Greece is once again at the center of a heated debate over surveillance and privacy, as the government pushes forward a controversial new bill despite lingering public outrage over the country’s recent wiretapping scandal. The illegal surveillance of ministers, politicians, military officials, and journalists has already shaken the country, with a majority of Greeks-seven in ten, according to polls-holding Prime Minister Kyriakos Mitsotakis responsible for covering up the affair. Given the deep distrust surrounding the state’s handling of surveillance, especially as the trial over the Predator spyware scandal and the executives of Intellexa and Krikel unfolds, many expected the Greek government to adopt a more cautious approach to issues of privacy and data protection. Instead, the proposed legislation has triggered fresh concerns.
The bill, titled "Reorganization of the Structure of the Hellenic Police and the Enhancement of Uniformed Personnel Training – Modernization of Electronic Monitoring for Defendants, Convicts, and Prisoners on Leave – Regulation of Prisoner-Related Issues and Other Provisions," introduces extensive new powers for law enforcement. At the heart of the controversy is the expanded authority granted to the police’s Intelligence Management and Analysis Directorate (DIDAP), allowing it to collect and process information with limited oversight. Critics warn that the bill lacks clear mechanisms for accountability, raising fears over potential abuses.
A particularly contentious element is the role of the National Passenger Data Unit (MSE), which would gain access to airline passenger records (PNR) without well-defined safeguards regarding necessity and proportionality. Experts caution that this broad mandate could lead to mass surveillance, exceeding legal limits. Additionally, there is no clear framework for how Greece will share this data with international agencies like Europol, adding to transparency concerns.
The proposed law also grants DIDAP personnel access to sensitive databases without any dedicated oversight mechanism. The retention of passenger data for five years has been flagged as excessive and potentially in violation of the EU’s General Data Protection Regulation (GDPR). Furthermore, the bill does not establish an independent evaluation process to assess whether depersonalized data should be kept beyond six months. The lack of judicial approval before collecting personal data is seen as a major threat to privacy.
The level of supervision over DIDAP’s activities remains unclear, as there is no requirement for regular reporting to Parliament or independent regulatory bodies such as the Hellenic Authority for Communication Security and Privacy (ADAE) and the Data Protection Authority (DPA). The absence of defined procedures for imposing disciplinary or criminal penalties in cases of data misuse leaves significant legal gaps and increases the risk of unchecked surveillance.
Another controversial provision in the bill allows the police intelligence unit to collect information from private individuals without clear privacy protections. Critics argue that the classification of information based on "security levels" could enable secret data processing without transparent review mechanisms. At the same time, police union representatives are barred from staffing the intelligence unit, raising concerns over discrimination and restrictions on labor rights. The selection process for personnel remains opaque, as appointments are left entirely to police leadership without clear meritocratic criteria.
The legislation also fails to provide sufficient clarity on how passenger data will be transferred to third countries, leaving questions about whether Greece is complying with European Union data protection standards. The bill’s provision for the creation of an "electronic platform for lifting confidentiality" has sparked additional alarm, with opposition figures warning that it could facilitate unchecked government access to private data.
Opposition parties attempted to involve ADAE in the parliamentary review process for the sections concerning DIDAP, arguing that an independent regulatory opinion was necessary. However, the government’s majority refused to allow ADAE’s participation.
Nasos Iliopoulos, an MP from the left-wing New Left party, sharply criticized this decision, stating, “The government continues to fear ADAE. Today, discussions began in the parliamentary committees on the Ministry of Citizen Protection’s bill. Among its provisions are articles concerning DIDAP, effectively the police’s own intelligence service, which was involved in the wiretapping scandal. As New Left, we proposed that ADAE be among the institutions called to testify on the bill. The government majority, however, blocked this. They are so afraid they cannot even tolerate a single statement from ADAE in a parliamentary committee. They are as fearful as the guilty should be.”
