HDPA (Greece) - Opinion 11/2026
Greece's DPA issues negative opinion on child abuse protocol requiring photos of minors.
The Hellenic Data Protection Authority (HDPA) has issued a negative opinion on a draft Ministerial Decision concerning child abuse cases. The protocol would have mandated healthcare professionals to photograph suspected injuries on minors and transfer these images to law enforcement. The HDPA found that the draft lacked a sufficient legal basis under GDPR and Greek constitutional law to impose such obligations on healthcare providers and also violated data minimization principles.
AI summary of the linked source. Not reviewed by an editor. How this works
Run HDPA?
Get an email when a new story names HDPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Hellenic Data Protection Authority blocked a proposed protocol that would have required healthcare professionals to photograph injuries on minors and share those images with law enforcement, citing an insufficient legal basis under GDPR and Greek constitutional law. The core failure was that policymakers attempted to legislate a sensitive data-processing workflow without first establishing the robust legal and ethical foundation required for processing special-category data involving children. This matters because even well-intentioned public health or law enforcement initiatives must be grounded in clear, proportionate legal authority before imposing data-sharing obligations on third parties. The data minimization principle under GDPR was also violated, as compulsory photography and transfer of images went beyond what was strictly necessary to achieve the stated protective aim.