Print   

Law 2472/1997

on the Protection of Individuals with regard to the Processing of Personal Data

(as amended)

CHAPTER A

GENERAL PROVISIONS

Article 1

Object

The object of this law is to establish the terms and conditions under which the processing of personal data is to be carried out so as to protect the fundamental rights and freedoms of natural persons and in particular their right to privacy.

Article 2

Definitions

For the purposes of this law:

Article 3

Scope

1. The provisions of this law shall apply to the processing, in whole or in part, by automatic means as well as to the processing by non-automatic means, of personal data which form part of a file or are intended to form part of a file.

2. The provisions of this law shall not apply to the processing of personal data, which is carried out by a natural person in the course of a purely personal or household activity.

3. The present law shall apply to any processing of personal data, provided that such processing is carried out:

CHAPTER B

PROCESSING OF PERSONAL DATA

Article 4

Characteristics of personal data

1. Personal data, in order to be lawfully processed, must be:

2. Personal data, which have been collected or are being processed in breach of the previous paragraph, shall be destroyed, such destruction being the Controller’s responsibility. The Authority, once such a breach is established, either ex officio or upon submission of a relevant complaint, shall order any such collection or processing ceased and the destruction of the personal data already collected or processed.

Article 5

Conditions of processing

1. Processing of personal data will be permitted only when the data subject has given his/her consent.

2. Exceptionally, data may be processed even without such consent, only if :

3. The Authority may issue special data processing rules for the more usual categories of data processing and files, which do not evidently affect the rights and freedoms of the persons to whom such data refer. These categories will be specified by regulations enacted by the Authority and ratified by Presidential Decrees, issued upon a proposal by the Minister of Justice.

Article 6

Notification

1. The Controller must notify the Authority in writing about the establishment and operation of a file or the commencement of data processing.

2. In the course of the aforementioned notification the Controller must necessarily declare the following:

3. The data referred to in the preceding paragraph will be registered with the Files and Data Processing Register kept by the Authority.

4. Any modification of the data referred to in paragraph 2 must be communicated in writing and without any undue delay by the Controller to the Authority.

[Case (a) of paragraph 2 of the present article was amended as above according to article 8 paragraph 1 of Law 2819/2000 (Official Gazette 84A/2000)

Case (i) [1] of paragraph 2 of the present article was abolished according to article 8 paragraph 2 of Law 2819/2000].

Article 7

Processing of sensitive data

1. The collection and processing of sensitive data is prohibited.

2. Exceptionally, the collection and processing of sensitive data, as well as the establishment and operation of the relevant file, will be permitted by the Authority, when one or more of the following conditions occur:

3. The Authority shall grant a permit for the collection and processing of sensitive data, as well as a permit for the establishment and operation of the relevant file, upon request of the Controller. Should the Authority ascertain that processing of sensitive data is carried out, the notification of the existence of such a file pursuant to article 6 of this law is considered to be a request for a permit. The Authority may impose terms and conditions for a more effective protection of the data subjects’ or third parties’ right to privacy. Before granting the permit, the Authority shall summon the Controller or his/her representative and the Processor to a hearing.

4. The permit will be issued for a specific period of time, depending on the purpose of the data processing. It may be renewed upon request of the Controller.

5. The permit shall necessarily contain the following:

6. A copy of the permit shall be registered with the Permits Register kept by the Authority.

7. Any change in the data referred to in paragraph 5 shall be communicated without undue delay to the Authority. Any change other than a change of address of the Controller or his/her representative shall entail the issuance of a new permit, provided that the terms and conditions stipulated by law are fulfilled.

[Case (c) of paragraph 2 of the present article was amended as above according to article 34 paragraph 1 of Law 2915/2001 (Official Gazette 109 A / 2001), case (e) of paragraph 2 of the present article was amended as above according to article 34 paragraph 2 of Law 2915/2001 and sub-case (cc) of case (e) of paragraph 2 of the present article was amended according to article 26 paragraph 4 of Law 3156/2003 (Official Gazette 157A/2003) and sub-case (dd) was added].

Article 7a

Exemption from the obligation to notify and receive a permit

1. The Controller is exempted from the obligation of notification, according to article 6, and the obligation to receive a permit, according to article 7 of the present Law in the following cases:

2. In every case of paragraph 1 of the present article, the Controller is subject to all obligations specified by the present law and is obliged to conform with any special processing rules issued by the Authority pursuant to article 5 paragraph 3 of the present law.

3. The deadlines referred to in paragraphs 1, 2 and 3 of article 24 of Law 2472/1997 are prolonged until January 21st 2001.

[Article 7a was added pursuant to article 8 paragraph 4 of Law 2819/2000 (Official Gazette 84A/2000).

