[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fU0KGN6sjZEaivxc_0rG-0V15oJg_EQwQOVXatCRxOPY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"d555f71d-c2b6-48c6-9b42-14fb0c7fb5d7","greek-dpa-rejects-child-abuse-protocol-for-gdpr-non-compliance","24dfd244-1f6b-44a2-b9fa-2c74bd0a2d98","Greek DPA Rejects Child Abuse Protocol for GDPR Non-Compliance","The Hellenic Data Protection Authority found that a proposed ministerial protocol requiring healthcare professionals to photograph and transfer images of suspected child abuse injuries to law enforcement lacked a sufficient legal basis and failed to meet core GDPR requirements. Critically, no Data Protection Impact Assessment (DPIA) was conducted before drafting the decision, despite the clearly high-risk nature of processing sensitive data relating to children and criminal matters. This case illustrates that even well-intentioned public health and safety initiatives must be grounded in proper legal frameworks and privacy-by-design principles from the outset. Failure to engage data protection authorities and conduct required assessments early in policy development wastes resources and delays legitimate child protection goals.","**Immediate actions:**\n- Halt or revise any draft policy or protocol that processes sensitive or special-category personal data until a full DPIA is completed and documented.\n- Engage the relevant Data Protection Authority (DPA) for prior consultation before finalising any high-risk data processing decisions as required under GDPR Article 36.\n\n**Policy and legal foundation:**\n- Establish a clear statutory legal basis for every data processing activity in public sector protocols, explicitly mapping each processing operation to a GDPR Article 6 and Article 9 lawful basis.\n- Embed privacy-by-design and privacy-by-default principles (GDPR Article 25) into the drafting process for all ministerial decisions that involve personal data.\n- Define and enforce technical and organisational security measures (encryption, access controls, secure transfer channels) for any protocol mandating transfer of sensitive imagery to third parties.\n\n**Long-term improvements:**\n- Implement a mandatory data protection review checklist that all ministerial and legislative drafting teams must complete before any decision involving personal data is circulated for approval.\n- Establish ongoing training for public sector legal and policy teams on GDPR obligations, DPIA triggers, and the role of the DPA in the legislative process.",[12,13,14,15,16,17,18],"GDPR Article 32","GDPR Article 35","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 14: Security Awareness and Skills Training","ISO\u002FIEC 27001:2022 Clause 7.2: Competence",{"GDPR Article 32":20,"GDPR Article 35":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":23,"CIS Control 14: Security Awareness and Skills Training":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"The HDPA explicitly found the protocol failed to meet Article 32's requirement for appropriate technical and organisational measures to ensure security and integrity of the sensitive data being transferred to law enforcement.","A Data Protection Impact Assessment was legally required given the high-risk processing of children's sensitive medical imagery, yet none was performed before the protocol was drafted, a direct violation cited by the HDPA.","A structured review cycle for policy and system flaws, applied to the draft protocol, would have surfaced the missing legal basis and absent DPIA before the decision reached the DPA for opinion.","Ensuring that staff responsible for drafting data-processing protocols possess verified competence in data protection requirements would have prevented the submission of a non-compliant ministerial decision.","Inadequate understanding of GDPR obligations among policy drafters contributed to the omission of the DPIA and legal basis analysis; targeted training for public sector teams on data protection law would reduce such gaps.","Establishing formal processes to assess risks in data handling practices — analogous to vulnerability management — would have identified the legal and security gaps in the protocol before submission.","The protocol lacked defined access control measures governing who could receive and store sensitive child injury photographs, a gap that privacy-by-design and access governance frameworks directly address.","published","2026-10-19T10:20:45.119489+00:00","2026-10-19T10:20:45.064+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_Opinion_11\u002F2026&diff=53449&oldid=53448","hdpa-greece-opinion-11-2026-5a3de8","HDPA (Greece) - Opinion 11\u002F2026",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]