HDPA investigates Greek Infrastructure Ministry for SMS sent without consent or

Athens, September 15, 2026 Ref. No.: Γ/ΕΞΕ/4029 DECISION 17/2026 (Plenary Session) The Data Protection Authority convened, following an invitation from the Acting Chairman and Deputy Chairman, Georgios Batzalexis, for a regular meeting via teleconference on Tuesday, July 28, 2026, in order to examine the case referred to below in the background section of this decision. Present via teleconference were the acting President, Vice President Georgios Batzalexis; the regular members Charalambos Anthopoulos and Spyridon Vlachopoulos as rapporteurs, and the regular members Konstantinos Lambrinoudakis, Christos Kalloniatis, Aikaterini Iliadou, and Gregorios Tsolias. Kalliopi Karveli and Anastasia Tritaki, experts, attended the meeting without voting rights, at the direction the Vice Chair, Kalliopi Karveli and Anastasia Tritaki, legal experts serving as assistant rapporteurs, Irini Papageorgopoulou as Secretary, and Georgia Palaiologou as the videoconference coordinator, all employees of the Authority’s Administrative Affairs Department.

The Authority took the following into account: Eighty-three (83) complaints against the Ministry of Infrastructure and Transportation regarding the receipt of a short message service (SMS) from the Ministry of Infrastructure and Transportation (hereinafter: MOT) prior to October 28, 2025, with the following content: “LAST YEAR DURING THE THREE-DAY WEEKEND OF OCTOBER 28, 14 PEOPLE LOST THEIR LIVES ON THE ROAD. IF YOU LOVE YOUR FAMILY, BE CAREFUL ON THE ROAD. MINISTRY OF TRANSPORTATION.” In response to these complaints, citizens protested in front of 1 1-3 Kifissias Avenue, 11523 Athens T: 210 6475 600 • E: contact@dpa.gr • www.dpa.grΑρχής regarding the receipt of this message without prior notification / consent and asked the Authority to investigate the lawfulness of the aforementioned processing, while some of them pointed out that, since they do not hold a driver’s license, the message in question did not concern them.

Specifically, the complaints and submissions filed by the complainants state the following: 1) The Ministry of Digital Governance, in violation of Article 14 of the General Data Protection Regulation, never informed the data subjects in advance that their processing for the purpose of sending them text messages, whereas it should have informed subscribers by any appropriate means that it was going to send this SMS, so that they would not be taken by surprise and would have the right to exercise their right to object. 2) The processing of data pertaining to all mobile subscribers , regardless of whether or not they are drivers, involves data that is neither appropriate nor relevant, nor is it limited to what is necessary for the purposes for which they are processed. This is because the receipt of the text message from a subscriber who is not a driver renders the processing of their data inappropriate, irrelevant, and concerning data that is not necessary for the purposes of raising drivers’ awareness of road safety. 3) The Ministry of Infrastructure and Transport wrongly invokes Article 6(1)(e) of the General Data Protection Code as “processing necessary for the performance of a task carried out in the public interest in the exercise of official authority.”

It also unjustifiably cites Article 25 of Law 4624/2019, which stipulates that processing is permitted. data for a purpose other than that for which it was originally collected, provided that the processing is “necessary” for purposes of national security or public safety. This invocation is unfounded, since road safety is indeed the responsibility of the Ministry of Transportation, but there is no legislative provision under which stipulates that the Ministry’s said authority may, for the purpose of raising awareness, also be exercised through the processing of personal data. Regarding the application of the necessity of processing personal data 2by state agencies for the purpose of fulfilling duties in the public interest involving citizens, without their consent, since the Administration is bound by the principle of lawfulness, it must always involve data processing that is legislatively mandated and for which it is expressly stipulates that the data subject’s consent is not required.

According to Opinion 06/2014 of the Art 29 Working Party of Directive 95/46 on the concept of the legitimate interests of the controller under Article 7 of the Directive (p. 21): “It covers circumstances in which the controller has a public authority or a public duty (but not necessarily a legal obligation to process data) and the processing is necessary for the exercise of that authority or the performance of that duty. 4) If the Ministry wanted to send a short text message content related to raising awareness about road safety, it was required to and could have initiated the specific procedure carried out through the Ministry of Digital Governance (not the Ministry of Infrastructure and Transportation) and applies only to citizens who had given their consent to the “National Citizen Communication Registry” so that public agencies could send them short text messages via the General Secretariat of the Ministry of Digital Governance.