Case (a) of paragraph 1 of the present article was amended as above according to article 34 paragraph 3 of Law 2915/2001.

Case (f) of paragraph 1 of the present article was added pursuant to article 10 of Law 3090/2002 (Official Gazette 329A/2002)].

Article 8

Interconnection of files

1. Interconnection of files is permitted only according to the terms and conditions set out in this article.

2. Every interconnection will be communicated to the Authority by means of a declaration jointly submitted by the Controllers or the Controller who interconnects two or more files serving different purposes.

3. If at least one of the files about to be interconnected contains sensitive data or if the interconnection results to the disclosure of sensitive data or if for the implementation of the interconnection a uniform code number is to be used, such an interconnection will be permitted only following a prior permit by the Authority (interconnection permit).

4. The interconnection permit referred to in the preceding paragraph may be granted upon a prior hearing of the Controllers of such files and shall necessarily include the following:

5. The interconnection permit may be renewed upon request of the Controllers.

6. The declarations referred to in paragraph 2 of this article, as well as any copies of the interconnection permits, shall be registered with the Interconnections Register kept by the Authority.

Article 9

Transboundary flow of personal data

1. The transfer of personal data to states of the European Union is permitted. The transfer, to a state non member of the European Union, of personal data which are undergoing processing or are intended for processing after transfer, shall be permitted only following a permit granted by the Authority. The Authority may grant such permit only if it deems that the country in question ensures an adequate level of protection. For this purpose it shall particularly take into account the nature of the data, the purpose and the duration of the processing, the relevant general and particular rules of law, the codes of conduct, the security measures for the protection of personal data, as well as the protection level in the countries of origin, transit and final destination of the data.

2. The transfer of personal data to a state non member of the European Union which does not ensure an adequate level of protection is exceptionally allowed only following a permit granted by the Authority, provided that one or more of the following conditions occur:

3. In the cases referred to in the preceding paragraphs, the Authority shall inform the European Commission and the respective Authorities of the other member-states, when it considers that a specific state does not ensure an adequate protection level.

Article 10

Confidentiality and security of processing

1. The processing of personal data shall be confidential. It shall be carried out solely and exclusively by persons acting under the authority of the Controller or the Processor and upon his/her instructions.

2. In order to carry out data processing the Controller must choose persons with corresponding professional qualifications providing sufficient guarantees in respect of technical expertise and personal integrity to ensure such confidentiality.

3. The Controller must implement appropriate organisational and technical measures to secure data and protect them against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access as well as any other form of unlawful processing. Such measures must ensure a level of security appropriate to the risks presented by processing and the nature of the data subject to processing. The Authority shall issue from time to time instructions as to the level of security of such data as well as on the protection measures necessary for each category of data in view of technological developments.

4. If the data processing is carried out on behalf of the Controller, by a person not dependent upon him, the relevant assignment must necessarily be in writing. Such assignment must necessarily provide that the Processor carries out such data processing only on instructions from the Controller and that all other obligations arising from this article shall mutatis mutandis be borne by him.

CHAPTER C

THE DATA SUBJECT'S RIGHTS

Article 11

Right to information

1. The Controller must, during the stage of collection of personal data, inform the data subject in an appropriate and express manner of the following data:

2. If the Controller, in order to collect personal data, requests the data subject's assistance, s/he must inform him specifically and in writing of the data referred to in paragraph 1 of this article as well as of his/her rights according to articles 11-13 of this law. By means of such notification the Controller shall also inform the data subject whether s/he is obliged to assist in the collection of data, on the basis of which provisions, as well as of any sanctions resulting from his/her failure to co-operate.

3. If the data are to be disclosed to third parties, the data subject will be kept informed of such disclosure before it is effected.

4. By virtue of a decision by the Authority, the obligation to inform, pursuant to paragraphs 1 and 3, may be lifted in whole or in part, provided that data processing is carried out for reasons of national security or for the detection of particularly serious crimes. In a state of emergency said obligation may be lifted by way of a provisional, immediately enforceable judgement by the President, who shall convene as soon as possible the Board in order that a final judgement on the matter may be issued.

5. Without prejudice to the rights arising from paragraphs 12 and 13, the right to inform does not exist when such collection is carried out solely for journalistic purposes and refers to public figures.

[Paragraph 4 of the present article was amended pursuant to article 34 paragraph 4 of Law 2915/2001 (Official Gazette 109A/2001)].

Article 12

Right to access

1. Everyone is entitled to know whether personal data relating to him are being processed or have been processed. As to this the Controller must answer in writing.

2. The data subject shall be entitled to request and obtain from the Controller, without undue delay and in an intelligible and express manner, the following information:

The data subject may exercise his/her right to access with the assistance of a specialist.

