[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwtG_oK8jPAkFkc0dQ3J9XSgt6mB-cSqsj5H9VFZZifM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"aceba840-f6e6-49e2-8992-b5096b78d5fc","hdpa-rejects-child-abuse-photo-protocol-for-gdpr-violations","50eeb908-53b1-450e-8ac6-2e406315f0f0","HDPA Rejects Child Abuse Photo Protocol for GDPR Violations","The Hellenic Data Protection Authority blocked a proposed protocol that would have required healthcare professionals to photograph injuries on minors and share those images with law enforcement, citing an insufficient legal basis under GDPR and Greek constitutional law. The core failure was that policymakers attempted to legislate a sensitive data-processing workflow without first establishing the robust legal and ethical foundation required for processing special-category data involving children. This matters because even well-intentioned public health or law enforcement initiatives must be grounded in clear, proportionate legal authority before imposing data-sharing obligations on third parties. The data minimization principle under GDPR was also violated, as compulsory photography and transfer of images went beyond what was strictly necessary to achieve the stated protective aim.","**Policy and Legal Design:**\n- Conduct a Data Protection Impact Assessment (DPIA) before drafting any protocol that mandates processing of sensitive or special-category personal data.\n- Engage Data Protection Authorities (DPAs) in early consultation to validate the legal basis and proportionality of proposed data-sharing obligations.\n\n**Data Minimization and Purpose Limitation:**\n- Restrict data collection to only what is strictly necessary for the stated purpose, explicitly documenting why less intrusive alternatives were considered and rejected.\n- Define clear retention, access, and deletion rules for any sensitive data collected under public-interest protocols before the protocol is enacted.\n\n**Governance and Accountability:**\n- Establish a cross-functional review board (legal, medical ethics, data protection) to evaluate any new inter-agency data-sharing initiative involving vulnerable populations.\n- Train healthcare professionals on their rights and obligations under GDPR before imposing new data-processing duties on them via ministerial decree.",[12,13,14,15,16,17,18],"GDPR Article 32","GDPR Article 9","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)",{"GDPR Article 9":20,"GDPR Article 32":21,"NIS2 Article 21(2)(b)":22,"NIST SP 800-53 SI-2: Flaw Remediation":23,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"Photographs of injuries on minors constitute special-category health data; Article 9 demands an explicit and sufficient legal basis for processing such data, which the HDPA found was absent in the draft protocol.","The draft lacked appropriate technical and organisational safeguards for processing sensitive health and child-protection data, which Article 32 requires to be in place before any such processing begins.","NIS2 requires incident-handling and data-sharing procedures to be proportionate and legally sound; the same proportionality test that invalidated this protocol applies to any cross-sector data-sharing obligation imposed on healthcare entities.","While not a technical flaw, the legislative 'flaw' of omitting a lawful basis mirrors SI-2's principle of identifying and correcting deficiencies before deployment — here the deficiency was legal rather than technical and should have been remediated in the drafting phase.","Policymakers and healthcare professionals involved in designing the protocol required demonstrated competence in GDPR obligations for special-category data, which would have surfaced the legal basis problem during drafting.","ISO 27001's broader risk-treatment philosophy requires organisations to assess and address gaps in lawful processing authority as a governance vulnerability before rolling out new data-processing activities.","The framework's Protect function demands that access to sensitive personal data — such as images of injured children — is governed by defined roles and authorisation policies, none of which were adequately established in the proposed protocol.","published","2026-10-27T15:21:48.535429+00:00","2026-10-27T15:21:48.495+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_Opinion_11\u002F2026&diff=53530&oldid=53495","hdpa-greece-opinion-11-2026-255795","HDPA (Greece) - Opinion 11\u002F2026",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]