Harmonisation of the Presidential Decree 75/2020 with the GDPR and the Police Directive

PD 75/2020 makes explicit reference to the general application of Regulation (EU) 2016/679 (GDPR) and Directive (EU) 2016/680 (Police and Criminal Justice Authorities Directive), but it further specifies special rules, which are harmonised with the principles derived from Article 5 of GDPR and Article 4 of the Directive, as analysed above.

Firstly, as far as the principles of lawfulness, fairness, and purpose limitation are concerned, the PD limits the collection and processing of personal data exclusively to the purposes restrictively specified by the authorising legal provision of Article 14 of Law 3917/2011 (Articles 1 and 3). Such a procession is subject to a decision provided by the competent public authority (Article 12) when the above objectives cannot be achieved equally effectively using less restrictive means, and, in particular, with regard to crime prevention or repression, provided that there is adequate evidence that the crime was committed, and, in any case, provided that the collection and processing is necessary (Articles 5 and 6).

Secondly, referring to the implementation of the principle of transparency, according to the PD, data collection and processing is contingent upon the prior notification to the public prosecutor, the gathering organiser, the data subjects, and the public, as appropriate, with any expedient means, and primarily with the means explicitly specified in its provisions (Articles 6 and 10). The foregoing obligation to notify the public prosecutor and the public also includes the notification of the decision of the competent public authority on the operation of a surveillance system (Article 12). Data subjects always have the right to request and receive information about the data concerning them and any recipients of the processing (Article 10 par. 3).

Thirdly, data minimisation principle is clearly reflected in the PD, which limits the installation and operation of surveillance systems to the specific necessary space, and prohibits expansion thereof to a broader area and collection of data from non-public spaces or homes, image focus is allowed only for the detection of crimes (Article 5), while sound data collection and processing is in principle prohibited (Article 7).

Furthermore, specific provisions have been set in order to ensure storage limitation. According to the PD, the maximum data retention period is, in principle, 15 days, with certain exceptions that serve the needs of the criminal court procedure, while specifically in the case of public gatherings, the maximum data retention period is 48 hours. In addition, integrity and confidentiality (security) are pursued through specific provisions in the PD. The automatic destruction of personal data is provided in a manner that precludes retrieval thereof, and in the case of their exceptional retention for educational purposes. The PD includes also provisions for data anonymization and compliance with the confidentiality obligation (Articles 6 and 8), and for ensuring, using suitable technical means, not only secure transfer of data, but also that the transferred data cannot possibly be distorted in an unperceivable manner (Article 9). Moreover, the data controller is subject to all the necessary organisational and technical security measures (Article 11), which are aligned with Article 25 of the Regulation, or Article 20 of the Directive.

Finally, the designation of the public authorities acting as data controllers, the establishment of the legislative framework of their liability (Article 4), and the establishment of special requirements for the issuance of a decision on the installation and operation of surveillance systems (Article 12) integrate the principle of accountability in the PD.

## Critical Assessment of the Provisions of Presidential Decree 75/2020

The draft PD 75/2020 was submitted to the DPA, in accordance with the law, which issued its Opinion No. 3/2020, where, presenting an analysis of the Greek and European legal framework on personal data protection, and having particularly focused to ECtHR and CJEU case law, it stressed that certain provisions needed to be amended in order to be compatible with the International and European Union Law. Compliant with the recommendations of the DPA, the final text of the PD constitutes a strict set of rules that integrate the principles of modern protection of personal data at an international and EU level.

Although the principle of proportionality is not explicitly mentioned at any point in the text of PD 75/2020, Article 5, which sets the conditions and criteria for the installation and operation of surveillance systems, introduces the special condition of implementation of the principle of necessity and the principle of appropriateness, as manifestations of the principle of proportionality. In addition, Article 8, with respect to the retention period and the destruction of data, also follows the recommendations of the DPA regarding the respect of the principle of proportionality52. Besides, the authorizing legal provision of PD 75/2020 explicitly stipulates that this PD should aim at setting the criteria for complying with the principle of proportionality<sup>53</sup> .

It is also to underline that Articles 11 (Organizational and Technical Security Measures) and 12 (Decision on the Installation and Operation of Surveillance Systems) provide not only for the conduct of an impact assessment study at the stage of personal data processing, but also for the conduct of an impact assessment study concerning the installation, commissioning, and procurement of the surveillance systems, the software, and the additional equipment in general. Therefore, impact assessment accompanies the surveillance system and any accompanying item or equipment already from the stage of procurement thereof until installation, operation, and processing of the collected material. Such a provision is of great importance, since impact assessment at the time of the determination of the means for processing is essential for data protection by design and by default. In this sense, legal framework set by the PD not only follows in a timeliest manner current European trends on personal data protection but also forms the necessary legal background for any other future laws regarding the use of remote sensing technologies, including possible specialized legislation for environmental protection.

However, there are some points in which PD 75/2020 did not fully comply with the recommendations of the DPA. Thus, contrary to DPA's recommendations, Article 5 (installation and operation of surveillance systems) did not encompass any provision specifying clearly the criteria based on which surveillance in a specific space is evaluated as necessary, or the precise procedural requirements and the necessitated guarantees of supervision and control of the relevant measure. Similarly, Article 9 (data recipients) did not incorporate DPA's recommendation for a procedure of control and supervision by an independent authority in the case of transfer of data (except for the cases of transfer to administrative authorities acting as third parties where the transfer is approved by the public prosecutor). Finally, in Article 10 (Rights of data subjects), DPA's recommendations for special provisions for each surveillance system, and for persons who have lost their eyesight, so that the obligation of informing data subject could be most successfully achieved, were not taken into account.

Moreover, even at the points where the PD conforms to the DPA's recommendations, it is not certain that the final wording of the provisions is always correct. Thus, despite adding to Article 8 (Data retention period and destruction) the criteria on which the justified suspicions for preparing or committing in the future offences are assessed, pursuant to the Authority's recommendations, as a reason for exceptional extension of the data retention period, the criteria encompass the wording "any kind of relevant information54", which is rather ambiguous, and possibly leaves room for unauthorized extension of the data retention period. These shortcomings are indicative of the necessary adjustments for the lawful use of remote sensing technologies for all purposes and especially for environmental purposes.

<sup>52</sup> DPA, Opinion 3/2020, Available online: https://www.dpa.gr/sites/default/files/2020-07/gnomodotisi%203\_2020.pdf (accessed on 5 April 2021).

<sup>53</sup> Law 3917/2011, Article 14 (4).

<sup>54</sup> Article 8 of the PD: " . . . justified suspicions for preparing or committing in the future the above criminal acts may stem from witnesses' testimonies or from any kind of relevant information".
