The Greek data protection authority issued an opinion on a draft joint ministerial decision concerning the implementation of an electronic application for submitting candidacies for youth council elections.

The authority made several observations and recommendations to the Ministry of the Interior. It first raised a question about the legal basis of the decision, noting that the enabling law does not seem to authorize the co-signature by the Deputy Minister of Economy and National Finance. Regarding data processing, the draft provides for an "exclusively automated" eligibility check. The authority recommends specifying the exact conditions of this check and ensuring compliance with Article 22 of the GDPR, notably by guaranteeing the possibility of human intervention and contestation of the decision.

The authority also examined the intention to send informational messages to users of the Gov.gr Wallet application. It recalled the purpose limitation principle of Article 5 paragraph 1 point b) of the GDPR, the initial purpose of this application being identity verification, and asked the ministry to justify the legality of this new processing under Article 6 paragraph 4 of the GDPR. Furthermore, it questioned the allocation of roles of data controller between the ministry and the municipalities, suggesting to reassess whether the ministry might rather act as a processor or if both entities should be qualified as joint controllers. Finally, the authority insisted on the transparency obligation, requiring that complete information on the processing of personal data be published on the websites of the ministry and the municipalities.