The Hellenic Data Protection Authority launches an investigation into the National Intelligence Service (EYP), following a complaint filed by us!

As early as 1997, data protection legislation did not exempt the National Intelligence Service (EYP) from the Authority’s supervisory oversight. Furthermore, the EYP’s internal regulations have required the Service to comply with personal data protection legislation since 2008. However, in 2019, the Mitsotakis government, through Law 4624/2019, restricted the Authority’s competence to oversee the processing of classified personal data by the EYP.

In November 2022, the HDPA itself, in an opinion submitted to the Ministry of Justice, highlighted serious concerns regarding the constitutionality of the legal framework and the effective protection of personal data processed by the EYP. The Authority’s recommendations were not incorporated into the revision of the legislative framework in December 2022 by the then Minister of Justice, Konstantinos Tsiaras.

In March 2026, a citizen represented by our organisation attempted to exercise their personal data protection rights before the EYP by submitting an access request, invoking specific provisions of the law. The EYP failed to respond to the request. As a result, in June 2026, we filed a formal complaint with the Authority.

In October, we were informed that the Authority had launched an investigation into our complaint, requesting that the EYP respond to specific questions concerning its failure to address the citizen’s access request. This is an important development in our efforts to clarify the EYP’s obligations and establish the extent to which the processing of personal data by the Service is subject to independent oversight.

The crucial question remains: How can the protection of personal data be guaranteed in practice when such data is in the hands of the National Intelligence Service?

National security and the protection of fundamental rights must go hand in hand, supported by clear rules, meaningful safeguards, and effective oversight.