permitted, where their use is justified by the nature or the conditions of work and is
necessary for the protection of health and security of employees or the protection of
high-risk workplaces, e.g. banks and military plants. The systems used for monitoring of places, such as the entrance and exit at the premises of an enterprise or places
where safe deposit boxes or electromechanical equipment are located, are compliant
with the law, if the cameras focus on the property or goods to be protected and are
not used to control employees at the workplace.
The new Law 4624/2019 adopts the principles in respect to the surveillance at the
workplace mentioned above (art. 27). It states that the surveillance systems at the
workplace shall be used in a way that does not offend the dignity of the employees.
The collection of employees’ personal data shall be limited to those data that are
directly connected to employment and not extend, as far as possible, to the personal
behaviour and personal contacts of the employees. The personal data of employees
that are collected by means of a surveillance camera is prohibited to be used as
criteria for their evaluation.
71
As concern the thorny issue of the consent that is necessary for processing
employees’ personal data, the Data Protection Authority held that the imbalance of
powers between the parties in an employment relationship casts doubts on the
possibility of the employees to refuse giving their consent or withdraw it without
any detriment being suffered. Such an opinion appears to be aligned with the
approach adopted by the General Data Protection Regulation.
72
A specific regulation is provided for by the Greek legislation in respect to the
medical data of employees. Pursuant to Law 3144/2003 on “social dialogue for the
promotion of employment and social protection”,
73 the processing of medical data
shall be only permitted if it were necessary for the evaluation of an employee’s
suitability for work or for implementing the employer’s duty to protect the health
and safety of employees, or to establish employee’s rights to social benefits. Moreover, the personal data of employees is prohibited to be included in his/her individual
book of professional risks, with the exception of the results of medical tests. In
relation to data resulting from genetic examinations related to employees, the
Authority held that such examinations were prohibited under the existed legislative
framework as contravened to the principle of proportionality, taking also into
consideration the constitutionally guaranteed human values.
74
Finally, worth to mention is a judgment recently rendered by Areios Pagos on a
case concerning claims of an employer against his employees who had provided
corporate information to a competitor company via electronic mail.
75 The critical
e-mails have been sent using corporate computers and corporate electronic addresses
71 See also DPA Directive no. 115/2001 on the processing of employees’ personal data, part e, §§
6–8.
72 See the recital 155 of the GDPR.
73 Article 8 L. 3144/2003, Government Gazette A 111.
74 See DPA Directive no. 115/2001 on the processing of employees’ personal data, part d, §7.
75 Areios Pagos no. 1/2017.
Data Protection in the Internet: Greece
223
necessary for the protection of health and security of employees or the protection of
high-risk workplaces, e.g. banks and military plants. The systems used for monitoring of places, such as the entrance and exit at the premises of an enterprise or places
where safe deposit boxes or electromechanical equipment are located, are compliant
with the law, if the cameras focus on the property or goods to be protected and are
not used to control employees at the workplace.
The new Law 4624/2019 adopts the principles in respect to the surveillance at the
workplace mentioned above (art. 27). It states that the surveillance systems at the
workplace shall be used in a way that does not offend the dignity of the employees.
The collection of employees’ personal data shall be limited to those data that are
directly connected to employment and not extend, as far as possible, to the personal
behaviour and personal contacts of the employees. The personal data of employees
that are collected by means of a surveillance camera is prohibited to be used as
criteria for their evaluation.
71
As concern the thorny issue of the consent that is necessary for processing
employees’ personal data, the Data Protection Authority held that the imbalance of
powers between the parties in an employment relationship casts doubts on the
possibility of the employees to refuse giving their consent or withdraw it without
any detriment being suffered. Such an opinion appears to be aligned with the
approach adopted by the General Data Protection Regulation.
72
A specific regulation is provided for by the Greek legislation in respect to the
medical data of employees. Pursuant to Law 3144/2003 on “social dialogue for the
promotion of employment and social protection”,
73 the processing of medical data
shall be only permitted if it were necessary for the evaluation of an employee’s
suitability for work or for implementing the employer’s duty to protect the health
and safety of employees, or to establish employee’s rights to social benefits. Moreover, the personal data of employees is prohibited to be included in his/her individual
book of professional risks, with the exception of the results of medical tests. In
relation to data resulting from genetic examinations related to employees, the
Authority held that such examinations were prohibited under the existed legislative
framework as contravened to the principle of proportionality, taking also into
consideration the constitutionally guaranteed human values.
74
Finally, worth to mention is a judgment recently rendered by Areios Pagos on a
case concerning claims of an employer against his employees who had provided
corporate information to a competitor company via electronic mail.
75 The critical
e-mails have been sent using corporate computers and corporate electronic addresses
71 See also DPA Directive no. 115/2001 on the processing of employees’ personal data, part e, §§
6–8.
72 See the recital 155 of the GDPR.
73 Article 8 L. 3144/2003, Government Gazette A 111.
74 See DPA Directive no. 115/2001 on the processing of employees’ personal data, part d, §7.
75 Areios Pagos no. 1/2017.
Data Protection in the Internet: Greece
223