In August 2019, with the adoption of Article 10 of Law 4624/2019, the Greek Government introduced a significant legislative change that restricted the framework for personal data protection in Greece.
As a result of this amendment, the Hellenic Data Protection Authority (HDPA) lost its competence to supervise the processing of classified personal data by the National Intelligence Service (EYP).
In its 2022 Opinion, the HDPA highlighted that: “Questions arise as to the legality and constitutionality of this provision in light of Article 9A of the Greek Constitution and Convention 108, since, in essence, no personal data protection is provided when any activity involving the processing of personal data is carried out by the EYP.”
Nevertheless, the Greek Government failed to take these concerns into consideration.
In March 2026, a citizen attempted to exercise their personal data protection rights before the EYP. However, despite repeated communications, they received no response.
In June 2026, Homo Digitalis represented the data subject and filed a formal complaint with the Hellenic Data Protection Authority (HDPA) on their behalf.
The complaint calls for an investigation into whether the EYP has breached its legal obligations, clarification of the scope of the HDPA’s supervisory powers, and an examination of whether the EYP’s complete exemption from the oversight of an independent authority is compatible with Article 9A of the Greek Constitution and Greece’s international treaty obligations.