GreeceGDPR Articles 12-21 and Law 4624/2019 Article 27, Data Subject Rights and Employment in Greece
Regulation (EU) 2016/679, Arts. 12-21; Law 4624/2019, Art. 27(2), (7)
In force since .
A data subject rights rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Greece within one month of receipt.NIST Privacy FrameworkCT.PO-P3
- Inform employees in Greece in writing or electronically of the installation and operation of closed circuit television in the workplace, which is permitted only where necessary for the protection of persons and goods (Law 4624/2019, Article 27(7)).NIST Privacy FrameworkCM.AW-P1
These lines are LexLint's reading of the law's text. Also read by: Case C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums, judgment of the Court of Justice of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0034
- Case citation
- Case C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums, judgment of the Court of Justice of (First Chamber)
- Open questions
- Does Article 27 of Law 4624/2019 contain the 'suitable and specific measures' that Article 88(2) of Regulation (EU) 2016/679 requires of a national 'more specific rule', as Case C-34/21 requires?
- Which circumstances, besides the employee's dependence set out in the contract of employment, show that an employee's consent was not 'freely given' under Article 27(2) of Law 4624/2019, which lists the factors only as matters to be taken into account 'in particular'?
What it makes you log
Logging duty
GDPR Articles 12 to 21 and Article 27 of the Law set how and when a controller answers a rights request, and what an employer tells employees about consent and workplace CCTV. They state no duty to create, keep or produce a log or record. Article 33(2) of the Law, which this row does not cite, requires the grounds for refusing information to a data subject to be documented.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Articles 12 to 21 apply in Greece. Article 27(2) of Law 4624/2019 makes an employee's consent a lawful basis for processing their data only by way of exception, judged mainly by the employee's dependence under the contract of employment and the circumstances in which consent was given.
Article 27(7) permits closed circuit television in the workplace only where necessary for the protection of persons and goods, bars using the data as a criterion for assessing employee performance, and requires the employees to be informed in writing or electronically of its installation and operation.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .