Data protection & privacy law in Greece (2026)

Eight individuals whose phones were confirmed infected with Predator spyware filed a civil suit against Intellexa and 13 individuals including founder Tal Dilian, each seeking €1 million for moral harm. The action marks the first major civil damages phase of Greece's multi-year surveillance scandal.

An Athens court found Tal Dilian (Intellexa founder), Sara Hamou, Felix Bitzios, and Yiannis Lavranos guilty of breaching telecommunications confidentiality and illegally accessing information systems; each received eight-year suspended sentences. The conviction marked the criminal conclusion of the 2022 Predatorgate affair that had exposed state-linked spyware use against 90+ public figures.

The Hellenic DPA found Vodafone violated GDPR Articles 5, 28, and 32 by failing to implement adequate technical/organisational measures, inadequately supervising its processor, and providing inaccurate data to prosecutors. The separate processor fine signals HDPA's intent to hold processors directly accountable.

HDPA penalised the Greek Ministry of Interior for leaking personal data of Greek nationals living abroad that was subsequently used in political email campaigns. The case underscored persistent state-sector compliance failures and the HDPA's willingness to sanction central government ministries.

HDPA found the Ministry of Migration and Asylum used AI-powered surveillance (drones, cameras, sensors) and biometric fingerprint systems in refugee camps without a lawful basis or adequate DPIA, imposing the largest fine ever levied against a Greek public body at that time. The ruling set boundaries on state use of AI at borders.

PASOK leader Nikos Androulakis disclosed his phone had been targeted by Predator spyware, triggering a national and European Parliament investigation into state-linked surveillance in Greece; HDPA later confirmed 220 malicious SMS messages had infected 92 smartphones. The scandal prompted the resignation of the prime minister's chief of staff and the head of the National Intelligence Service.

Signed into force 15 months after GDPR's application date (after an EU infringement referral for late transposition of the Law Enforcement Directive), Law 4624/2019 repealed Law 2472/1997, re-established and expanded the HDPA, supplemented GDPR provisions with national specifics, and transposed Directive 2016/680. Critics noted deviations that created legal uncertainties.

Greece's most extensive constitutional revision (affecting 70+ articles) inserted Article 9A, giving every person an explicit constitutional right to protection against electronic collection and processing of personal data, and constitutionally mandating an independent supervisory authority (the HDPA). This elevated data privacy to a fundamental right alongside traditional privacy under Article 9.

Greece's first comprehensive data-protection statute implemented EU Directive 95/46/EC and created the HDPA as an independent public authority with powers to investigate complaints, impose administrative sanctions, and issue guidance. It remained the primary data-protection framework for over 22 years until replaced by Law 4624/2019.