3. The right referred to in the preceding paragraph and the rights arising from article 13 are exercised by means of a relevant application to the Controller and the simultaneous payment of an amount of money, the amount of which, the method of payment as well as any other relevant matter will be regulated by a decision of the Authority. This amount will be returned to the applicant if his/her request to rectify or delete data is considered valid by the processor or the Authority, in case of an appeal before it. The Controller must in this case provide the applicant without undue delay, free of charge and in an intelligible form, a copy of the rectified part of the data relating to him.

4. Should the Controller not reply within a period of fifteen (15) days or should his/her answer be unsatisfactory, the data subject shall be entitled to appeal before the Authority. In the event the Controller refuses to satisfy the request of the party concerned, s/he must notify the Authority as to his/her response and inform the party concerned as to his/her right of appeal before it.

5. By virtue of a decision by the Authority, upon application by the Controller, the obligation to inform, pursuant to paragraphs 1 and 2 of the present article, may be lifted in whole or in part, provided that the processing of personal data is carried out on national security grounds or for the detection of particularly serious crimes. In this case the President of the Authority or his/her substitute carries out all necessary acts and has free access to the files.

6. Data pertaining to health matters will be communicated to the data subject by means of a medical doctor.

Article 13

Right to object

1. The data subject shall be entitled to object at any time to the processing of data relating to him. Such objections shall be addressed in writing to the Controller and must contain a request for a specific action, such as correction, temporary non-use, locking, non-transfer or deletion. The Controller must reply in writing to such objection within an exclusive deadline of fifteen (15) days. His/her response must advise the data subject as to the actions s/he carried out or, alternatively, as to the grounds for not acceding to his/her request. In case the objection is rejected, the relevant response must also be communicated to the Authority.

2. If the Controller does not respond within the specified time limit or his/her reply is unsatisfactory, then the data subject has the right to appeal before the Authority and request that his/her objections are examined. Should the Authority consider that such objections are reasonable and furthermore there is a risk of serious damage being caused to the data subject as a result of the processing, it may order the immediate suspension of the processing until a final decision on the objections is issued.

3. Any person shall be entitled to declare to the Authority that s/he does not wish data relating to him to be submitted to processing in order to promote the sale of goods or long distance services. The Authority shall keep a register for the identification of such persons. The Controllers of the relevant files must consult the said register prior to any processing and delete from their files the persons referred therein.

Article 14

Right to provisional judicial protection

1. Everyone is entitled to request from the competent court the immediate suspension or non-application of an act or decision affecting him, issued by an administrative authority or public law entity or private law entity or association or natural person solely on automated processing of data intended to evaluate his/her personality and especially his/her effectiveness at work, creditworthiness, reliability and general conduct.

2. The right referred to in this article may also be satisfied even when the other substantive conditions for provisional judicial protection, as stipulated from time to time, do not occur.

CHAPTER D

PERSONAL DATA PROTECTION AUTHORITY

Article 15

Establishment - Task - Legal Nature

1. A Personal Data Protection Authority (hereinafter: the Authority) is hereby created with the task to supervise the implementation of this law and all other regulations pertaining to the protection of individuals from the processing of personal data as well as to the exercise of the duties assigned to it each time.

2. The Authority constitutes an independent public authority and will be assisted by its own Secretariat. The Authority shall not be subject to any administrative control. In the course of their duties the members of the Authority shall enjoy personal and functional independence. The Authority reports to the Minister of Justice and its seat is in Athens.

3. All necessary appropriations for the operation of the Authority shall be entered in a special code which shall be integrated in the annual Budget of the Ministry of Justice. The authorizing officer for the expenditure is the President or his substitute.

[Paragraphs 2 and 3 were amended pursuant to article 13 paragraph 15 of Law 2703/1999 (Official Gazette 72A/1999)].

Article 16

Composition of the Authority

1. The Authority shall be composed of a judge of a rank corresponding at least to that of a Conseiller d’État as President and six members as follows:

The judge-President and the professors-members may be on active service or not.

“It is allowed for the members of the Data Protection Authority to exercise duties as members of a University faculty on a full or part-time basis”.

The above section between “ ” was added pursuant to article 14 of Law 3068/2002 (Official Gazette 274 A/ 2002).

[2. The President of the Authority will be employed on a full and exclusive time basis and will be appointed by a Presidential Decree issued upon proposal of the Cabinet following a report by the Minister of Justice. If a judge on active service is selected for the position of the President, then a decision of the competent Supreme Judicial Council is also required. The same procedure is to be followed for the selection and appointment of the President’s substitute.

