obtaining or recording of sound or image at public areas and relative provisions,
implemented Directive 2006/24.
130 This Law also provides for further measures on
the effective protection of the retained data of communication of subscribers and
registered users, with respect to the principle of proportionality and it specifies the
requirements for the installation and operation of surveillance systems at public
areas. A special committee was set up by the Ministry of Justice to study the
abolition or modification of Law 3917/2011, so that the Greek law to be complying
with the CJEU’s decision on the cases C-293/12 and C-594/12; in the meanwhile,
this Law is still in force.
Law 3917/2011 applies to traffic and location data on legal entities as well as
natural persons and to the related data necessary to identify the subscriber or
registered user. It shall not apply to the content of electronic communications,
including information consulted using an electronic communications network. The
categories of data that can be retained follow verbatim the categories referred to in
Directive 2006/24. Pursuant to Article 1 §1, the providers are obliged to retain the
traffic and location data in order to be available to the competent authorities for
investigating, detecting and prosecuting very serious crimes.
131
2.4 Data Protection and Electronic Surveillance for Security
and Defence Purposes
National security is a constitutionally established reason for allowing restrictions on
the freedom of communication and protection of confidentiality under guarantees,
which shall be specified by law.
132 Due to its vagueness, the concept of national
security must be specified in each one case regarding personal data protection.
133 In
respect to processing of personal data on grounds of national security, certain
restrictions to the basic rules regarding data protection are provided for.
In particular, the processing of sensitive personal data is exceptionally allowed
when is carried out by a public authority and is necessary for the purposes of national
security or public health.
134 Even in such a case, the basic requirements for lawful
processing must be met.
135 The processing of other (simple) personal data is allowed
without the data subject’s consent when processing is necessary for the performance
of a task carried out in the public interest or carried out in the exercise of public
function by a public authority.
136 When the processing is carried out on national
130 Government Gazette A 22.
131 As defined by art. 4 L. 2225/1995.
132 Art. 19 § 1b of the Constitution.
133 See Alexandropoulou-Aigyptiadou (2016), p. 102.
134 Art. 7 § 2e L. 2472/1997.
135 As laid down by articles 4 and 5 L. 2472/1997. See also Iglezakis (2003), p. 238.
136 Art. 5 § 2d L. 2472/1997.
232
V. Kourtis
implemented Directive 2006/24.
130 This Law also provides for further measures on
the effective protection of the retained data of communication of subscribers and
registered users, with respect to the principle of proportionality and it specifies the
requirements for the installation and operation of surveillance systems at public
areas. A special committee was set up by the Ministry of Justice to study the
abolition or modification of Law 3917/2011, so that the Greek law to be complying
with the CJEU’s decision on the cases C-293/12 and C-594/12; in the meanwhile,
this Law is still in force.
Law 3917/2011 applies to traffic and location data on legal entities as well as
natural persons and to the related data necessary to identify the subscriber or
registered user. It shall not apply to the content of electronic communications,
including information consulted using an electronic communications network. The
categories of data that can be retained follow verbatim the categories referred to in
Directive 2006/24. Pursuant to Article 1 §1, the providers are obliged to retain the
traffic and location data in order to be available to the competent authorities for
investigating, detecting and prosecuting very serious crimes.
131
2.4 Data Protection and Electronic Surveillance for Security
and Defence Purposes
National security is a constitutionally established reason for allowing restrictions on
the freedom of communication and protection of confidentiality under guarantees,
which shall be specified by law.
132 Due to its vagueness, the concept of national
security must be specified in each one case regarding personal data protection.
133 In
respect to processing of personal data on grounds of national security, certain
restrictions to the basic rules regarding data protection are provided for.
In particular, the processing of sensitive personal data is exceptionally allowed
when is carried out by a public authority and is necessary for the purposes of national
security or public health.
134 Even in such a case, the basic requirements for lawful
processing must be met.
135 The processing of other (simple) personal data is allowed
without the data subject’s consent when processing is necessary for the performance
of a task carried out in the public interest or carried out in the exercise of public
function by a public authority.
136 When the processing is carried out on national
130 Government Gazette A 22.
131 As defined by art. 4 L. 2225/1995.
132 Art. 19 § 1b of the Constitution.
133 See Alexandropoulou-Aigyptiadou (2016), p. 102.
134 Art. 7 § 2e L. 2472/1997.
135 As laid down by articles 4 and 5 L. 2472/1997. See also Iglezakis (2003), p. 238.
136 Art. 5 § 2d L. 2472/1997.
232
V. Kourtis