[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUOpnRHeYOOdQ1du3qjBQnJy8OlESN13eqQnpwiChrEs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"3a988165-ecd2-49c5-89df-966544ed8b78","greek-dpa-blocks-unlawful-child-abuse-image-transfer-scheme-over-gdpr-failures","eb96b959-5ce0-4d72-9b23-4fe8eb68f69e","Greek DPA Blocks Unlawful Child Abuse Image Transfer Scheme Over GDPR Failures","The HDPA found that a proposed Ministerial Decision requiring healthcare professionals to photograph and transfer child abuse injury images to law enforcement lacked a sufficient statutory legal basis, violating foundational GDPR requirements for processing sensitive data. The draft also failed the data minimization principle by not restricting photography strictly to clinically necessary findings, and omitted mandatory data security safeguards and a Data Protection Impact Assessment (DPIA). This case illustrates that even well-intentioned public policy initiatives involving special category data must be grounded in robust legal frameworks before implementation. Without proper GDPR compliance architecture — including legal basis, DPIA, and security measures — such schemes expose both data subjects and institutions to serious legal and reputational risk.","**Policy and Legal Basis Review:**\n- Conduct a formal legal basis assessment before drafting any policy that involves processing sensitive or special category personal data.\n- Engage Data Protection Officers (DPOs) and legal counsel at the earliest stage of policy design to identify GDPR compliance gaps.\n\n**Data Protection by Design:**\n- Apply data minimization principles explicitly in policy drafts, defining precisely what data may be collected, by whom, and under what conditions.\n- Mandate a Data Protection Impact Assessment (DPIA) as a prerequisite for any public sector initiative involving health or child-related personal data.\n\n**Governance and Oversight:**\n- Establish a formal inter-agency review process requiring DPA consultation before ministerial decisions involving personal data processing are finalized.\n- Implement ongoing compliance monitoring to ensure that approved policies remain aligned with evolving data protection regulations.",[12,13,14,15,16,17,18],"GDPR Article 32","GDPR Article 35","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 14: Security Awareness and Skills Training","NIS2 Article 21(2)(b)","ISO\u002FIEC 27001:2022 Clause 7.2: Competence",{"GDPR Article 32":20,"GDPR Article 35":21,"NIS2 Article 21(2)(b)":22,"NIST SP 800-53 SI-2: Flaw Remediation":23,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":24,"CIS Control 14: Security Awareness and Skills Training":25,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":26},"The draft Ministerial Decision failed to include adequate technical and organizational security measures for the transfer of sensitive health images, which Article 32 explicitly requires for processing personal data.","Processing photographs of child abuse injuries constitutes high-risk processing of special category data, making a Data Protection Impact Assessment mandatory under Article 35 — a step the draft omitted entirely.","NIS2 requires incident handling and risk management policies for entities handling sensitive data; the absence of security and incident response planning in the draft violated the spirit of these obligations for health sector actors.","While procedural rather than technical, the absence of a proper legal and policy framework represents an unaddressed systemic flaw; structured review processes, as encouraged by SI-2 principles, would have identified and corrected the deficiency before deployment.","The draft's failure to incorporate GDPR requirements reflects a competence gap among those responsible for its design, which ISO\u002FIEC 27001 Clause 7.2 addresses by requiring organizations to ensure personnel have the necessary knowledge to fulfill data protection responsibilities.","Policymakers and healthcare professionals involved in drafting the proposal lacked sufficient data protection awareness to recognize GDPR compliance requirements, underscoring the need for targeted privacy and security training.","The lack of defined security controls for image capture and transfer represents a vulnerability in the proposed data handling process that ISO\u002FIEC 27001 governance structures would require to be identified and remediated.","published","2026-10-19T10:21:05.11134+00:00","2026-10-19T10:21:05.085+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=HDPA_(Greece)_-_Opinion_11\u002F2026&diff=53448&oldid=0","hdpa-greece-opinion-11-2026-80bc19","HDPA (Greece) - Opinion 11\u002F2026",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]