However, this did not happen in this case, as instead of the Ministry initiating this established procedure, what actually happened was that the Ministry contacted the mobile phone providers, asking them to send their subscribers the message in question, without first seeking the consent of those specific citizens.In the case at hand, consent for the processing of the data was not given, and none of the other legal conditions set forth in subparagraphs (b) through (f) of this article; therefore, the processing of personal data in question was carried out without a lawful basis and, for this reason, is contrary to Article 6(1) of the General Data Protection Regulation (GDPR). 5) The Ministry of Digital Governance, as the controller, determined the purpose and means of processing. processing and that the mobile phone companies became “processors.” However, according to Article 28(3) of the GDPR, the mobile phone companies became “processors.”

However, according to Article 28(3) of the GDPR, the mobile phone companies became “processors.” 3to Union or Member State law, which binds the processor processing in relation to the controller and specifies the subject matter and duration of the processing, the nature and processing purpose, the type of personal data and the categories of data subjects, as well as the obligations and data subject rights of the controller. The said contract or other legal act specifically provides for items (a) through (h) of the relevant article of the General Data Protection Regulation. The Ministry, in its submission, did not present such contract to the Authority. Consequently, the Ministry has also violated article 28(3) of the General Data Protection Code. Consequently, the Authority, by letter ref. no. Γ/ΕΞ/348/21-01-2026, requested the Ministry of Transport and Communications to provide information regarding the dispatch of the aforementioned SMS, which included part of the complaints filed against it, and posed the following questions to the Ministry: 1) on the basis of which legal provisions was this sending took place, 2) what was the legal basis for this specific processing, 3) what was the purpose of the sending, as well as what was the source of the database from which the personal data of the citizens to whom the messages in question were sent was extracted, and 4) whether the messages were sent directly by the Ministry or through telecommunications providers.

In this regard, the Authority received memorandum No. Γ/ΕΙΣ/1729/06-02-2026 from the Ministry of Infrastructure, Transport, and Communications (MITC), along with the accompanying documents, in which the MITC asserted the following: 1) This specific awareness campaign was designed as a for prevention and raising awareness within the framework of a broader road safety strategy of the Ministry of Infrastructure, based on statistical data regarding traffic accidents, 2) The purpose does not fall within the regulatory scope of Article 11 of Law 3471/2006, since it had no connection whatsoever with the commercial promotion of products or services, 3) In the past, the Authority had endorsed similar initiatives by the Ministry of Health (see documents ref. nos. 1664/10.09.2002 and 1880/04.10.2006, in in which the Authority recognized that the Ministry’s cooperation with mobile phone providers to send road safety messages serves a public purpose), and that, as 4 present case, the factual circumstances (the need to reduce traffic accidents) and the legal framework (protection of life) remain unchanged, 4) The technical transmission of the messages was carried out by cellular service providers, without notification or transmission of the data to the Ministry of Digital Governance, following the Ministry’s specification of the method of transmission and the content of the message, and is based on Article 25 of Law 4624/2019, which permits the processing of personal data by private entities for a purpose other than that for which it was collected, provided that the processing is necessary to prevent threats to national security or public safety at the request of a public entity, 5) The processing was carried out to fulfill a task carried out in the public interest, in accordance with Article 6(1)(e) of the GDPR and Article 6(3) of the GDPR, which purpose was necessary (due to an increased statistical risk of accidents during those days), explicitly (clearly communicated to service providers), and legitimate (based on the Constitution, as well as on the Ministry of Infrastructure and Transport’s binding authority and positive obligation to protecting road safety and human life in accordance with the provisions of Article 1, para 1, subparagraph (e) of Presidential Decree 123/2017, the provisions of Law 5209/2025 (New Traffic Code) and the organizational structure of the Ministry), 6) SMS was selected as the implementation method because it is a suitable means of communication, as it is a non-intrusive, immediate, and universally accessible means of raising risk awareness, and in this way also serves the principle of minimizing the processing of personal data under the GDPR, 7) The existence of an increased risk during the three-day period of October 28 is scientifically documented in a technical report submitted by the Ministry of Health and before the Authority, and makes the implementation of this specific action necessary, 8) The purpose of the processing was, strictly speaking, proportionate, insofar as the purpose was the protection of human life, which outweighs the momentary inconvenience caused by an SMS. 5 The Authority then summoned the Ministry of Foreign Affairs via letter ref. no. Γ/ΕΞ/2201/14-05- 2026, to a hearing via teleconference on May 26, 2026, in order to present his views on the case.

