HDPA Rejects Child Abuse Photo Protocol for GDPR Violations
Written by AI from the linked story. Not reviewed by an editor. How this works
The Hellenic Data Protection Authority blocked a proposed protocol that would have required healthcare professionals to photograph injuries on minors and share those images with law enforcement, citing an insufficient legal basis under GDPR and Greek constitutional law. The core failure was that policymakers attempted to legislate a sensitive data-processing workflow without first establishing the robust legal and ethical foundation required for processing special-category data involving children. This matters because even well-intentioned public health or law enforcement initiatives must be grounded in clear, proportionate legal authority before imposing data-sharing obligations on third parties. The data minimization principle under GDPR was also violated, as compulsory photography and transfer of images went beyond what was strictly necessary to achieve the stated protective aim.
Tactical Insight
Policy and Legal Design
- Conduct a Data Protection Impact Assessment (DPIA) before drafting any protocol that mandates processing of sensitive or special-category personal data.
- Engage Data Protection Authorities (DPAs) in early consultation to validate the legal basis and proportionality of proposed data-sharing obligations.
Data Minimization and Purpose Limitation
- Restrict data collection to only what is strictly necessary for the stated purpose, explicitly documenting why less intrusive alternatives were considered and rejected.
- Define clear retention, access, and deletion rules for any sensitive data collected under public-interest protocols before the protocol is enacted.
Governance and Accountability
- Establish a cross-functional review board (legal, medical ethics, data protection) to evaluate any new inter-agency data-sharing initiative involving vulnerable populations.
- Train healthcare professionals on their rights and obligations under GDPR before imposing new data-processing duties on them via ministerial decree.