GDPR: Complaint against Greece to the European Commission for personal data

Η Homo digitalis, the first Non-governmental organization in Greece on the protection of human rights in the digital age, submitted on 30 May, complaint to the European Commission for non-compliance of Greece with EU personal data law (Directive 2016/680 and GDPR).

ΠIn particular, the complaint concerns Directive 2016/680, which regulates the processing of personal data by national law enforcement authorities for the purposes of preventing, investigating, detecting or prosecuting criminal offenses or the execution of criminal sanctions.

Pursuant to Article 63 thereof, Member States shall adopt and publish, by 6 May 2018 at the latest, the laws, regulations and administrative provisions necessary to comply with this Directive, and shall forthwith communicate to the European Commission the text of those provisions. . However, Greece has not yet adopted these legislative provisions, one year and twenty-four days after the expiration of this deadline. It therefore violates Article 63 thereof.

Furthermore, the complaint also raises issues concerning Regulation 2016/679 (GDPR). Homo Digitalis emphasizes that despite the fact that the GDPR is binding on all EU Member States and is directly applicable in each of them from 25.05.2018, the European Legislator has left important issues to the discretion of the Greek legislator. These issues include, for example, the lower age limit for a child to consent to information society services (Article 8), the provision of further terms and restrictions regarding the processing of genetic data, biometric data or health data ( Article 9), the right of NGOs, regardless of any assignment of the data subject, to file a complaint and to exercise the rights referred to in Articles 78 and 79 of the GDPR (Article 80), penalties for infringements not subject to administrative fines (Article 84 ), the processing of employees' personal data in the context of their employment (Article 88), and confidentiality obligations (Article 90).

Greece does not have until today - one year and five days after the implementation of the provisions of the GDPR - an implementing law, which regulates the above issues, which on the one hand creates insecurity for data subjects and citizens in general, regarding the protection of their rights, and on the other hand confusion on the specific issues that need immediate regulation. The European Commission will process the complaint of Homo Digitalis within twelve months and will inform about its progress.

Source