3. The members of the Authority will be appointed by means of the following procedure: the Minister of Justice submits to the Speaker of the Parliament a proposal for the appointment of the six ordinary members of the Authority and an equal number of substitutes. The proposal shall include a double number of candidates. The Speaker will then forward the proposal to the Committee on Institutions and Transparency, which renders an opinion. The ordinary members of the Authority and their substitutes are selected by the [Parliamentary Committees] Chairmen Conference. The persons selected are then appointed by virtue of a presidential decree issued following a proposal by the Minister of Justice and published in the Official Gazette.]

[The above paragraphs 2 and 3 of the present article were abolished pursuant to article 5 paragraph 9 of Law 3051/200; the general provisions of the said Law apply].

4. The President and members of the Authority will be appointed for a specific term of office. Their term of office will be of four years and may be renewed only once. None may serve for a total period exceeding eight (8) years. Half of the Authority's six members will be renewed every two years. In the first application of these presents the term of office of the six (6) members of the Authority shall be of four years. After the second composition of the Authority, a draw will take place among the six ordinary members so as to decide which three of them will serve for a four-year period and which for a two-year period.

[The last section of paragraph 4 was amended as above pursuant to article 11 paragraph 3 of Law 2623/1998].

5. The President and members of the Authority shall be appointed with an equal number of substitutes who must have the same status and qualifications. The substitutes for the President and the members will participate in the meetings of the Authority only if the corresponding ordinary member is provisionally absent or unable to participate. By means of a decision the President of the Authority may delegate special duties to the substitutes. “Therefore the latter shall participate in the meeting and shall have the right to vote even if the ordinary member is present”. The term of office of each substitute will equal the term of office of the corresponding ordinary member.

The above section between “ ” was added pursuant to article 47 paragraph 1 of Law 2721/1999 (Official Gazette 112 A/ 1999).

Article 17

Impediments - Incompatibilities of the members of the Authority

1. No one may be appointed as a member of the Authority:

2. Membership of the Authority is automatically forfeit for anyone who, following his/her appointment:

3. Evidence on the incompatibility, pursuant to the preceding paragraph, is taken by the Authority without the participation of the member, whose position may be incompatible. The Authority shall decide having previously heard the said member. The procedure may be initiated either by the President of the Authority or by the Minister of Justice.

4. The loss of the qualifications on the basis of which a member of the Authority was appointed, pursuant to article 16 paragraph 1 of this law, shall entail his/her automatic forfeiture, if due to an irrevocable disciplinary or criminal conviction.

Article 18

Duties and rights of the members of the Authority

1. When exercising their duties the members of the Authority are subject to their conscience and the law. They have a duty of confidentiality. As witnesses or expert witnesses they may testify only on facts exclusively and solely pertaining to the observance of the provisions of this law by Controllers. The duty of confidentiality continues to exist even after the members of the Authority are in any way retired.

2. The monthly wages of the President of the Authority correspond to those of the President of the Legal Council of the State and the monthly wages of the members of the Authority equal to forty per cent (40%) of those of the President notwithstanding any other provision. The substitutes of the President and the members of the Authority will be paid 1/3 of the monthly wages paid to the President and the ordinary members of the Authority provided that the President certifies that they have rendered services during the month other than participating in the Authority’s meetings. The remuneration of the President, the members of the Authority and the Secretary for each session in which they participate shall be stipulated by a joint decision by the Ministers of Justice and Finance. The provisions applicable from time to time regarding travel expenses of persons travelling upon official instructions in the exercise of their duties shall also apply for travel by the members of the Authority and employees of the Secretariat of the Authority. The President of the Authority shall issue the relevant travel mandates. The aforementioned provisions shall come into force on the date of the commencement of the operations of the Authority.

3. For any breach of their duties arising from this law the members of the Authority are held disciplinarily liable. The disciplinary procedure will be initiated before the Disciplinary Council by the Minister of Justice with regard to the President and the members of the Authority and by the President of the Authority with regard to its members. The Disciplinary Council consists of a Vice-President of the Conseil d’État as Chairman, an Areios Pagos (Supreme Court) judge, a Councillor of the Court of Auditors and two University law professors. An employee of the Authority shall perform the duties of the Secretary to the Council. The Chairman, the members and the Secretary of the Council will be appointed along with an equal number of substitutes. For those members of the Council who are judges a decision of the competent Supreme Judicial Council is also required. The Council is established by virtue of a decision by the Minister of Justice with a three-year term of office. The Council is in session when at least four of its members are present, among which necessarily the President or his/her substitute, and decides by the absolute majority vote of those present. In case of split vote, the Chairman's vote shall prevail. In case of more than two opinions, those of the lesser dissent, must accede to one of the two prevailing ones. The Disciplinary Council shall decide at first and last instance whether the defendant is released of all charges or discharged from the service. The compensation payable to the President, the members and the Secretary of the Council is specified by a joint decision of the Ministers of Finance and Justice, notwithstanding any other provision.

