Duty LXD-0933
Processes personal data, in Greece
Hellenic Statistical System Law 3832/2010, statistical confidentiality and anonymous disseminationsince 3 lines
Law 3832/2010 (Hellenic Statistical System), Arts. 7(3)-(4), 8(1) and 9(2) · Read the law's page
- If you are the Hellenic Statistical Authority (ELSTAT) or another body of the Hellenic Statistical System, keep a public file of individual statistical data only from records that have been made anonymous, so that the statistical unit cannot be identified directly or indirectly by any means a third party could use (Law 3832/2010 Article 7(3)).
- If you are a body of the Hellenic Statistical System in Greece, disseminate statistical results that could allow a statistical unit to be identified only after modifying them so that dissemination does not breach statistical confidentiality, or with the unit's unreserved consent (Article 7(4)).
- If you are a body of the Hellenic Statistical System in Greece, do not publish confidential statistical data, and take preventive measures so that individual statistical units cannot be identified by technical or other means that third parties could reasonably use (Article 8(1)).
GDPR Articles 33-34, Breach Notification in Greecesince 3 lines
Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page
- Notify the Hellenic Data Protection Authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Greece, unless the breach is unlikely to risk their rights and freedoms.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.
GDPR Chapter V, Cross-Border Transfer of Personal Data from Greecesince 1 line
Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page
- Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Greece outside the European Economic Area.
GDPR Articles 82-83 and HDPA Enforcement in Greecesince 1 line
Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.
Law 4624/2019 Article 30, anonymisation and pseudonymisation of research and statistical datasince 3 lines
Law 4624/2019, Art. 30(3)-(4) · Read the law's page
- If you process special categories of personal data in Greece for scientific or historical research or for statistics, anonymise them as soon as those purposes allow, unless that is contrary to the legitimate interest of the data subject (Law 4624/2019 Article 30(3)).
- Until the data are anonymised, store separately the characteristics that can be used to match individual details to an identified or identifiable person, and combine them with the individual details only where research or statistical purposes require it (Article 30(3)).
- If you publish personal data processed in research without the written consent of the data subjects, publish only what is necessary to present the results, and pseudonymise the results before publishing them (Article 30(4)).
Law 4624/2019, Greek GDPR Implementation Law (Nomos 4624/2019, N. 4624/2019)since 2 lines
Law 4624/2019, FEK A' 137/29-08-2019 · Read the law's page
- Establish a GDPR Article 6 lawful basis before processing personal data of a person in Greece, including data collected by crawling.
- Where an employee's consent is used by way of exception as the legal basis for processing the employee's personal data in Greece, take into account the employee's dependence under the contract of employment and the circumstances in which consent was given, and give the consent in writing or electronically, clearly distinguishable from the contract of employment (Law 4624/2019, Article 27(2)).
GDPR Articles 12-21 and Law 4624/2019 Article 27, Data Subject Rights and Employment in Greecesince 2 lines
Regulation (EU) 2016/679, Arts. 12-21; Law 4624/2019, Art. 27(2), (7) · Read the law's page
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Greece within one month of receipt.
- Inform employees in Greece in writing or electronically of the installation and operation of closed circuit television in the workplace, which is permitted only where necessary for the protection of persons and goods (Law 4624/2019, Article 27(7)).