The Commissioner for Personal Data Protection has issued answers to questions about the implementation of measures here in Greek.
We translated these unofficially and will circulate any official translation:
- In relation to my personal data, how the Decree of the Minister of Health dated. 08.07.2021, is it different from the previous Decrees?
Under the previous Decrees, the employer had the right to check the certificates of its employees on a sample basis. Now, he/she has to check that all employees have a certificate for Rapid test or PCR of 72 hours or for recovery from Covid-19 or for vaccination.
In previous Decrees, the owners / managers / managers of certain places, such as leisure centers, restaurants, gyms, etc., were not obliged to check their customers’ certificates. Now, they have the obligation to check them and ask the customers to show their identity card or passport. External premises of businesses, which serve less than 20 people, are excluded from this obligation.
- Does the Decree dated 08.07.2021, in relation to the previous ones, violate the legislation for the protection of personal data?
No. What is different is that this Decree creates additional obligations due to the current epidemiological situation.
- What is the role of the Commissioner in relation to these Decrees?
The role of the Commissioner is to advise the state when drafting legislation on issues of personal data protection and to ensure that their provisions are in accordance with the General Data Protection Regulation. The Principle of Proportionality requires that the obligations created by a Decree are proportionate to the purpose pursued at the time. In this case, the current epidemiological situation requires and may justify the additional obligations.
- Are these measures legal and proportionate?
Yes, in relation to the current epidemiological situation. However, because they are more intrusive in relation to the measures of previous Decrees, the Commissioner, in the context of the legal consultation, demanded and ensured that, in this Decree, there is a legal basis for the owner / manager / administrator of the site to check the certificate I have as well as my ID card or passport.
- In my workplace, how will the certificate I hold be checked?
In each case, the responsibility for the control lies with the employer (paragraph 2.82 of the Decree dated 08.07.2021). In workplaces where there is a Safety and Health Officer under the relevant Legislation, the control of the certificates should be done by this Officer.
If a company is exempt from the obligation to appoint a Safety and Health Officer and there is no authorized private security guard, the control should be performed by the employer.
Also, in workplaces, checks can be carried out by the Police and depending on the activity of the company, by the authorized Officers mentioned in paragraph 2.48 (c) of the Decree dated 08.07.2021.
In the event that an employee refuses to show the certificate he holds, the employer should take steps to ensure that both he and the employee comply with this Decree.
- In a cafe, restaurant, hotel, gym, etc., how will the control be done?
In each case, according to paragraph 2.48 (a) of the Decree, the responsibility of control lies with the owner / manager / administrator of the space.
- How can I be sure that the person conducting the audit is an authorized official, Officer or Police Officer?
I can ask him to show me his police or service ID or his warrant.
- Can my employer record details of the certificate I hold?
As the Decree shows, yes. This is because he must be able to know which of his employees have been vaccinated and / or become ill and have recovered and are therefore exempt from the obligation to present certificates for a 72-hour Rapid test or PCR. He or she must also be able to know when the 72-hour Rapid Test or PCR certificates of employees holding such certificates expire. It is understood that in no case is it justified to provide a copy of the certificate.
- Can the owner / administrator / manager of a location covered by the Decree record details of the certificate I hold or my identity / passport?
No. The last Decree does not give him the right, nor does it oblige him to keep my information.
- In what other cases is it allowed to record my certificate details?
Exceptional recording of this information is only allowed in special cases, such as in hotels where it should be checked that a customer’s stay does not exceed the validity period of the certificate he/she holds. In any case, the person in charge of the site must be able to prove that some data must be recorded.
- If I arrange a party or reception at a hotel or leisure center or restaurant, will I be responsible for checking in with my guests?
No. According to paragraph 2.48 (a) of the Decree, the responsibility always lies with the owner / manager / manager of the site.
- Do the measures provided for in this Decree also apply to the European Digital Certificate (EuropeanUnionDigitalGreenCertificate – EUDCC)?
No. The EUDCC is used for travel purposes only. It may not be used for the purposes of this Decree.
- If I do not have the certificate I have with me, could I use my EUDCC?
No, because according to the Decree, the EUDCC does not constitute evidence. The Commissioner is in consultation with the Ministries concerned so that, if it is necessary to regulate the use of EUDCC within the Republic, this is in accordance with the conditions set by the European EUDCC Regulation.
- If the epidemiological situation improves, can the Commissioner request the suspension of some provisions of a Decree?
Yes. If the epidemiological situation improves and the Commissioner considers that the provisions of a Decree are no longer in accordance with the General Regulation of Personal Data, she may request their temporary suspension, until the amendment or repeal of the Decree.