[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fk_Wr3_DB1FwI4Jx4VnCInGy5xWrEKEU2D3uB37rplhM":3},{"article":4,"iocs":40,"watch_terms":41,"solutions":42,"lesson":45},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"50eeb908-53b1-450e-8ac6-2e406315f0f0","HDPA (Greece) - Opinion 11\u002F2026","hdpa-greece-opinion-11-2026-255795","← Older revision Revision as of 14:14, 27 October 2026 Line 112: Line 112: }} }} The DPA issued a negative opinion on a draft Ministerial Decision (Child Abuse Protocol) mandating that healthcare professionals photograph suspected child abuse injuries and transfer the material to law enforcement. The DPA issued a negative opinion on a draft Ministerial Decision (Child Abuse Protocol) mandating healthcare professionals to photograph suspected child abuse injuries and transfer the material to law enforcement. == English Summary == == English Summary ==","The Hellenic Data Protection Authority (HDPA) has issued a negative opinion on a draft Ministerial Decision concerning child abuse cases. The protocol would have mandated healthcare professionals to photograph suspected injuries on minors and transfer these images to law enforcement. The HDPA found that the draft lacked a sufficient legal basis under GDPR and Greek constitutional law to impose such obligations on healthcare providers and also violated data minimization principles.","Greece's DPA issues negative opinion on child abuse protocol requiring photos of minors.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_Opinion_11\u002F2026&diff=53530&oldid=53495","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-10-27T14:14:34+00:00","2026-10-27T15:00:12.029219+00:00",7,[17,20],{"name":18,"type":19},"HDPA","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":39},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":43,"vendors":44},[],[],{"slug":46,"title":47,"body":48,"framework_refs":49,"framework_notes":57},"hdpa-rejects-child-abuse-photo-protocol-for-gdpr-violations","HDPA Rejects Child Abuse Photo Protocol for GDPR Violations","The Hellenic Data Protection Authority blocked a proposed protocol that would have required healthcare professionals to photograph injuries on minors and share those images with law enforcement, citing an insufficient legal basis under GDPR and Greek constitutional law. The core failure was that policymakers attempted to legislate a sensitive data-processing workflow without first establishing the robust legal and ethical foundation required for processing special-category data involving children. This matters because even well-intentioned public health or law enforcement initiatives must be grounded in clear, proportionate legal authority before imposing data-sharing obligations on third parties. The data minimization principle under GDPR was also violated, as compulsory photography and transfer of images went beyond what was strictly necessary to achieve the stated protective aim.",[50,51,52,53,54,55,56],"GDPR Article 32","GDPR Article 9","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"GDPR Article 9":58,"GDPR Article 32":59,"NIS2 Article 21(2)(b)":60,"NIST SP 800-53 SI-2: Flaw Remediation":61,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":62,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":63,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":64},"Photographs of injuries on minors constitute special-category health data; Article 9 demands an explicit and sufficient legal basis for processing such data, which the HDPA found was absent in the draft protocol.","The draft lacked appropriate technical and organisational safeguards for processing sensitive health and child-protection data, which Article 32 requires to be in place before any such processing begins.","NIS2 requires incident-handling and data-sharing procedures to be proportionate and legally sound; the same proportionality test that invalidated this protocol applies to any cross-sector data-sharing obligation imposed on healthcare entities.","While not a technical flaw, the legislative 'flaw' of omitting a lawful basis mirrors SI-2's principle of identifying and correcting deficiencies before deployment — here the deficiency was legal rather than technical and should have been remediated in the drafting phase.","Policymakers and healthcare professionals involved in designing the protocol required demonstrated competence in GDPR obligations for special-category data, which would have surfaced the legal basis problem during drafting.","ISO 27001's broader risk-treatment philosophy requires organisations to assess and address gaps in lawful processing authority as a governance vulnerability before rolling out new data-processing activities.","The framework's Protect function demands that access to sensitive personal data — such as images of injured children — is governed by defined roles and authorisation policies, none of which were adequately established in the proposed protocol."]