[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWJCfRLNsKlWdqOBaT7FWh5M-aEP95RzeS6Ac9euo6rA":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"eb96b959-5ce0-4d72-9b23-4fe8eb68f69e","HDPA (Greece) - Opinion 11\u002F2026","hdpa-greece-opinion-11-2026-80bc19","Created page with \"{{DPAdecisionBOX |Jurisdiction=Greece |DPA-BG-Color= |DPAlogo=LogoGR.jpg |DPA_Abbrevation=HDPA |DPA_With_Country=HDPA (Greece) |Case_Number_Name=Opinion 11\u002F2026 |ECLI= |Original_Source_Name_1=HDPA |Original_Source_Link_1=https:\u002F\u002Fwww.dpa.gr\u002Fsites\u002Fdefault\u002Ffiles\u002F2026-10\u002F%CE%93%CE%9D%CE%A9%CE%9C%CE%9F%CE%94%CE%9F%CE%A4%CE%97%CE%A3%CE%97%2011_2026_anonym.pdf |Original_Source_Language_1=Greek |Original_Source_Language__Code_1=EL |Original_Source_Name_2= |Original_Source_...\" Show changes","The Greek Data Protection Authority (HDPA) issued a negative opinion on a draft Ministerial Decision that would require healthcare professionals to photograph suspected child abuse injuries and transfer these images to law enforcement. The HDPA found that the draft lacked an adequate statutory legal basis, violated data minimization principles by failing to restrict photography to necessary findings, and did not meet GDPR requirements for data security and impact assessments.","Greek DPA issues negative opinion on child abuse protocol mandating photo transfer.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_Opinion_11\u002F2026&diff=53448&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F49\u002FLogoGR.jpg","2026-10-19T09:01:32+00:00","2026-10-19T10:00:04.561297+00:00",7,[17,20],{"name":18,"type":19},"HDPA","vendor",{"name":21,"type":22},"GDPR","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,33,38,43],{"category":30},{"id":31,"icon":25,"name":21,"slug":32},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":34},{"id":35,"icon":25,"name":36,"slug":37},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":39},{"id":40,"icon":25,"name":41,"slug":42},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":44},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":48,"vendors":49},[],[],{"slug":51,"title":52,"body":53,"framework_refs":54,"framework_notes":62},"greek-dpa-blocks-unlawful-child-abuse-image-transfer-scheme-over-gdpr-failures","Greek DPA Blocks Unlawful Child Abuse Image Transfer Scheme Over GDPR Failures","The HDPA found that a proposed Ministerial Decision requiring healthcare professionals to photograph and transfer child abuse injury images to law enforcement lacked a sufficient statutory legal basis, violating foundational GDPR requirements for processing sensitive data. The draft also failed the data minimization principle by not restricting photography strictly to clinically necessary findings, and omitted mandatory data security safeguards and a Data Protection Impact Assessment (DPIA). This case illustrates that even well-intentioned public policy initiatives involving special category data must be grounded in robust legal frameworks before implementation. Without proper GDPR compliance architecture — including legal basis, DPIA, and security measures — such schemes expose both data subjects and institutions to serious legal and reputational risk.",[55,56,57,58,59,60,61],"GDPR Article 32","GDPR Article 35","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 14: Security Awareness and Skills Training","NIS2 Article 21(2)(b)","ISO\u002FIEC 27001:2022 Clause 7.2: Competence",{"GDPR Article 32":63,"GDPR Article 35":64,"NIS2 Article 21(2)(b)":65,"NIST SP 800-53 SI-2: Flaw Remediation":66,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":67,"CIS Control 14: Security Awareness and Skills Training":68,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":69},"The draft Ministerial Decision failed to include adequate technical and organizational security measures for the transfer of sensitive health images, which Article 32 explicitly requires for processing personal data.","Processing photographs of child abuse injuries constitutes high-risk processing of special category data, making a Data Protection Impact Assessment mandatory under Article 35 — a step the draft omitted entirely.","NIS2 requires incident handling and risk management policies for entities handling sensitive data; the absence of security and incident response planning in the draft violated the spirit of these obligations for health sector actors.","While procedural rather than technical, the absence of a proper legal and policy framework represents an unaddressed systemic flaw; structured review processes, as encouraged by SI-2 principles, would have identified and corrected the deficiency before deployment.","The draft's failure to incorporate GDPR requirements reflects a competence gap among those responsible for its design, which ISO\u002FIEC 27001 Clause 7.2 addresses by requiring organizations to ensure personnel have the necessary knowledge to fulfill data protection responsibilities.","Policymakers and healthcare professionals involved in drafting the proposal lacked sufficient data protection awareness to recognize GDPR compliance requirements, underscoring the need for targeted privacy and security training.","The lack of defined security controls for image capture and transfer represents a vulnerability in the proposed data handling process that ISO\u002FIEC 27001 governance structures would require to be identified and remediated."]