4. A member of the Authority who, in breach of this law, discloses in any way whatsoever personal data accessible to him in the course of his/her duties or allows such data to become known to a third party shall be punished by imprisonment for a period of at least two (2) years and a fine amounting between two million Drachmas (GRD 2,000,000) and ten million Drachmas (GRD 10,000,000). If, however, s/he has committed the act with the purpose of gaining unlawful benefit on his/her behalf or on behalf of another or for the purpose of causing harm to another person, then s/he will be punished by confinement in a penitentiary. If the act referred to in the first section of this paragraph has been committed as a result of negligence, then the perpetrator will be punished by imprisonment for a period of at least three (3) months and a fine.

[Paragraph 2 was amended as above pursuant to article 11 paragraph 4 of Law 2623/1998 (Official Gazette 139A/1998)].

Article 19

Competence, operation and decisions of the Authority

1. The Authority shall mainly have the following powers:

2. The Authority shall hold regular sessions upon an invitation by its President. It shall hold extraordinary sessions upon an invitation by the President or an application by at least two of its members. The Authority will decide by the majority vote of at least four of its members. In case of split vote, the President's vote or that of his/her substitute shall prevail.

3. The Authority shall adopt its rules of procedure, thus regulating more specifically the allocation of duties among its members, the prior hearing of interested parties, matters relating to the disciplinary procedure, and the methods of carrying out the reviews stipulated in paragraph 1 case (h) of the present article.

[The following items are added in paragraph 3 of this article pursuant to article 34 paragraph 5 of Law 2915/2001]:

“The Authority may also hold meetings in sections, comprised of at least three regular or substitute members presided by the President of the Authority or his/her substitute. The rules of procedure of the Authority further regulate the composition, the terms of operation of the sections and the allocation of duties between the plenum and the sections. Any decisions of the sections may be amended or revoked by the plenum”.

4. The Authority shall keep the following registries:

5. Everyone shall have access to the registries under a), b), c), d) and e) of the previous paragraph. Following an application by the party concerned and a decision by the Authority access may also be permitted, in whole or in part, to the Secret Files Register. Following an application by the Controller or his/her representative and by virtue of a decision of the Authority access to the Transfer Permits Register may be prohibited, in whole or in part, if it may jeopardise the privacy of a third party, national security, the detection of particularly serious crimes and the performance of obligations of the state arising out of international treaties.

6. The President will represent the Authority before all other authorities as well as before committees and groups, in sessions and conferences of institutions of the European Union and of any other international organisation and institution created by an international convention or in which representatives of similar authorities of other countries participate. The President may delegate the representation of the Authority to one of its members, a substitute or even an employee of the Auditors branch of the Secretariat.

7. The President bears responsibility for the operation of the Authority as well as for the operation of the Secretariat. The President may authorise a member of the Authority or the person in charge of the Secretariat or the person in charge of a department of the Secretariat to sign "by order of the President" documents, payment warrants or other acts. The President shall be the Administrative Head of the personnel of the Secretariat. S/he shall exercise disciplinary power over them and may impose disciplinary sanctions, at most a fine equal to half the monthly wages of the defendant.

[Paragraph 7a is added to the present article pursuant to article 34 paragraph 6 of Law 2915/2001, as follows]:

7a. In the event that the protection of an individual with regard to the processing of personal data calls for immediate decision-making, the President may, upon request of the party concerned, issue a provisional order for immediate suspension of the processing or the file operation, in whole or in part. Said order shall apply until the Authority issues a final judgement. The Authority shall be equally responsible when dealing with the matter.

8. The regulations issued by the Authority shall be published in the Official Gazette. All other decisions of the Authority shall come into force as of the date of their issuance or as of the date they were notified to their recipients.

9. Remedies against the decisions of the Authority may also be filed by the State. Such remedy shall be initiated by the competent Minister as the case may be.

[The following items are added to paragraph 9 of this article pursuant to article 34 paragraph 7 of Law 2915/2001]:

In every trial relating to a decision issued by the Authority, the party to the legal proceedings shall be the latter represented by the President. The appearer in court shall be either a member of the Legal Council of the State or a member of the Authority, regular or substitute, or an auditor, who is attorney-at-law and acts by order of the President, without remuneration.

10. All public authorities shall render assistance to the Authority.

Article 20

The Secretariat of the Authority

1. The Authority shall be assisted by a Secretariat. The Secretariat operates at the Directorate level. The status of its employees will be governed by the provisions applicable from time to time on administrative civil servants.