During the May 26, 2026, session of the Authority’s Plenary Session, the following attended via teleconference: the Legal Advisor to the Deputy Minister, Mr. A; the authorized representative of the Legal Council of the Ministry of YYM B, the legal representative of the Legal Council of the Ministry of YYM C, and the DPO of the Ministry of YYM D, who presented their views and responded to the questions from the Chair, the members, the rapporteurs, and the assistant rapporteurs. Subsequently, they were given a deadline and submitted, within the deadline, the memorandum bearing ref. no. C/EIS/8369/09-06-2026 memorandum on time. Specifically, both during the hearing and in the relevant memorandum submitted by the respondent Ministry to the Authority following the hearing of its representatives, the Ministry of Tourism and Maritime Affairs stated the following: 1) The Ministry of Tourism and Maritime Affairs, taking into account the National Holiday of October 28, 2025, and the statistical data from previous years regarding increases in fatal traffic accidents during holiday travel periods, it deemed it necessary to take action to inform and raise awareness among drivers regarding road safety.

As part of this this initiative, the Ministry of Transport and Communications formally approached the Association of Mobile Telecommunications Companies, sending a letter from the Deputy Minister of the Ministry of Transport and Communications to the President of the Association of Mobile Telecommunications Companies, in which it was requested—at no cost to the Greek government—to investigate the technical feasibility of sending a mass text message to all citizens with content that promotes legal safety and the protection of human life. This initiative was carried out by mobile phone providers free of charge to all subscribers of each company as part of their corporate social responsibility programs using their own infrastructure, in accordance with the records and systems maintained by them, without any transfer of data to the Ministry. 2) The Ministry of Digital Governance did not collect, receive, possess, or use personal data of mobile phone subscribers, nor did it have access 6 to the databases or information systems of mobile telephone providers.

Furthermore, the Ministry did not request or receive any lists of phone numbers or other subscriber identification data, did not receive any communication records, had no knowledge of the recipients of the message , and did not maintain any records related to the sending of the message in question , and there was no technical interconnection or transfer of records. 3) The Ministry of Digital Governance’s sole involvement consisted of defining the purpose, which was served and implemented by sending the relevant message—specifically, in determining the text of the message and the public interest purpose served by sending that specific message. 4) The primary legal basis for the processing is Article 6(1)(e) of the GDPR in conjunction with Article 6(3) of the GDPR, as it is grounded in national legislation (Presidential Decree 123/2017, Law 5209/2025) that serves a public interest purpose and is proportionate to the intended lawful purpose; the technical implementation of the message transmission by mobile network providers is also based on Article 25(1)(a) (a) of Law 4624/2019, which permits private entities to process data for a purpose other than that of the original collection, provided that this is necessary to prevent threats to public safety at the request of a public authority.

