5.4.1. Overview of the Provisions of the Presidential Decree 75/2020

PD 75/2020 governs all the surveillance systems installed and operating at public spaces, provided that they process personal data, regardless of their technical specifications (Articles 1 and 2).

The restrictively designated public authorities that are competent for the prevention, investigation, detection, or prosecution of crimes, or the enforcement of criminal sanctions, namely the Hellenic Police, the Hellenic Fire Service, and the Hellenic Coast Guard, are considered as data controllers (Article 4).

The installation and operation of surveillance systems in public spaces is permitted only to the extent necessary, and when the objectives pursued cannot be achieved equally effectively using less restrictive means, in a specific place and for a specific period of time, following a reasoned decision of the competent authority. This decision has a validity term of no longer than three years, is subject to periodical evaluation and is issued following the conduct of an impact assessment study. Finally, it is promptly sent to the competent public prosecutor for district court judges. In particular, with regard to crime prevention or repression, it is required that there is adequate evidence that the offences subject to the PD were committed (Articles 5 and 12).

The collection and processing of sound data is only exceptionally allowed, following a specifically reasoned decision of the data controller, which is approved by the competent public prosecutor, for the purpose of detecting and recognizing the persons involved in specific punishable acts, including forest arson by negligence (Article 7).

Strict rules have also been established concerning the retention period, the complete and automatic destruction of the data without the right to retrieve them, and the anonymization of the data kept exceptionally for educational purposes (Article 8), the data recipients, and the safe and unimpeachable transfer of data (Article 9), and the rights of the data subjects, especially the right of information (Article 10).

Furthermore, organisational and technical safety measures are imposed with regard to the technical specifications and the operation of the surveillance systems, for the purpose of minimizing the impact on the right to personal data protection, in accordance with the accepted international standards, as well as the minimum safety measures (users' training,

<sup>51</sup> Government Gazette, Series I, No. 173/ 10 September 2020.

creation of separate accounts, and user authentication, data encryption, etc.) are explicitly provided for (Article 11).