2. The organisation of the Secretariat, its division into departments and services and the competence thereof, the number of personnel by branch and speciality as well as any other necessary detail are stipulated by a presidential decree issued upon a proposal by the Ministers of the Interior, Public Administration and Decentralisation, Finance and Justice following a report by the Authority delivered within two months from its establishment. The same decree provides for the establishment, as an administrative unit within the Secretariat, of a Department of Auditors, whose method of employment and status shall also be determined, notwithstanding any other provisions in force from time to time. The person in charge of the Secretariat shall necessarily come from the Auditors branch. The number of positions of the Secretariat of all categories shall not exceed thirty (30).

Lawyers may also be employed in the Auditors Department of the Authority’s Secretariat. However, without relinquishing their capacity as lawyers, they may not practice law during their term of office.

[This last item was added to paragraph 2 pursuant to article 11 paragraph 5 of Law 2623/1998].

3. Vacancies in the Secretariat Section will be filled according to the provisions applicable from time to time on civil servants. The employees of the Auditors branch in particular shall be employed by the Secretariat, upon selection or by an examination procedure following a relevant advertisement.

4. Matters pertaining to the employment status of the personnel of the Secretariat shall be subject to a Service Council established by a decision of the President of the Authority and comprising two of its members, one employee appointed by it and two elected representatives of the employees. In all other matters the provisions applicable from time to time to the Service Councils for civil servants and the personnel of legal entities of public law shall apply.

5. Ordinary employees of the Authority's Secretariat will be subject, as to their secondary social security, to the Assistance Fund for Employees Supervised by the Ministry of Justice. Those coming from other agencies may continue to be covered by the social security funds of their previous position. The employees of the Secretariat shall be necessarily registered with the Lawyers' Pension Fund under the same terms and conditions applicable on salaried lawyers covered by it. The provisions of this paragraph shall also apply to employees transferred to the Secretariat of the Authority from legal entities of private law.

6. For the first time the positions of the persons in charge of service units of the Secretariat, with the exception of the Auditors Department, shall be filled following an advertisement by the Authority either by a transfer of civil servants or employees of legal entities of public law of grade A or equivalent thereof or by appointment. The appointment procedure shall take place only for those positions not filled by transfer. The selection of those to be transferred or appointed is carried out by the Authority. Those selected are appointed by a decision of the Minister of Justice and those transferred by a decision of the same and the competent Minister. For such transfer to be effected it is not necessary to have an opinion by the competent Service Council of the department of origin. The person in charge of the Secretariat is selected by the Authority among the employees of the Auditors Department, notwithstanding any other provision.

7. For the first time the remaining positions of the Secretariat shall be filled under the terms and conditions and according to the procedure stipulated in the preceding paragraph. Candidates with a proven experience in information technology shall be preferred. Regarding the employees of the Auditors Department the provisions of paragraph 3 of this article apply.

8. Regarding persons transferred from legal entities of public or private law prior service time shall be deemed as actual service time entailing all lawful consequences.

9. The provisions of paragraph 4 of article 18 shall also apply regarding the employees of the Secretariat.

10. In addition to the monthly wages, and other benefits paid to the ordinary employees of the Ministry of Justice, an extra pay may be granted to the personnel of the Secretariat of the Authority, depending on each category, upon a joint decision of the Ministers of Finance and Justice.

[Paragraph 10 was added pursuant to article 13 paragraph 3 of Law 2703/1999 (Official Gazette 72 A/1999)].

CHAPTER E

SANCTIONS

Article 21

Administrative Sanctions

1. The Authority may impose on the Controllers or on their representatives, if any, the following administrative sanctions for breach of their duties arising from this law as well as from any other regulation on the protection of individuals from the processing of personal data:

2. The administrative sanctions referred to in the preceding paragraph under b, c, d and e shall only be imposed following a hearing of the Controller or his representative. Such sanctions shall be commensurate to the gravity of the violation impeached. The administrative sanctions under c, d, and e shall be imposed in case of a particularly serious or repeated violation. A fine may be imposed in conjunction with the sanctions provided for under c, d and e. If the sanction of file destruction is imposed, then the Controller is responsible for such destruction taking place upon payment of a fine in case of non-compliance.

3. The fines referred to in paragraph 1 may be readjusted by a decision of the Minister of Justice following a proposal by the Authority.

4. Any acts of the Authority imposing a fine shall constitute an enforceable instrument and will be served to the Controller or his/her representative, if any. The collection of fines will be effected pursuant to the provisions of the Public Revenues Collection Code.

NOTE: See article 8 of Law 3144/2003 concerning the Protection of Personal Data of employees and infliction of sanctions of said law.

Article 22

Penal Sanctions

1. Anyone who fails to notify the Authority, according to the provisions of article 6 of this law, of the establishment or the operation of a file or any change in the terms and conditions regarding the granting of the permit referred to in paragraph 3 of article 7 of this law, will be punished by imprisonment for up to three (3) years and a fine amounting between one million Drachmas (GRD 1,000,000) and five million Drachmas (GRD 5,000,000).