Road safety is the fundamental operational manifestation of public security. Furthermore, the lawfulness of this specific processing is grounded in the provisions of Article 5, para 2, of the Constitution (protection of the life, dignity, and liberty of every person within Greek territory) and Article 21, para 3 (the State’s duty State to safeguard the health of citizens), as they impose an obligation on the State to take preventive measures against threats to human life. 5) The processing that took place is legally justified and, in practical terms, linked to a public interest purpose of the utmost importance; consequently, there is no illegality due to a violation of the legislation on personal data. 76) The specific measure of sending an SMS is appropriate, necessary, and proportionate, in accordance with the provisions of Article 5(1) of the GDPR. In particular, sending this specific SMS message is necessary for immediately informing and raising awareness among as many number of citizens, taking into account that, as common experience shows, the majority of them have a cell phone number, and (b) appropriate, given that it is a gentle, immediate, and universally accessible means of reminding people of the risks prior to a period of increased traffic on the road network, without imposing obligations or restrictions on citizens; and c) consistent with the principle of proportionality and processing minimization required by the GDPR, since a one-time notification was sent to citizens via a brief message, without the Ministry having become aware of or gained access to citizens’ personal data. 7) Regarding the complainants’ assertion that the Greek State had an alternative way to transmit the specific message to citizens’ cell phones via the VIBER App on the Greek Government’s account, such an action would not have served the intended purpose, since for a citizen to gain access to the information portal, they must first register for that account; consequently, it would not be possible to and raise awareness among all citizens regarding the issue of road safety, except for those who have registered for the Greek Government’s account on the relevant App. 8) Regarding the complainants’ allegations that the Ministry of Infrastructure and Transport could have used the “112” Service or the “National Communications Registry” Communications Registry” to send the specific message, a) the “112” Service constitutes, pursuant to Article 118 of Law No. 4727/2020, a public warning system that sends immediate messages to inform citizens located within a specific geographic area in cases of emergencies or dangerous weather events—and not for preventive notification—while b) EMEp 8 is a system for citizens to communicate with government agencies at the initiative of each interested citizen and has not been established to inform the public on public safety issues 9) The Ministry’s strategy, of which the SMS is an integral part, has led to the saving of 143 additional lives within one year. 10) The message in question does not fall within the regulatory scope of unsolicited messages promoting products and services (spam) under Article 11 of Law 3471/2006, because its purpose was to inform the public and it was sent free of charge, without links and without any inducement to purchase or financial consideration. 11) The moral harm alleged by the respondents consists of annoyance caused by receiving a single, one-time message—not recurring, which contained no offensive or intrusive content, was not personalized, and did not call for further communication; consequently, any minimal annoyance cannot take precedence over a preventive measure that serves a public purpose.

Finally, forty-four (44) respondents, following the request bearing ref. no. C/EIS/8370/9.6.26 for the issuance of the aforementioned memorandum by the Ministry of Health, which was provided to them by the Authority on June 10, 2026, argued, through their attorney of record, V. Sotiropoulos, in their memorandum bearing ref. no. C/EIS/8727/June 15, 2026, the following: 1) Two of the complainants filed a lawsuit against the Greek State seeking legal remedy of a lawsuit, seeking monetary compensation for the emotional distress they suffered, and the Court postponed the issuance of final decision and ordered the plaintiffs to submit to the Court clerk’s office, within sixty (60) days of the notification of the copies of the court decisions, a copy of the Authority’s decision regarding the plaintiffs’ pending complaints. 2) The Ministry of Digital Governance violated: (a) the principles of lawfulness, transparency, and no further processing for a purpose incompatible with the original purpose of data collection (Article 5 of the GDPR), b) the principle of lawfulness of processing, because it did not have consent or another legal basis for the processing the complainants’ data, for which it itself determined the purpose and means of processing (article 6 of the GDPR); (c) the rules on data processing in the context of the provision of electronic communications services, in that the Ministry of Digital Governance did not have the consent of the data subjects and the other conditions for processing traffic data without the data subjects’ consent were not met either (Articles 5 and 6 of Law 3471/2006); therefore, only through legislative regulation in accordance with article 15 of Directive 2002/58 would the measure in question affecting millions of mobile phone subscribers; (d) the obligation to inform data subjects about the processing of their data, as the Ministry did not inform the data subjects before sending the message (article 14 of the GDPR); (e) the obligation to implement data minimisation and apply data protection principles by design and by default (Article 25 of the GDPR), because, instead of the Ministry following the procedure of the National Citizen Communication Registry—where only those citizens are registered who have given their consent to receive updates from the Ministry of Digital Governance, the Ministry contacted the cell phone companies, requesting that they send the SMS to the respondents, disregarding the lack of consent from the data subjects; f) the obligation to conduct an impact assessment (Article 35 of the GDPR), given that the processing involved millions of natural persons who are mobile phone subscribers, (g) the obligation to enter into a contract with data processors (article 28 of the GDPR).

