The COVID-19 Pandemic as a Stress Test on the Right to Protection of Personal Data: The Case of Greece
Niovi Vavoula · eucrim – The European Criminal Law Associations Forum · 2021
This article aims to critically examine the limitations to the fundamental right of personal data protection in Greece by exploring three instances in which the rules and practices have put the protection of personal data under significant pressure: (1) the processing of information on individuals who obtain movement permits via SMS; (2) the tracking of COVID-19 patients; and (3) the guidelines on the management of the COVID-19 crisis by the Hellenic Data Protection Authority (DPA). The article argues that the Greek response to COVID-19 has been fraught with over-restrictive measures that go beyond what is necessary and proportionate in a democratic society. In particular, the requirement of obtaining movement permits via SMS, which has been inserted through soft law, thus without parliamentary scrutiny, has relativized data protection and has lowered individuals’ resistance to future surveillance practices marking everyday movement as a matter of interest to the state. In relation to contact tracing the article demonstrates that an excessive retention period of patients’ data is foreseen. As for the DPA’s guidelines on the processing of personal data within the framework of COVID-19 it is concluded that they have provided an unclear and overly permissible interpretation of the GDPR rules in favour of the state.