2. Anyone who, in breach of article 7 of this law, keeps a file without permit or in breach of the terms and conditions referred to in the Authority's permit, will be punished by imprisonment for a period of at least one (1) year and a fine amounting between one million Drachmas (GRD 1,000,000) and five million Drachmas (GRD 5,000,000).

3. Anyone who, in breach of article 8 of this law, proceeds to the interconnection of files without notifying the Authority accordingly will be punished by imprisonment for up to three (3) years and a fine amounting between one million Drachmas (GRD 1,000,000) and five million Drachmas (GRD 5,000,000). Anyone who proceeds to the interconnection of files without the Authority's permit, wherever such permit is required, or in breach of the terms of the permit granted to him, will be punished by imprisonment for a period of at least one (1) year and a fine amounting between one million Drachmas (GRD 1,000,000) and five million Drachmas (GRD 5,000,000).

4. Anyone who unlawfully interferes in any way whatsoever with a personal data file or takes notice of such data or extracts, alters, affects in a harmful manner, destroys, processes, transfers, discloses, makes accessible to unauthorised persons or permits such persons to take notice of such data or anyone who exploits such data in any way whatsoever, will be punished by imprisonment and a fine and, regarding sensitive data, by imprisonment for a period of at least one (1) year and a fine amounting between one million Drachmas (GRD 1,000,000) and ten million Drachmas (GRD 10,000,000), unless otherwise subject to more serious sanctions.

5. Any Controller who does not comply with decisions issued by the Authority in the exercise of the right of access, pursuant to paragraph 4 of article 12, in the exercise of the right to object, pursuant to paragraph 2 of article 13, as well as with acts imposing the administrative sanctions provided under c, d and e of paragraph 1 of article 21 shall be punished by imprisonment for a period of at least two (2) years and a fine amounting between one million Drachmas (GRD 1,000,000) and five million Drachmas (GRD 5,000,000). By the sanctions referred to in the preceding sentence shall also be punished any Controller who transfers personal data in breach of article 9 as well as the person who does not comply with the court decision referred to in article 14 of this law.

6. If the perpetrator of the acts referred to in paragraphs 1-5 of this article purported to gain unlawful benefit on his/her behalf or on behalf of another person or to cause harm to a third party, then s/he shall be punished with confinement in a penitentiary for a period of up to ten (10) years and a fine amounting between two million Drachmas (GRD 2,000,000) and ten million Drachmas (GRD 10,000,000).

7. If the acts referred to in paragraphs 1-5 of this Article have jeopardised the free operation of democratic governance or national security, then the sanction imposed shall be confinement in a penitentiary and a fine amounting between five million Drachmas (GRD 5,000,000) and ten million Drachmas (GRD 10,000,000).

8. If the acts referred to in paragraphs 1-5 of this Article were committed as a result of negligence, then imprisonment for a period of at least three (3) months and a fine shall be imposed.

9. For the purposes of the present article, if the Controller is not a natural person, then liable shall be the representative of the legal entity or the head of the public authority or agency or organisation, provided s/he also carries out in effect administrative or managerial duties.

10. Regarding the offences of the present article, the President and the members of the Authority as well as the employees of the Secretariat's Auditors Department who are especially authorised to that effect shall be deemed as special investigating officers having all the powers invested to them by the Code of Criminal Procedure. They shall be entitled to carry out a preliminary investigation, even without an order by the Public Prosecutor, in case of an act caught in flagrante delicto, a misdemeanour, or if there is risk in any delay.

11. Regarding the offences referred to in paragraph 5 of this article as well as in any other case where an administrative review has been previously carried out by the Authority, the President of the same shall notify the competent Public Prosecutor in writing as to any eventuality that became the object of an investigation by the Authority and shall forward to him all the relevant records and evidence.

12. The preliminary investigation for the offences referred to in this article shall be completed within a period of maximum two (2) months since charges were brought and, provided that there is reasonable cause to remand the defendant to trial, the court date shall be set at a date no later than three (3) months since the preliminary investigation was completed or, if remand was effected by means of an order of the Judicial Council, within two (2) months since the date such order became irrevocable. In the event the case is sent to trial by direct summons, no appeal will be permitted against the writ of summons.

13. No continuation is allowed with regard to the offences referred to in this article, except for extremely important reasons and only once. In this case, the court is adjourned for a specific day within no more than two (2) months and the case shall, exceptionally, be heard first.

14. The felonies, provided for in this law, shall be subject to the jurisdiction of the Court of Appeal.

NOTE: Article 13 paragraph 3 of Law 2774/1999 (Official Gazette 287A/1999) on the “Protection of Personal Data in the Telecommunications Sector” stipulates the following:

“The provisions of article 22 paragraphs 6 to 14 of Law 2472/1997 shall also apply to the acts of the previous paragraphs”.