The Authority, after reviewing all the information in the file and conducting the oral hearing, having heard the rapporteurs and the clarifications provided by the rapporteurs’ assistants , who were present without voting rights and withdrew after the discussion of the case and before the deliberation and decision-making, following a thorough discussion 10 CONSIDERED IN ACCORDANCE WITH THE LAW 1. Whereas, in accordance with the provisions of Articles 51 and 55 of the General Regulation Data protection (EU) 2016/679 (hereinafter, the GDPR) and Article 9 of Law 4624/2019 (Government Gazette A 137), the Authority is competent to supervise the implementation of the provisions of the GDPR, this law, and other regulations concerning the protection of individuals with regard to the processing of personal data. In particular, it follows from the provisions of Article 57(1)(f) of the GDPR and Article 13(1)(g) of Law 4624/2019, it follows that the Authority has jurisdiction to address the complaints in question against the Ministry of Interior, as the complaints concern the processing of data included in a filing system within the meaning of Article 4, items 2 and 6 of the GDPR; therefore, such processing falls within the the regulatory scope of Article 2(1) of the GDPR and Article 2 of Law 4624/2019. 2.

Because, specifically, according to Article 4(1) of the GDPR, “personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one whose identity can be ascertained, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier identifier, or one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural, or social identity of that natural person.” 3. Furthermore, pursuant to Article 4(2) of the GDPR, the processing of is “any operation or set of operations performed with or without the use of automated means on personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, searching for information, use, disclosure by transfers, dissemination, or any other form of disclosure, interconnection or combination, restriction, 114.

Because article 4(7) of the GDPR defines a controller as “erasure, or destruction.” 114. Because article 4(7) of the GDPR defines a controller as “erasure, or destruction.” natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or the law of a Member State, the controller or the specific criteria for its designation may be be provided for by Union law or the law of a Member State,” while according to paragraph 8 of the same article, “processor” means the natural or legal entity, public authority, agency, or other body that processes personal data on behalf of the controller. 5. Because Article 5(1) of the GDPR sets forth the principles that must govern processing, and specifically: 1. Personal data: a) shall be subject to lawful and fair processing in a transparent manner in relation to the data subject (“lawfulness, fairness, and transparency”), b) collected for specified, explicit, and legitimate purposes and not subject to further processing in a manner incompatible with those purposes Further processing for archiving purposes in the public interest or for scientific or historical research purposes or statistical purposes shall not considered incompatible with the original purposes pursuant to Article 89 paragraph 1 (“purpose limitation”), (c) is appropriate, relevant, and limited to what is necessary for the purposes for which the data are processed (“data minimisation”). 6.

Furthermore, in accordance with the principle of accountability introduced by the second paragraph of the same article mentioned above, it is expressly stated that the controller “shall be responsible for and be able to demonstrate compliance with paragraph 1 (‘accountability’)”. This principle, which constitutes a cornerstone of the GDPR, entails the controller’s obligation to be able to demonstrate compliance. Furthermore, it enables the controller to verify and legally document any processing that is carried out in accordance with the legal bases provided by the GDPR and national data protection law. 127. Specifically, for a processing operation to be considered lawful (and in accordance with Article 5(1) of the GDPR), one of the legitimate grounds for processing provided for in Article 6(1) (subparagraphs (a) through (f)) GDPR, namely: “1. Processing is lawful only if and to the extent that at least one of the following conditions applies: (a) the data subject has consented to the processing of his or her personal data for one or specific purposes; (b) the processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the data subject’s request prior to the conclusion of a contract; c) the processing is necessary for compliance with a legal obligation to which the controller is subject; (d) the processing is necessary to protect the vital interests of the data subject or another natural person; e) the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, (f) the processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, unless such interests are are outweighed by the interests or data subject rights and freedoms that require data protection , in particular if the data subject is a child.

Point (f) of the first paragraph does not apply to processing of personal data Carried out by public authorities in the performance of their duties.” Furthermore, in accordance with paragraphs 2 and 3 of the same article mentioned above: 2. The Member States may maintain or adopt more specific provisions to adapt the application of the rules of this Regulation with regard to processing to comply with paragraph 1(c) and (e), by specifying more precisely specific requirements for processing and other measures to ensure lawful and legitimate processing…. 3. The basis for the processing referred to in paragraph 1(c) and (e) shall be determined in accordance with: (a) Union law, or (b) the law of the Member State to which the controller is subject. 13The processing purpose is determined by that legal basis or, with respect to the processing referred to in paragraph 1(e), is the necessity of the processing for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller . 8.

