HDPA (Greece) - Opinion 11/2026
Greek DPA issues negative opinion on child abuse protocol mandating photo transfer.
The Greek Data Protection Authority (HDPA) issued a negative opinion on a draft Ministerial Decision that would require healthcare professionals to photograph suspected child abuse injuries and transfer these images to law enforcement. The HDPA found that the draft lacked an adequate statutory legal basis, violated data minimization principles by failing to restrict photography to necessary findings, and did not meet GDPR requirements for data security and impact assessments.
AI summary of the linked source. Not reviewed by an editor. How this works
Run HDPA?
Get an email when a new story names HDPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe HDPA found that a proposed Ministerial Decision requiring healthcare professionals to photograph and transfer child abuse injury images to law enforcement lacked a sufficient statutory legal basis, violating foundational GDPR requirements for processing sensitive data. The draft also failed the data minimization principle by not restricting photography strictly to clinically necessary findings, and omitted mandatory data security safeguards and a Data Protection Impact Assessment (DPIA). This case illustrates that even well-intentioned public policy initiatives involving special category data must be grounded in robust legal frameworks before implementation. Without proper GDPR compliance architecture — including legal basis, DPIA, and security measures — such schemes expose both data subjects and institutions to serious legal and reputational risk.