Last review date: 19 December 2024
Yes.
The restrictions or requirements are as follows:
☒ qualified right not to be subject to a decision based solely on automated decision making, including profiling – for example, only applicable if the decision produces legal effects concerning them or similarly significantly affects them
☒ right to information / transparency requirement
☒ right to request human review of the automated decision making
☒ other
Par. 1 of article 52 of Law 4624/2019 in accordance to article 11 of EU Directive 2016/680 provides that:
“1. It is prohibited to take a decision based solely on automated processing, including profiling, which produces adverse legal effects for the data subject or significantly affects him, unless expressly provided for by a statutory provision or Union law, which defines the appropriate guarantees for the rights and freedoms of the data subject and, as a minimum, includes arrangements guaranteeing the specific and indiscernible information of the data subject, the right to ensure human intervention on the part of the controller and the right of the data subject to formulate his views, to demand justification of the decision taken following said assessment and to challenge or request a review of the decision.”.
Last review date: 19 December 2024
Yes.
As provided in article 22 of the GDPR, the exceptions are as follows:
If the decision:
- is necessary for entering into, or performance of, a contract between the data subject and a data controller;
- is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights/freedoms and legitimate interests; or
- is based on the data subject's explicit consent.
Last review date: 19 December 2024
Please refer to the EU Chapter for detailed information regarding EU-wide legislation.
No guidance on this has been produced at a national level.
Last review date: 19 December 2024
No enforcement activity to date
Last review date: 19 December 2024
Please refer to the EU Chapter for detailed information regarding EU-wide legislation.
Yes, laws in force
Article 9 of Law 4961/2022, provides the following:
“Obligation to inform about the use of artificial intelligence in the labor sector
1. Any private sector enterprise, as long as it uses an artificial intelligence system, which affects any decision-making process concerning employees or prospective employees and has an impact on their working conditions, selection, recruitment or evaluation, in any case before its first use, provides sufficient and clear information to every employee or prospective employee, which includes the parameters on which the decision is based, without prejudice to the cases that require prior information and consultation and ensures compliance with the principle of equal treatment and the fight against discrimination in employment and work due to gender, race, color, national or ethnic origin, genealogy, religious or other beliefs, disability or chronic condition, age, family or social status, sexual orientation, gender identity or characteristics.
2. The obligation of par. 1 also applies to digital platforms within the meaning of article 68 of Law 4808/2021 (A' 101), in terms of natural persons connected to them by contracts of dependent work or independent services or work.
3. The administrative and criminal sanctions of Articles 24 and 28, respectively, of Law 3996/2011 shall be imposed on the business that violates the obligation of paragraph 1. The competent authority for imposing the administrative sanctions of the first paragraph is the Labor Inspection Body (S.E.P.E.).
4. The obligations set by this article do not in any way affect the obligations set by article 22 of the GDPR for automated individual decision-making, including profiling.”.
The European Parliament and the Council have reached a political agreement on the EU AI Act, which is now subject to formal approval by the European Parliament and the Council. The final text of the AI Act is currently not available but is expected early 2024.
The Digital Services Act (Regulation 2022/2065 of 19 October 2022 on a Single Market For Digital Services - “DSA”), which will be fully applicable as from 17 February 2024, sets forth specific restrictions with respect to certain uses of profiling. In particular, under Art. 26 (3) of the DSA, providers of online platforms may not present advertisements to recipients of the service based on profiling as defined in Art. 4 GDPR using special categories of personal data referred to in Art. 9 (1) GDPR. Furthermore, pursuant to Art. 28 (2) of the DSA, providers of online platforms may not present advertisements on their interface based on profiling (within the meaning of Art. 4 GDPR) using personal data of the recipient of the service when they are aware with reasonable certainty that the recipient of the service is a minor. Lastly, according to Art. 38 DSA, providers of very large online platforms and of very large online search engines that use recommender systems must provide at least one option for each of their recommender systems which is not based on profiling (within the meaning of Art. 4 GDPR).
It is also worth pointing out that according to Art. 15 of the Digital Markets Act (Regulation (EU) 2022/1925 of 14 September 2022 on contestable and fair markets in the digital sector), within 6 months after its designation, a gatekeeper must submit to the Commission an independently audited description of any techniques for profiling of consumers that the gatekeeper applies to or across its core platform services listed in the designation decision. The Commission will transmit that audited description to the European Data Protection Board.