Greek DPA Rejects Child Abuse Protocol for GDPR Non-Compliance
Written by AI from the linked story. Not reviewed by an editor. How this works
The Hellenic Data Protection Authority found that a proposed ministerial protocol requiring healthcare professionals to photograph and transfer images of suspected child abuse injuries to law enforcement lacked a sufficient legal basis and failed to meet core GDPR requirements. Critically, no Data Protection Impact Assessment (DPIA) was conducted before drafting the decision, despite the clearly high-risk nature of processing sensitive data relating to children and criminal matters. This case illustrates that even well-intentioned public health and safety initiatives must be grounded in proper legal frameworks and privacy-by-design principles from the outset. Failure to engage data protection authorities and conduct required assessments early in policy development wastes resources and delays legitimate child protection goals.
Tactical Insight
Immediate actions
- Halt or revise any draft policy or protocol that processes sensitive or special-category personal data until a full DPIA is completed and documented.
- Engage the relevant Data Protection Authority (DPA) for prior consultation before finalising any high-risk data processing decisions as required under GDPR Article 36.
Policy and legal foundation
- Establish a clear statutory legal basis for every data processing activity in public sector protocols, explicitly mapping each processing operation to a GDPR Article 6 and Article 9 lawful basis.
- Embed privacy-by-design and privacy-by-default principles (GDPR Article 25) into the drafting process for all ministerial decisions that involve personal data.
- Define and enforce technical and organisational security measures (encryption, access controls, secure transfer channels) for any protocol mandating transfer of sensitive imagery to third parties.
Long-term improvements
- Implement a mandatory data protection review checklist that all ministerial and legislative drafting teams must complete before any decision involving personal data is circulated for approval.
- Establish ongoing training for public sector legal and policy teams on GDPR obligations, DPIA triggers, and the role of the DPA in the legislative process.