public communications networks, use of surveillance systems with the obtaining or
recording of sound or image at public areas and relative provisions,
13 transposing
Directive 2006/24.
1.2 The Notion of Personal Data
In Greek legislation, personal data means any information relating to the data
subject, that is, to any identified or identifiable individual to whom such personal
data refer. An identifiable natural person is one who can be identified, directly or
indirectly, especially by reference to a name, an identity card number, location data
or to one or more factors specific to his/her physical, physiological, mental, economic, cultural, political or social identity.
14 The data kept for statistical purposes,
which can no longer be attributed to a data subject, are not considered as personal
data in the meaning of the law on personal data protection. Personal data are relating
to living persons.
15 Although only individuals are afforded protection of their
personal data, Greek academics expressed the opinion that the constitutional data
protection is not limited to individuals.
16 Moreover, certain matters relating to legal
persons might be subject to data protection legislation, e.g. when the name of the
principal partner of a commercial company is referred to the company name.
17
Areios Pagos, the Greek Supreme Civil and Criminal Court, held that an information falls within the definition of personal data, when it is directly linked to the
data subject and to his/her personal qualities or activities that are not to become
known to the public, unless the data subject consented.
18 Moreover, the Greek courts
held that the picture of a person posted on the Facebook constitutes processing of
personal data
19 and that the picture of an individual without a name associated to it
constitutes indirect identification of that person.
20 In another case, the judge accepted
that a photo accompanied by an article containing relevant content identified an
individual to constitute personal data, even if the facial image was unrecognizable.
21
Moreover, according to the Data Protection Authority, factors of indirect identification, such as an email address, can sufficiently identify an individual from other
members of a group, even without a name associated to it.
22 The Authority
13 Government Gazette A 22.
14 See art. 4 GDPR and art. 2 L. 2472/1997.
15 See DPA decision no. 38/2010.
16 See Sotiropoulos (2006), pp. 84 and 89.
17 See Mittleton (2016), p. 10.
18 Areios Pagos no. 637/2013.
19 First Instance Court of Thiva no. 54/2014.
20 Court of Peace of Athens no. 4048/3014.
21 Court of Appeal of Athens no. 3808/2014.
22 See DPA decision no. 25/2013.
214
V. Kourtis
recording of sound or image at public areas and relative provisions,
13 transposing
Directive 2006/24.
1.2 The Notion of Personal Data
In Greek legislation, personal data means any information relating to the data
subject, that is, to any identified or identifiable individual to whom such personal
data refer. An identifiable natural person is one who can be identified, directly or
indirectly, especially by reference to a name, an identity card number, location data
or to one or more factors specific to his/her physical, physiological, mental, economic, cultural, political or social identity.
14 The data kept for statistical purposes,
which can no longer be attributed to a data subject, are not considered as personal
data in the meaning of the law on personal data protection. Personal data are relating
to living persons.
15 Although only individuals are afforded protection of their
personal data, Greek academics expressed the opinion that the constitutional data
protection is not limited to individuals.
16 Moreover, certain matters relating to legal
persons might be subject to data protection legislation, e.g. when the name of the
principal partner of a commercial company is referred to the company name.
17
Areios Pagos, the Greek Supreme Civil and Criminal Court, held that an information falls within the definition of personal data, when it is directly linked to the
data subject and to his/her personal qualities or activities that are not to become
known to the public, unless the data subject consented.
18 Moreover, the Greek courts
held that the picture of a person posted on the Facebook constitutes processing of
personal data
19 and that the picture of an individual without a name associated to it
constitutes indirect identification of that person.
20 In another case, the judge accepted
that a photo accompanied by an article containing relevant content identified an
individual to constitute personal data, even if the facial image was unrecognizable.
21
Moreover, according to the Data Protection Authority, factors of indirect identification, such as an email address, can sufficiently identify an individual from other
members of a group, even without a name associated to it.
22 The Authority
13 Government Gazette A 22.
14 See art. 4 GDPR and art. 2 L. 2472/1997.
15 See DPA decision no. 38/2010.
16 See Sotiropoulos (2006), pp. 84 and 89.
17 See Mittleton (2016), p. 10.
18 Areios Pagos no. 637/2013.
19 First Instance Court of Thiva no. 54/2014.
20 Court of Peace of Athens no. 4048/3014.
21 Court of Appeal of Athens no. 3808/2014.
22 See DPA decision no. 25/2013.
214
V. Kourtis