Because in order for personal data to be lawfully processed—that is, processed in accordance with the requirements of the GDPR—the the conditions for the application and observance of the principles set forth in article 5(1) of the GDPR must be cumulatively met, as is also evident from the decision of the Court of Justice of the European Union (CJEU) of January 16, 2019, in Case C-496/2017 Deutsche Post 1 AG v. Hauptzollamt Köln. The existence of a legal basis (Article 6 of the GDPR) does not exempt the controller from the obligation to comply with the principles (Article 5(1) of the GDPR) regarding lawfulness, necessity, and proportionality, as well as the principle of data minimization. In the event that any of the principles set forth in Article 5(1) of the GDPR are violated, the processing in question is deemed unlawful (contrary to the provisions of the GDPR) and there is no need to examine the conditions for the application of the legal bases set forth in Article 6 of the GDPR.

Thus, the unlawful collection and processing of personal data in violation of the principles of Article 5 of the GDPR is not remedied by the existence of a legitimate purpose and a legal basis. 9. Furthermore, the identification and selection of the appropriate legal basis from among those provided for in Article 6(1) of the GDPR is closely linked to the principle of lawful or fair processing as well as with the principle of purpose limitation . In particular, the selection of the legal basis for the processing of must take place before processing begins, and the controller is obligated, based on the principle of accountability (see Article 5(2) in conjunction with Articles 24 and 32 of the GDPR) to 1“57. However, any processing of personal data must comply, on the one hand, with the principles regarding data quality set forth Article 6 of Directive 95/46 or Article 5 of Regulation 2016/679 and, on the other hand, with the fundamental principles of lawful data processing listed in Article 7 of that Directive or Article 6 of that Regulation (see decisions of May 20, 2003, Österreichischer Rundfunk et al., C- 465/00, C-138/01, and C-139/01, EU:C:2003:294, paragraph 65, as well as the judgment of May 13, 2014, Google Spain and Google, C-131/12, EU:C:2014:317, paragraph 71).” 14select the appropriate legal basis from among those provided for in Article 6(1) of the GDPR, as well as be able to demonstrate, in the context of internal compliance framework that it has complied with the principles of Article 5(1) of the GDPR, including, of course, the documentation on the basis of which it arrived at the relevant legal basis.

Furthermore, the GDPR adopted a new compliance model, the central pillar of which is the aforementioned principle of accountability, within framework of which the data controller is required to design, implement, and generally adopt the necessary measures and policies to ensure that the processing of the data is in accordance with the relevant legal provisions. Furthermore, the controller bears the additional duty to demonstrate on their own and at any time that they are in compliance with the principles of Article 5 (1) of the GDPR. It is no coincidence that the GDPR incorporates accountability (as already mentioned in Article 5(2) of the GDPR) into the regulation of the principles (Article 5(1) of the GDPR) governing processing, thereby endowing it with the function of a compliance mechanism , effectively reversing the “burden of proof” regarding the lawfulness of the processing (and, more generally, compliance with the principles of article 5(1) of the GDPR), shifting it to the controller, so that it can reasonably be argued that the controller bears the burden of invoking and proving the lawfulness of the processing 2. 10.

Furthermore, in accordance with Article 14 of the GDPR, when personal data have not been collected from the data subject, the data controller processing must provide the data subject with information, among other things, regarding the identity and contact details of the controller and, where applicable, the controller’s representative, the contact information of the data protection officer, where applicable, the purposes of processing for which the personal data are intended, as well as the legal basis for the processing, the relevant categories of personal data, the recipients or categories of recipients of the personal data, the period for which the personal data will be stored or, where this is not possible, the 2 See, in this regard, DPA decisions 26/2019, para. 7, and DPA 43/2019, para. 6. 15criteria determining that period, the existence of the right to submit an access request or a request for rectification to the controller erasure of personal data or restriction of processing concerning the data subject and the right to object to processing, as well as the right to data portability, and the source from which the personal data originate.

