2 Specific Problems Concerning Data Protection
in the Internet
2.1 Personal Data Processed by Electronic Means
The guiding and interpretive principles laid down by the general Law 2472/1997 to
govern the protection of personal data and privacy were also applicable to the
electronic data processing with the necessary adjustments. The basic requirements
for carrying out lawful personal data processing provided for by the previous law are
also laid down by the GDPR.
34 Moreover, Law 3471/2006 governing personal data
processing in the framework of publicly available electronic telecommunications
services including internet stipulates that the data processing must be limited to the
extent as is strictly necessary for the purposes it is carried out.
35 The electronic data
processing is only allowed, if the subscriber or user has given his/her consent upon
notification as to the type of data, the purpose and extent of the processing and the
recipients.
36 The consent must be given in an explicit manner and it must concern the
processing that is carried out for a specific purpose, whereas the consent that is given
in an abstract and general manner for any future processing relating to him/her is not
valid.
37 The rule regarding the consent is subject to limitations so that a fair balance
to be achieved between the protection of personal data and the satisfaction of other
constitutionally guaranteed rights.
38 Thus, processing may be carried out without the
subject’s consent in certain circumstances, such as when processing is necessary for
the performance of a contract concluded online or for the controller to comply with a
legal obligation to which s/he is subject.
39 Moreover, when data processing is
necessary for the protection of a vital interest of the data subject,
40 if the subject is
physically or legally incapable of giving the consent, or for the purposes of a
legitimate interest pursued by the data controller or by the third party to whom the
data are disclosed and on condition that such an interest manifestly prevails over the
rights and interests of the persons to whom the data refer and their fundamental rights
are not affected.
34 See art. 5 GDPR.
35 Art. 5 § 1 L. 3471/2006.
36 Art. 5 § 2 L. 3471/2006.
37 See Alexandropoulou-Aigyptiadou (2016), p. 60; Christodoulou (2013), p. 361; Iglezakis (2009),
pp. 218 ff. See also Consumer Ombudsman’s decision no. 1204/2007.
38 See Areios Pagos no. 1/2017 and Council of State nos. 1616/2012 & 2254/2005.
39 Art. 5 § 2 L. 2472/1997.
40 See also recital 46 of the GDPR.
Data Protection in the Internet: Greece
217
in the Internet
2.1 Personal Data Processed by Electronic Means
The guiding and interpretive principles laid down by the general Law 2472/1997 to
govern the protection of personal data and privacy were also applicable to the
electronic data processing with the necessary adjustments. The basic requirements
for carrying out lawful personal data processing provided for by the previous law are
also laid down by the GDPR.
34 Moreover, Law 3471/2006 governing personal data
processing in the framework of publicly available electronic telecommunications
services including internet stipulates that the data processing must be limited to the
extent as is strictly necessary for the purposes it is carried out.
35 The electronic data
processing is only allowed, if the subscriber or user has given his/her consent upon
notification as to the type of data, the purpose and extent of the processing and the
recipients.
36 The consent must be given in an explicit manner and it must concern the
processing that is carried out for a specific purpose, whereas the consent that is given
in an abstract and general manner for any future processing relating to him/her is not
valid.
37 The rule regarding the consent is subject to limitations so that a fair balance
to be achieved between the protection of personal data and the satisfaction of other
constitutionally guaranteed rights.
38 Thus, processing may be carried out without the
subject’s consent in certain circumstances, such as when processing is necessary for
the performance of a contract concluded online or for the controller to comply with a
legal obligation to which s/he is subject.
39 Moreover, when data processing is
necessary for the protection of a vital interest of the data subject,
40 if the subject is
physically or legally incapable of giving the consent, or for the purposes of a
legitimate interest pursued by the data controller or by the third party to whom the
data are disclosed and on condition that such an interest manifestly prevails over the
rights and interests of the persons to whom the data refer and their fundamental rights
are not affected.
34 See art. 5 GDPR.
35 Art. 5 § 1 L. 3471/2006.
36 Art. 5 § 2 L. 3471/2006.
37 See Alexandropoulou-Aigyptiadou (2016), p. 60; Christodoulou (2013), p. 361; Iglezakis (2009),
pp. 218 ff. See also Consumer Ombudsman’s decision no. 1204/2007.
38 See Areios Pagos no. 1/2017 and Council of State nos. 1616/2012 & 2254/2005.
39 Art. 5 § 2 L. 2472/1997.
40 See also recital 46 of the GDPR.
Data Protection in the Internet: Greece
217