find further information on the Directive 2016/680 here.

Greece by delaying the proceedings of such legislation and the adoption of the necessary provisions at a Member State level deprive data subjects and Greeks from their rights, as enshrined in the paragraphs 12-18 of the Directive, while creates concerns about citizens’ trust in the ways the law enforcement authorities treat their personal data. Specifically, the non transposition of the provisions concerning data protection by design or by default, the non keeping of the records of processing activities, etc. decrease public’s trust concerning the lawful processing of their personal data operated by these authorities.

Furthermore, the complaint raises issues related to the Regulation 2016/679 (GDPR). Specifically, our organisation highlights that despite the fact that GDPR shall be binding in its entirety and directly applicable in all member states, by 25.05.208, the European legislator has transferred important issues at the discretion of Greek legislator. These latter issues are related to the i.e. the minimum age for child’s consent in relation to information society services (article 8), provision for further conditions and restrictions on the processing of genetic and biometric data or data concerning health (article 9), NGO’s right independently of any data subject’s award to lodge a complaint and exercise the rights referred to articles 78 and 79 GDPR (Article 80), penalties for infringements which are not subject to administrative fines (Article 84), the processing of employees’ personal data in the course of their employment (Article 88), and obligations concerning confidentiality (Article 90).

Therefore, Greece without having up to date – one year and five days after the enforcement of GDPR– draft law, creates uncertainty to data subjects and Greeks with regard to the protection of their rights and confusion about the specific issues as mentioned above which are in need of direct implementation.

European Commission will process our complaint within the period of twelve months and will inform us οn its progress.

You can find the proof of our submitted complaint and its full text here. Finally, you can see our organisation’s press release here.