[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fT3tIL-Uj1ZXg1dbOFMfMUDpnKVA2OMsL0KKyjTbt5Ck":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":53},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"24dfd244-1f6b-44a2-b9fa-2c74bd0a2d98","HDPA (Greece) - Opinion 11\u002F2026","hdpa-greece-opinion-11-2026-5a3de8","← Older revision Revision as of 09:03, 19 October 2026 Line 120: Line 120: When the HDPA questioned whether the existing legislative delegation legally permitted imposing obligations on entities beyond forensic services, the Ministry pointed to a legislative amendment allowing joint decisions with co-competent Ministers. However, the text submitted to the HDPA remained formulated solely as a decision of the Minister of Justice. Consequently, the Authority assessed whether the proposed processing operations complied with the fundamental requirement of an adequate statutory legal basis under both EU data protection law and Greek constitutional requirements. When the HDPA questioned whether the existing legislative delegation legally permitted imposing obligations on entities beyond forensic services, the Ministry pointed to a legislative amendment allowing joint decisions with co-competent Ministers. However, the text submitted to the HDPA remained formulated solely as a decision of the Minister of Justice. Consequently, the Authority assessed whether the proposed processing operations complied with the fundamental requirement of an adequate statutory legal basis under both EU data protection law and Greek constitutional requirements. === Holding === === Holding === The HDPA issued a negative opinion on the draft decision, concluding as follows: The HDPA issued a negative opinion on the draft decision, concluding as follows: Line 132: Line 129: Third, the proposed framework fails to satisfy Articles 25 and 32 GDPR as it does not explicitly ban the use of doctors' personal mobile devices, misses requirements for dedicated authorized devices and immediate encrypted storage, lacks cryptographic hashing to guarantee evidentiary integrity, and permits printed paper circulations that increase data leakage risks. Third, the proposed framework fails to satisfy Articles 25 and 32 GDPR as it does not explicitly ban the use of doctors' personal mobile devices, misses requirements for dedicated authorized devices and immediate encrypted storage, lacks cryptographic hashing to guarantee evidentiary integrity, and permits printed paper circulations that increase data leakage risks. Fourth, pursuant to [[Article 35 GDPR|Article 35 GDPR]], a formal Data Protection Impact Assessment is strictly mandatory before implementation, given that the processing involves the systematic handling of special categories of data of vulnerable data subjects. Fourth, pursuant to [[Article 35 GDPR]], a formal Data Protection Impact Assessment is strictly mandatory before implementation, given that the processing involves the systematic handling of special categories of data of vulnerable data subjects. == Comment == == Comment == ''Share your comments here!'' ''Share your comments here!''","The Hellenic Data Protection Authority (HDPA) issued a negative opinion on a draft Ministerial Decision concerning a child abuse protocol. The protocol would require healthcare professionals to photograph suspected child abuse injuries and transfer them to law enforcement. The HDPA found that the draft decision lacked an adequate statutory legal basis, failed to meet GDPR requirements for data security and integrity (Articles 25 and 32), and mandated a Data Protection Impact Assessment (Article 35) which was not performed.","Greek DPA issues negative opinion on draft child abuse protocol due to GDPR non-compliance.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_Opinion_11\u002F2026&diff=53449&oldid=53448","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-10-19T09:03:29+00:00","2026-10-19T10:00:04.561297+00:00",7,[17,20],{"name":18,"type":19},"HDPA","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38,43],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":40,"icon":25,"name":41,"slug":42},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":44},{"id":45,"icon":25,"name":46,"slug":47},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":51,"vendors":52},[],[],{"slug":54,"title":55,"body":56,"framework_refs":57,"framework_notes":65},"greek-dpa-rejects-child-abuse-protocol-for-gdpr-non-compliance","Greek DPA Rejects Child Abuse Protocol for GDPR Non-Compliance","The Hellenic Data Protection Authority found that a proposed ministerial protocol requiring healthcare professionals to photograph and transfer images of suspected child abuse injuries to law enforcement lacked a sufficient legal basis and failed to meet core GDPR requirements. Critically, no Data Protection Impact Assessment (DPIA) was conducted before drafting the decision, despite the clearly high-risk nature of processing sensitive data relating to children and criminal matters. This case illustrates that even well-intentioned public health and safety initiatives must be grounded in proper legal frameworks and privacy-by-design principles from the outset. Failure to engage data protection authorities and conduct required assessments early in policy development wastes resources and delays legitimate child protection goals.",[58,59,60,61,62,63,64],"GDPR Article 32","GDPR Article 35","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 14: Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 Clause 7.2: Competence",{"GDPR Article 32":66,"GDPR Article 35":67,"NIST SP 800-53 SI-2: Flaw Remediation":68,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":69,"CIS Control 14: Security Awareness and Skills Training":70,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":71,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":72},"The HDPA explicitly found the protocol failed to meet Article 32's requirement for appropriate technical and organisational measures to ensure security and integrity of the sensitive data being transferred to law enforcement.","A Data Protection Impact Assessment was legally required given the high-risk processing of children's sensitive medical imagery, yet none was performed before the protocol was drafted, a direct violation cited by the HDPA.","A structured review cycle for policy and system flaws, applied to the draft protocol, would have surfaced the missing legal basis and absent DPIA before the decision reached the DPA for opinion.","Ensuring that staff responsible for drafting data-processing protocols possess verified competence in data protection requirements would have prevented the submission of a non-compliant ministerial decision.","Inadequate understanding of GDPR obligations among policy drafters contributed to the omission of the DPIA and legal basis analysis; targeted training for public sector teams on data protection law would reduce such gaps.","Establishing formal processes to assess risks in data handling practices — analogous to vulnerability management — would have identified the legal and security gaps in the protocol before submission.","The protocol lacked defined access control measures governing who could receive and store sensitive child injury photographs, a gap that privacy-by-design and access governance frameworks directly address."]