date on a public authority for failing to take appropriate security measures during the
processing of taxpayers’ personal data.
153
The new Law 4624/2019 provides that, without prejudice to its corrective powers
according to art. 58 § 2 of the GDPR, the Data Protection Authority is empowered to
impose the administrative fines provided for by article 83 §§ 4, 5 and 6 of the GDPR.
3 The International Dimension of Data Protection
3.1 The Territorial Scope of the Rules on Data Protection
The outgoing Law 2472/1997, implementing Directive 95/46, based its territorial
scope on the criterion of the place of establishment of the controller/processor or the
place in which the equipment used for the purposes of the personal data processing
was situated. Specifically, Greek Law was applicable to any personal data
processing, which was carried out by a controller or a processor established on the
Greek territory, or in a place where the Greek law was applicable by virtue of
international law, e.g. a Greek embassy.
154 A conflict of laws rule was established
for intra-community cases, according to which the data protection law of the member
state in which the controller was established applied, regardless of the place where
the equipment was situated.
A controller is considered to be established in Greece when s/he exercises
effective and real activity through stable arrangements in the country. The “form
of the arrangements, for example, whether they are carried out through a branch or a
subsidiary, is not relevant”.
155 The term “establishment” was given a broad interpretation by CJEU in the well-known decisions rendered on the cases Spain Google
and Weltimmo.
156 According to that case-law, the concept of establishment in
Greece within the meaning of Directive 95/46 and Law 2472/1997 extends to any
real and effective activity, even a minimal one, exercised through stable arrangements in Greece and the presence of only a representative in Greece can be sufficient
to constitute a stable arrangement. This reasoning of the Court was replicated by the
language of the GDPR. Under Regulation, of high importance is the concept of
“main establishment”.
157
153 DPA decision no. 98/2013.
154 Art. 3 § 3 L. 2472/1997.
155 See recital 19 of Directive 95/46; see also recital 22 GDPR.
156 CJEU, 13.05.2014, C-131/12, Google Spain v Agencia Española, ECLI:EU:C:2014:317;
01.10.2015, C-230/14, Weltimmo v NAIH., ECLI:EU:C:2015:639.
157 See art. 4 (16) GDPR.
236
V. Kourtis
processing of taxpayers’ personal data.
153
The new Law 4624/2019 provides that, without prejudice to its corrective powers
according to art. 58 § 2 of the GDPR, the Data Protection Authority is empowered to
impose the administrative fines provided for by article 83 §§ 4, 5 and 6 of the GDPR.
3 The International Dimension of Data Protection
3.1 The Territorial Scope of the Rules on Data Protection
The outgoing Law 2472/1997, implementing Directive 95/46, based its territorial
scope on the criterion of the place of establishment of the controller/processor or the
place in which the equipment used for the purposes of the personal data processing
was situated. Specifically, Greek Law was applicable to any personal data
processing, which was carried out by a controller or a processor established on the
Greek territory, or in a place where the Greek law was applicable by virtue of
international law, e.g. a Greek embassy.
154 A conflict of laws rule was established
for intra-community cases, according to which the data protection law of the member
state in which the controller was established applied, regardless of the place where
the equipment was situated.
A controller is considered to be established in Greece when s/he exercises
effective and real activity through stable arrangements in the country. The “form
of the arrangements, for example, whether they are carried out through a branch or a
subsidiary, is not relevant”.
155 The term “establishment” was given a broad interpretation by CJEU in the well-known decisions rendered on the cases Spain Google
and Weltimmo.
156 According to that case-law, the concept of establishment in
Greece within the meaning of Directive 95/46 and Law 2472/1997 extends to any
real and effective activity, even a minimal one, exercised through stable arrangements in Greece and the presence of only a representative in Greece can be sufficient
to constitute a stable arrangement. This reasoning of the Court was replicated by the
language of the GDPR. Under Regulation, of high importance is the concept of
“main establishment”.
157
153 DPA decision no. 98/2013.
154 Art. 3 § 3 L. 2472/1997.
155 See recital 19 of Directive 95/46; see also recital 22 GDPR.
156 CJEU, 13.05.2014, C-131/12, Google Spain v Agencia Española, ECLI:EU:C:2014:317;
01.10.2015, C-230/14, Weltimmo v NAIH., ECLI:EU:C:2015:639.
157 See art. 4 (16) GDPR.
236
V. Kourtis