NOTE: See article 8 of Law 3144/2003 concerning the Protection of Personal Data of employees and infliction of sanctions of said law.

Article 23

Civil Liability

1. Any natural person or legal entity of private law, who in breach of this law, causes material damage shall be liable for damages in full. If the same causes non pecuniary damage, s/he shall be liable for compensation. Liability subsists even when said person or entity should have known that such damage could be brought about.

2. The compensation payable according to article 932 of the Civil Code for non pecuniary damage caused in breach of this law is hereby set at the amount of at least two million Drachmas (GRD 2,000,000), unless the plaintiff claims a lesser amount or the said breach was due to negligence. Such compensation shall be awarded irrespective of the claim for damages.

3. The claims referred to in the present Article shall be litigated according to articles 664-676 of the Code of Civil Procedure, notwithstanding whether the Authority has issued a relevant decision or whether criminal charges have been brought or suspended or postponed on any grounds whatsoever. The decision of the Court shall be issued within a period of two (2) months since the first hearing in court.

NOTE: See article 8 of Law 3144/2003 concerning the Protection of Personal Data of employees.

CHAPTER F

FINAL - TRANSITIONAL PROVISIONS

Article 24

Responsibilities of the Controller

1. The Controllers of files operating on the date this law enters into force must submit to the Authority the notification of operation referred to in article 6 within six (6) months from the date the Authority commenced operations.

2. The same obligation applies to Controllers of sensitive data files operating on the date this law enters into force, in order to have the permit referred to in paragraph 3 of article 7 issued.

3. Regarding files operating and processing carried out on the date this law enters into force, Controllers must inform the data subjects, according to paragraph 1 of article 11, within six (6) months from the date the Authority commenced operations. In the event such information pertains to a large number of data subjects, it may also be carried out through the press. In this case the relevant details shall be determined by the Authority. The provisions of paragraph 4 of article 11 shall also apply in this instance.

NOTE: Article 8 paragraph 5 of Law 2819/2000 (Official Gazette 84A/2000) stipulates that:

“Deadlines provided for in article 24 paragraphs 1, 2 and 3 of Law 2472/1997 are extended to January 21st 2001”.

4. Regarding wholly non-automated files the deadlines referred to in the preceding paragraphs will extend to one (1) year.

5. The provisions of articles 11, 12, 13 and 19 paragraph 1 of this law shall not apply on criminal records and the official records kept by the competent judicial authorities in order to meet the operational needs of criminal justice and in the context thereof.

NOTE: Article 11 of Law 2623/1999 as amended by article 47 paragraph 2 of Law 2721/1999 stipulates the following:

“Deadlines provided for in article 24 paragraphs 1, 2, 3 and 4 of Law 2472/1997 as amended by article 11 paragraph 2 of Law 2623/1998 expire in December 31st 1999”.

Article 25

Commencement of the operation of the Authority

1. Within a period of sixty (60) days since this law enters into force, the President of the Authority and his/her substitute shall be appointed. Within the same time limit the Minister of Justice shall submit to the Speaker of Parliament a proposal for the appointment of the four ordinary members of the Authority and an equal number of substitutes.

2. The time of commencement of the operation of the Authority shall be determined by a decision of the Minister of Justice issued no later than four (4) months since the Authority was established. For the period between the appointment of its members and the recruitment of its Secretariat, according to article 20 paragraphs 6 and 7 of the present Law, the Authority shall be served by personnel temporarily seconded to it by means of its own decision, notwithstanding any other provision.

3. Until such time as the Authority operates according to the preceding paragraph, the administrative control of its expenses shall be effected by the Department of Finance of the Central Service of the Ministry of Justice at the expense of the budget of the Ministry of Justice.

4. The decision of the Minister of Justice, pursuant to paragraph 2 of this article, whereby the date of commencement of the operations of the Authority is determined shall be published in the Official Gazette and in at least four (4) daily political newspapers of broad circulation published in Athens and Thessaloniki and in at least two (2) daily financial newspapers.

Article 26

Entry into force

1. The provisions of Articles 15, 16, 17, 18 and 20 of this law shall enter into force on the date the present law is published in the Official Gazette.

2. The remaining provisions shall enter into force on the date of the commencement of the operations of the Authority, pursuant to the preceding article.


[1] [In the event that such data processing or file falls within one of the categories for which the Authority has issued special data processing rules, then the Controller must submit to the Authority a statement whereby s/he confirms that such data processing will be carried out or the file will be kept according to the special rules established by the Authority, which will prescribe in detail the form and contents of such statement].