Furthermore, according to paragraph 4 of the same article, when the controller intends to further process personal data for a purpose other than that for which the personal data were collected, the The controller must provide the data subject, prior to such further processing, with information regarding that purpose. 11. Furthermore, in accordance with Article 28(3) of the GDPR: 3. Processing by the processor is governed by a contract or other legal act subject Union or Member State law, which binds the processor in relation to the controller and specifies the subject matter and duration of the processing, the nature and processing purpose, the type of personal data, and the categories of data subjects data, as well as the obligations and rights of the controller. 12. Furthermore, in accordance with paragraph 1(a) of Article 25 of Law 4624/2019: The processing of personal data by private entities for a purpose other than that for which it was collected is permitted, provided that it is necessary: (a) to prevent threats to national security or public safety upon request by a public authority.

At this point, it should be noted that the Authority, in its Opinion No. 1/2020, has taken a position on the aforementioned provisions of Articles 24, 25, and 26 of Law 4624/2019, regarding their compatibility with EU law and the provisions of the GDPR. Specifically, according to the explanatory memorandum of Law 4624/2019, article 25 provides or establishes a “national legal basis” for the processing of personal data for a purpose other than that for which the data were originally collected. The provisions of Articles 24, 25, and 26 of the law concern the further 16processing of personal data, namely the case of processing for a purpose other than that for which the data were originally collected, only provided that the subsequent processing is compatible with the purposes of the initial collection, in accordance with the principle of purpose limitation under Article 5(1)(para 1)( (b) of the General Data Protection Regulation (GDPR).

In this case, no legal basis separate from that which authorized the collection of the data is required. Furthermore, it follows from the provisions of Article 6(2) and (3) of the General Data Protection Regulation, it follows that the national legislature is permitted to retain or adopt more specific provisions to adapt the App the rules regarding processing to comply with cases (c) (legal obligation of the controller) and (e) (performance of a task in the public interest or in the exercise of official authority vested in the controller), of para 1 of article 6 of the General Data Protection Regulation (GDPR), specifying more specifically the specific requirements for the processing and other measures to ensure lawful and legitimate processing. 13. Because in this case, an examination of all the evidence in the case file and the oral proceedings reveals that the Ministry of Education, taking into account the National Holiday of October 28, 2025, and the statistical data from previous years regarding increases in fatal traffic accidents during the travel periods of during national holiday periods, deemed it necessary to take action to inform and raise drivers’ awareness regarding road safety.

In context of this initiative, it formally addressed the Association of Mobile Telephone Companies, sending a letter from the Deputy Minister of Infrastructure, Transport, and Networks to the President of the Association of Mobile Telecommunications Companies, requesting—at no financial cost to the Greek government—that the technical feasibility of sending a mass text message to all citizens with content that promotes road safety and the protection of human life. This initiative was carried out by mobile phone providers free of charge to all subscribers of each company as part of their corporate social responsibility, using their own infrastructure, in accordance their own records and systems, without any transfer of data to the Ministry. 17Specifically, the Ministry of Digital Governance, as the controller, sent the mobile telecommunications providers the email in question, and they, in their capacity as processors acting on behalf of the Ministry, forwarded it to their subscribers for the purpose of promoting road safety, which constitutes a specific aspect of public safety and the protection of the public interest.

This processing is consistent with the principles of lawfulness processing set forth in Article 5(1) of the GDPR, because it was necessary to immediately inform and raise awareness among as many citizens as possible, appropriate, given that it constitutes a mild and direct means of reminding people of the risks prior to a period of increased traffic on the road network, without imposing obligations or restrictions on citizens or unduly infringing upon the personal rights and freedoms of data subjects, and consistent with the principles of proportionality and data minimization required by the GDPR, provided that citizens were notified once via a brief message, without the Ministry having knowledge of or access to the personal data of citizens. Furthermore, the legal basis for this specific processing was the promotion and protection of road safety—that is, a public interest purpose in accordance with the provisions of Article 6 para. 1 item e) of the GDPR in conjunction with Article 6 para. 3 of the GDPR, since article 1(1)(e) of Presidential Decree 123/2017 provides that, among other things, the mission of the Ministry of Infrastructure and Transport is to formulate and implement a comprehensive national policy to promote road safety and safe mobility, through coordinated actions and large-scale interventions.

