HDPA (Greece) - Opinion 11/2026
Greek DPA issues negative opinion on draft child abuse protocol due to GDPR non-compliance.
The Hellenic Data Protection Authority (HDPA) issued a negative opinion on a draft Ministerial Decision concerning a child abuse protocol. The protocol would require healthcare professionals to photograph suspected child abuse injuries and transfer them to law enforcement. The HDPA found that the draft decision lacked an adequate statutory legal basis, failed to meet GDPR requirements for data security and integrity (Articles 25 and 32), and mandated a Data Protection Impact Assessment (Article 35) which was not performed.
AI summary of the linked source. Not reviewed by an editor. How this works
Run HDPA?
Get an email when a new story names HDPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Hellenic Data Protection Authority found that a proposed ministerial protocol requiring healthcare professionals to photograph and transfer images of suspected child abuse injuries to law enforcement lacked a sufficient legal basis and failed to meet core GDPR requirements. Critically, no Data Protection Impact Assessment (DPIA) was conducted before drafting the decision, despite the clearly high-risk nature of processing sensitive data relating to children and criminal matters. This case illustrates that even well-intentioned public health and safety initiatives must be grounded in proper legal frameworks and privacy-by-design principles from the outset. Failure to engage data protection authorities and conduct required assessments early in policy development wastes resources and delays legitimate child protection goals.