“25/5/2018 – 25/5/2025: 7 years of GDPR”
On the occasion of the completion of 7 years since the implementation of the General Data Protection Regulation (GDPR), the President of the Hellenic DPA Konstantinos Menoudakos held a press conference on Tuesday, May 27th, at the Journalists’ Union of Athens Daily Newspapers. In the context of his leaving office, Mr. Menoudakos presented an overview of the seven-year period from 25/5/2018 to 25/5/2025 and also referred to the challenges that the Independent Authority is facing. This was followed by a Q&A and discussion with media representatives.
In the key points of his introductory speech, the President of the Authority noted, among other things, the following:
- “The GDPR has strengthened the rights of data subjects, that is, individuals, and consequently the obligations of data controllers. It defined methods to ensure compliance with the legislation, as well as stricter sanctions for those who violate the rules. It also enhanced the cooperation between national supervisory authorities. Overall, the Regulation doesn’t constitute only a new legislative framework but it also introduced a new culture of responsibility and compliance.”
- “Despite the lack of sufficient resources, the Authority responded to the maximum possible extent to the responsibilities and duties assigned to it by the European Regulation and national law. Among its many activities, it examined important issues and issued numerous decisions, opinions, and guidelines, while also placing emphasis on informing and raising awareness among data subjects and data controllers/processors.”
- “In a rule of law, every processing of personal data must be carried out for a specific purpose and must be provided for by law. This is not only the view of the Authority or of peer supervisory authorities but also the consistent case law of the Court of Justice of the European Union and the European Court of Human Rights. Dispassionate weighing and appropriate safeguards are needed based on risk. The Hellenic DPA does not make policy but assists to ensure that policies comply with the legislation.”
- “The Authority makes systematic efforts to inform and raise awareness regarding the protection of personal data and to provide suitable tools to facilitate compliance with data protection rules. In this context, it recently launched the unified space of its new digital tools, which are now available on its website: https://www.dpa.gr/online-toolkits.”
- “The GDPR has become a global standard and is simultaneously at the center of new legislation for the unified digital market in Europe. A series of EU laws, included in its digital and data strategy, have started to be implemented or are about to be — laws that ‘interact’ to a greater or lesser extent with the GDPR and generally raise personal data issues.”
- “There are two essential prerequisites for independent authorities, and especially the Hellenic DPA, to fulfill their role: Securing the Authority’s independence and ensuring the necessary means for its effective operation. Regarding the second, the Authority faces serious problems. It is imperative to strengthen the human resources and funding of the Authority, to exempt the Authority from the lengthy ASEP (Supreme Council for Civil Service Personnel) procedures, and to strengthen the Authority institutionally through amendments to the provisions of national Law 4624/2019, for which a relevant proposal has long been submitted to the Ministry of Justice with draft provisions. Additionally, over the last two years, the Authority is confronted with the very serious problem of inadequate office space.”
- “In Greece, strengthening independent authorities and ensuring their effective operation is not a priority for governments. As Professor Spyros Vlachopoulos, a member of our Authority, often says, political parties ‘love’ independent authorities when they are in the opposition and question them when in government. Sometimes, I would add, this questioning is expressed through statements that give the impression of pressure or threats that undermine their prestige and credibility. It seems that in Greece, the political system has not internalized that in a mature democracy, counterweights to power are not only the courts but also the independent authorities, at least the constitutionally enshrined ones, within their respective competencies. However, to avoid any misunderstandings about the Authority, I find it necessary to clarify that during my term, the Authority performed its work without influence from interventions by anyone, even in cases of broader interest that became a matter of dispute among political parties.”
- “Society and citizens have great expectations from the Hellenic DPA, and we have a duty to meet those expectations. For this purpose, I repeat that the competent state bodies must take the necessary initiatives, within their jurisdiction, to provide the Authority with the necessary resources.”
- From 2018 to 20/5/2025:
- The Hellenic DPA imposed fines amounting to €36,586,149 (including the €20 million fine on Clearview).
- 9,069 complaints have been filed.
- 6,916 complaints have been handled.
The President of the Journalists’ Union of Athens Daily Newspapers, Maria Antoniadou, and Members of the Hellenic DPA were present. President Menoudakos was accompanied by the General Director of the Secretariat, Dr. Vasilis Zorkadis, the Head of the Directorate of Supervision, Dr. George Rousopoulos, and the Head of the Independent Department of Communication and Public Relations, Dr. Elias Athanasiadis.
Independent Department of Communication and Public Relations