Furthermore, the transmission of the message by the mobile service providers acting as processors was carried out lawfully in accordance the provisions of Article 25(1)(a) of Law 4624/2019, which allows private entities to process data for a purpose other than that of the original collection, provided that this is necessary to prevent threats to public safety at the request of a public authority, as in the case at hand. 1814. It should be noted in this regard that, according to Article 4 of the Preamble to the GDPR, an integral part of the right to the protection of personal data also includes its “social function,” which consists in the fact that it serves not only the individual purposes of its holder, but also social or collective purposes. As this article explicitly states—which constitutes a fundamental rule of interpretation of the GDPR— “The processing of personal data should be intended to serve human beings.

The right to data protection is not an absolute right; it must be assessed in relation to its function in society and balanced against other fundamental rights, in accordance with the principle of proportionality” (see, e.g., K. Nolan, “Data Protection’s Function in Society: A Search for the Limits of a Non-Absolute Right,” in: European Journal of Law and Technology, 1/2025). The social function of the right to the protection of personal data is an expression of the principle of solidarity, which is gaining an increasingly prominent place in data protection law (see, for example, the principle of “data altruism” in the European Data Governance Act), and is enshrined as a general principle of the Greek constitutional order in article 25, §4 of the Constitution. The principle of solidarity takes on particular significance when balancing the right to the protection of personal data (Article 9A of the Constitution) against social or collective interests other than those of the rights holder.

As the Council of State has also held on another occasion (see Council of State Plenary Session 1147/2022), the principle of solidarity under Article 25, §4 of the Constitution constitutes, in certain cases, when—upon balancing constitutional interests—the pursuit of supra-individual purposes takes precedence, an acceptable limit on the exercise of individual rights “given that…these are realized within the context of society as a whole” (see C. Anthopoulos, Article 25, in: E. Venizelos, The Greek Constitution: An Article-by-Article Interpretation, Volume 1, 2025, pp. 1310–1359). In the case under consideration here, which concerns the secondary use of simple personal data (cell phone numbers) by mobile phone providers upon request by the Ministry of Infrastructure and Transport, for the purpose of promoting road safety—the promotion of which is an essential component of public health and public safety (Article 25 of Law 4624/2019), arises from Article 25, Section 4 of the Constitution—the obligation of the holder of the right under article 9A of the Constitution to tolerate momentary inconvenience caused by an SMS designed to raise awareness and social awareness regarding the problem of traffic accidents and tragedies in Greece, even without prior notification and consent.

The prevention of traffic accidents and incidents, which in Greece constitute a veritable scourge, with enormous human, social, and economic costs, undoubtedly constitutes an aspect of the state’s duty to protect fundamental rights under Article 25(1)(b) of the Constitution. In this regard, the processing of personal data in question finds an independent legal basis in Article 6(1)(e) of the GDPR, as the fulfillment of a task carried out in the public interest and in the exercise of public authority. In view of the nature of the specific data, the importance of the intended purpose, the effectiveness of choosing this specific means compared to other alternatives, the minimal intrusion this entails for the data subject, and taking into account the urgent nature of this initiative by the Ministry of Infrastructure, due to the statistically proven increase in traffic accidents and incidents during periods of mass travel, such as the three-day weekend of October 28, the sending of these text messages does not raise any issues with regard to respect for the principle of proportionality.

It is also justified to send these messages to all mobile phone subscribers and not only to drivers, since in the area of road safety it is necessary to raising awareness throughout society. However, in cases of similar actions, it is appropriate that a) the Ministry of Transport inform the data subjects accordingly, in accordance with the provisions of Article 14 of the GDPR; b) upon sending the first email, data subjects who receive these such messages to opt out of receiving similar messages in the future; and c) in the event that the sending of such messages is outsourced to processors, i) such delegation be provided for in a contract or other legal act that binds the processor in relation to the controller and specifies the scope and duration of the processing, the nature and purpose 20of the processing, the type of personal data, and the categories of data subjects, as well as the obligations and data subject rights of the controller and the processor, and ii) to inform the data subjects accordingly, as provided for in the provisions of Article 28 of the GDPR.