GreeceLaw 4624/2019, Greek GDPR Implementation Law (Nomos 4624/2019, N. 4624/2019)
Law 4624/2019, FEK A' 137/29-08-2019
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Greece, including data collected by crawling.
- Where an employee's consent is used by way of exception as the legal basis for processing the employee's personal data in Greece, take into account the employee's dependence under the contract of employment and the circumstances in which consent was given, and give the consent in writing or electronically, clearly distinguishable from the contract of employment (Law 4624/2019, Article 27(2)).
These lines are LexLint's reading of the law's text. Also read by: Case C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums, judgment of the Court of Justice of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0034
- Case citation
- Case C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums, judgment of the Court of Justice of (First Chamber)
- Open questions
- Does Article 27(1) of Law 4624/2019, which permits processing of employees' personal data where strictly necessary for the contract of employment, contain the 'suitable and specific measures' that Article 88(2) of Regulation (EU) 2016/679 requires of a national 'more specific rule', or does it only repeat the Regulation, which Case C-34/21 holds such a rule may not do?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record, Decision basis, Data lineage
Log retention
Logs are deleted at the end of the year following the year in which they were created, so a log is kept for at least one and at most two years.
- Unit
- Years
- As of
- Basis
- Fixed
- Maximum value
- 2
Logging duty
Articles 68 and 74 are in Chapter D, which transposes Directive (EU) 2016/680 and applies under Article 43 to processing by public authorities competent for the prevention, investigation, detection or prosecution of criminal offences, the execution of criminal penalties and the prevention of threats to public security. Article 74 requires the controller and processor to keep logs of collection, alteration, consultation, disclosure including transfers, combination and erasure. For consultation and disclosure the log must make it possible to establish the justification, the date and time, as far as possible who consulted or disclosed, and who received the data. The logs may be used only to verify lawfulness, for self-monitoring, to ensure integrity and security, and in criminal proceedings, and are deleted at the end of the year after the year they were created (between one and two years). Article 68 requires a written record of processing activities. Both must be made available to the Authority on request. The private-sector provisions this row summarizes (Articles 21 and 27) set no record duty of their own.
- Kind
- Explicit
- As of
- Provision
- Law 4624/2019, Articles 74 and 68
- Trigger
- personal_data_processing
What this law does
Greece's private-sector regime is the General Data Protection Regulation (GDPR) plus Law 4624/2019 (Greek: Nomos 4624/2019), FEK A' 137/29-08-2019, in force from publication on , which supplies domestic derogations and procedural rules, including an employment article (Article 27) narrowing consent as a lawful basis for employee data processing and separately regulating workplace video surveillance. The Hellenic Data Protection Authority (HDPA) is the supervisory authority.
Article 21(1) of the Law provides that, for information society services offered directly to a minor, processing on the basis of consent is lawful where the minor is at least 15 years old. Article 27(2) of the Law provides that, where an employee's consent is used by way of exception as the legal basis, the employee's dependence under the contract of employment and the circumstances in which consent was given are to be taken into account in deciding whether it was freely given.
When LexLint raises it
When your app profile says your app crawls the web or processes personal data.
Back to the example · Lint your app
Page updated .