director—is exempted from (a) his/her obligation to notify the Authority about the
establishment and operation of a file or the commencement of data processing, and
(b) his/her obligation to receive a permit for the processing of sensitive data, when
the processing of the employees’ data is carried out exclusively for purposes relating
directly to (1) an employment relationship or to provision of services to the public
sector, and (2) is necessary for the fulfilment of an obligation imposed by law or for
the performance of obligations arising from the employment relationship, and upon
the prior relevant information of the employee.
The Data Protection Authority dealing with specific issues that arose during the
period where Law 2472/1997 applied to employees repeatedly stressed that the
horizontal nature of the general rules regarding data protection has the effect that
the specific purposes as well as the conditions of the employment relationships are
often overlooked, and the protection of employees’ personal data becomes ineffective.
65 Besides that, the article 7A of Law 2472/1997, mentioned above, gave birth to
issues of interpretation and legal certainty, because of the absence of specific
regulations and guarantees regarding its implementation. Due to that situation and
the fact that the methods of monitoring the employees at the workplace became more
advanced, the Authority proceeded to issuance of guidelines,
66 whereby general
rules on personal data protection are interpreted to be uniformly applied and adapted
to employment relationships.
According to the interpretation given by the Authority in relation to Law 2472/
1997, the collection and processing of employees’ personal data shall be carried out
through legitimate means and in such a way that ensures respect of privacy,
personality and human dignity at the workplace and the framework of employment
relationship in general.
67 As it follows from the basic principle of purpose limitation,
the collection and processing of employees’ personal data are permitted exclusively
for purposes directly related to the employment relationship and provided that they
are necessary for fulfilling obligations of both parties arisen out of this relationship,
either legal or contractual. The purposes for collecting and processing employees’
personal data must be precisely determined, and the employees must be aware of the
purposes of processing in advance and understand them.
68
The Data Protection Authority, in its Directive 1/2011 concerning “the use of
CCTV systems for the protection of persons and property”, stressed the high
importance of the application of the principle of proportionality.
69 Furthermore,
according to the Authority,
70 the surveillance cameras may be exceptionally
65 See, e.g. DPA Decision no. 245/2000 on processing of personal data of workers for the purposes
of entrance and exit at the workplace by means of taking fingerprints and Decision no. 637/2000 on
monitoring of the calls of workers at the workplace.
66 See DPA Directive no. 115/2001.
67 See also Areios Pagos no. 1/2017.
68 See, e.g. DPA Decision no. 34/2018.
69 Art. 5 DPA Directive no. 1/2011.
70 Art. 18 DPA Directive no. 1/2011.
222
V. Kourtis
establishment and operation of a file or the commencement of data processing, and
(b) his/her obligation to receive a permit for the processing of sensitive data, when
the processing of the employees’ data is carried out exclusively for purposes relating
directly to (1) an employment relationship or to provision of services to the public
sector, and (2) is necessary for the fulfilment of an obligation imposed by law or for
the performance of obligations arising from the employment relationship, and upon
the prior relevant information of the employee.
The Data Protection Authority dealing with specific issues that arose during the
period where Law 2472/1997 applied to employees repeatedly stressed that the
horizontal nature of the general rules regarding data protection has the effect that
the specific purposes as well as the conditions of the employment relationships are
often overlooked, and the protection of employees’ personal data becomes ineffective.
65 Besides that, the article 7A of Law 2472/1997, mentioned above, gave birth to
issues of interpretation and legal certainty, because of the absence of specific
regulations and guarantees regarding its implementation. Due to that situation and
the fact that the methods of monitoring the employees at the workplace became more
advanced, the Authority proceeded to issuance of guidelines,
66 whereby general
rules on personal data protection are interpreted to be uniformly applied and adapted
to employment relationships.
According to the interpretation given by the Authority in relation to Law 2472/
1997, the collection and processing of employees’ personal data shall be carried out
through legitimate means and in such a way that ensures respect of privacy,
personality and human dignity at the workplace and the framework of employment
relationship in general.
67 As it follows from the basic principle of purpose limitation,
the collection and processing of employees’ personal data are permitted exclusively
for purposes directly related to the employment relationship and provided that they
are necessary for fulfilling obligations of both parties arisen out of this relationship,
either legal or contractual. The purposes for collecting and processing employees’
personal data must be precisely determined, and the employees must be aware of the
purposes of processing in advance and understand them.
68
The Data Protection Authority, in its Directive 1/2011 concerning “the use of
CCTV systems for the protection of persons and property”, stressed the high
importance of the application of the principle of proportionality.
69 Furthermore,
according to the Authority,
70 the surveillance cameras may be exceptionally
65 See, e.g. DPA Decision no. 245/2000 on processing of personal data of workers for the purposes
of entrance and exit at the workplace by means of taking fingerprints and Decision no. 637/2000 on
monitoring of the calls of workers at the workplace.
66 See DPA Directive no. 115/2001.
67 See also Areios Pagos no. 1/2017.
68 See, e.g. DPA Decision no. 34/2018.
69 Art. 5 DPA Directive no. 1/2011.
70 Art. 18 DPA Directive no. 1/2011.
222
V. Kourtis