We call the Greek DPA to temporarily block the inclusion of the Personal Number on new ID cards until the necessary risk mitigation measures are implemented!
Since June, the Hellenic Police (EL.AS.) has been issuing ID cards that display the Personal Number (P.A). for citizens who already have one. As of tomorrow, June 28, 2025, it will no longer issue an ID card to any citizen who is eligible for a P.A. but has not yet completed the required issuance process.
In its Opinion 1/2025, the Hellenic Data Protection Authority (HDPA) states that displaying the P.A. on ID cards poses risks and must therefore be accompanied by specific mitigation measures.
However, despite the fact that the Greek State proposed certain measures to the HDPA, which were approved as appropriate, it has failed to implement them, thereby exposing citizens to severe risks of identity theft.
For example, one of the proposed measures was the adoption of legal provisions prohibiting private entities from keeping photocopies of ID cards. This legislative step must be paired with coordinated and intensive public awareness campaigns to ensure that citizens know they should not allow copies of their physical ID to be retained.
At the end of its analysis, the HDPA concludes that, since the risks associated with including the P.A. on ID cards remain, once a sufficient period has passed during which mitigation measures are applied and public authorities are equipped with the necessary tools for digital reading of the P.A., the display will no longer be necessary and the obligation to display the P.A. on the ID card should be lifted.
For these reasons, on Friday, June 20, we submitted a formal request (Ref. No. Γ/ΕΙΣ/5621/20-06-2025), urging the HDPA to exercise its powers under Article 58(2)(f) of the GDPR, and impose a temporary restriction on processing, by prohibiting the display of the P.A. on ID cards until the essential mitigation measures are properly in place to address the significant risks arising from this practice.
Our request is available here (only in EL).
We prepared an explanatory video on the Greek DPA's Decision on the new ID cards
On Monday 23/9 the Hellenic Data Protection Authority (DPA) issued Decision 32/2024, which relates to the new identity cards for Greek citizens.
The Authority found deficiencies regarding the provision of general information to data subjects, and further found that the required data protection impact assessment was carried out late and deficient. For these reasons, it imposed an administrative fine of EUR 150,000 on the Ministry of Citizen Protection, as controller, for the above infringements, while at the same time it issued a compliance order to the Ministry within six months. Finally, the Authority pointed out the obligation to update and codify the legal framework regarding the details of the new type of identity cards for Greek citizens.
The Decision 32/2024 of the Hellenic Data Protection Authority is available here.
The Homo Digitalis team has prepared a short explanatory video in plain language to highlight some important points of this Decision.
The video is available here.