controller,
143 except if s(he) gave the relevant consent.
144 Under Law 2472/1997, the
compensation payable for non-material damage was set at the amount of at least two
million drachmas (about 6000 euros), unless the plaintiff claimed a lesser amount for
compensation, or the breach was due to negligence.
145 Areios Pagos held that the
minimum threshold provided for compensation is contrary to the Constitution.
146
Under Law 3471/2006, the compensation is set at the amount of at least 10,000
euros, unless the plaintiff claims a lesser amount. The claims shall be litigated
according to the Code of Civil Procedure, notwithstanding whether the Authority
has issued a relevant decision or whether criminal charges have been filed.
The new Law 4624/2019 recognizes the right of the data subject who considers
that his/her rights under the GDPR or Directive 2016/680 or other data protection
legislation have been infringed as a result of the processing to bring an action before
the Greek courts against the controller or processor claiming compensation (art. 40).
The data subject has the right to mandate a not-profit body or organisation or
association, which has statutory objective the protection of data subjects’ rights
and freedoms with regard to the protection of their personal data to exercise his/her
rights to seek judicial redress for compensation (art. 41).
2.5.2 Criminal Sanctions
The earlier Greek data protection legislation
147 as well as the new Law 4624/2019
provides for criminal sanctions: In particular, anyone who unlawfully interferes in
any way with a personal data file or takes notice of such data or extracts, alters, hurts,
destroys, processes, transfers, discloses, makes accessible to unauthorized persons or
permits such persons to take notice of such data or anyone who exploits such data in
any way, will be punished by imprisonment. If the offences mentioned above
concern special categories of data or data relating to convictions or security measures, the perpetrator will be punished by a term of imprisonment of between 1 and
5 years and by a fine ranging from 10,000 to 100,000 euros. If the perpetrator
purported to jeopardize the free functioning of democratic government or national
security, the sanctions imposed shall be imprisonment for a period at least of 5 years
and by a fine ranging from 100,000 to 300,000 euros. If the perpetrator of any of the
acts mentioned above purported to gain unlawful benefit on his/her behalf or on
behalf of another person or to cause harm to a third person, s/he shall be punished by
a term of imprisonment of at least 3 years and by a fine ranging from 100,000 to
143 See Augoustianakis (2011), pp. 673 ff.
144 See Areios Pagos no. 1284/2017.
145 See Areios Pagos no. 476/2009.
146 Areios Pagos no. 252/2018 (A 2). The same opinion was expressed in the past by academics, see
Kornilakis (2002), p. 435.
147 See articles 22 L. 2472/1997 and 15 L. 3471/2006. On the criminal sanctions see also
Anastassopoulos (2016), pp. 421 ff.; Nouskalis (2005).
234
V. Kourtis
143 except if s(he) gave the relevant consent.
144 Under Law 2472/1997, the
compensation payable for non-material damage was set at the amount of at least two
million drachmas (about 6000 euros), unless the plaintiff claimed a lesser amount for
compensation, or the breach was due to negligence.
145 Areios Pagos held that the
minimum threshold provided for compensation is contrary to the Constitution.
146
Under Law 3471/2006, the compensation is set at the amount of at least 10,000
euros, unless the plaintiff claims a lesser amount. The claims shall be litigated
according to the Code of Civil Procedure, notwithstanding whether the Authority
has issued a relevant decision or whether criminal charges have been filed.
The new Law 4624/2019 recognizes the right of the data subject who considers
that his/her rights under the GDPR or Directive 2016/680 or other data protection
legislation have been infringed as a result of the processing to bring an action before
the Greek courts against the controller or processor claiming compensation (art. 40).
The data subject has the right to mandate a not-profit body or organisation or
association, which has statutory objective the protection of data subjects’ rights
and freedoms with regard to the protection of their personal data to exercise his/her
rights to seek judicial redress for compensation (art. 41).
2.5.2 Criminal Sanctions
The earlier Greek data protection legislation
147 as well as the new Law 4624/2019
provides for criminal sanctions: In particular, anyone who unlawfully interferes in
any way with a personal data file or takes notice of such data or extracts, alters, hurts,
destroys, processes, transfers, discloses, makes accessible to unauthorized persons or
permits such persons to take notice of such data or anyone who exploits such data in
any way, will be punished by imprisonment. If the offences mentioned above
concern special categories of data or data relating to convictions or security measures, the perpetrator will be punished by a term of imprisonment of between 1 and
5 years and by a fine ranging from 10,000 to 100,000 euros. If the perpetrator
purported to jeopardize the free functioning of democratic government or national
security, the sanctions imposed shall be imprisonment for a period at least of 5 years
and by a fine ranging from 100,000 to 300,000 euros. If the perpetrator of any of the
acts mentioned above purported to gain unlawful benefit on his/her behalf or on
behalf of another person or to cause harm to a third person, s/he shall be punished by
a term of imprisonment of at least 3 years and by a fine ranging from 100,000 to
143 See Augoustianakis (2011), pp. 673 ff.
144 See Areios Pagos no. 1284/2017.
145 See Areios Pagos no. 476/2009.
146 Areios Pagos no. 252/2018 (A 2). The same opinion was expressed in the past by academics, see
Kornilakis (2002), p. 435.
147 See articles 22 L. 2472/1997 and 15 L. 3471/2006. On the criminal sanctions see also
Anastassopoulos (2016), pp. 421 ff.; Nouskalis (2005).
234
V. Kourtis