The Hellenic Data Protection Authority issued an opinion on the draft bill implementing the Artificial Intelligence Regulation, highlighting concerns about its resources and independence to assume its new tasks.

The Data Protection Authority (DPA) expressed reservations about the draft bill, considering it insufficient in terms of human and organizational resources to cope with the new powers assigned to it. It recommended the creation of a Directorate for the supervision of artificial intelligence systems and requested specific measures to guarantee its independence in recruitment and personnel management, in accordance with Article 52, paragraph 5 of the GDPR, as well as financial incentives to attract and retain experts. In response, the government accepted some proposals, such as the possibility of an exceptional two-year mobility cycle and participation in selection committees, but rejected requests for exemption from recruitment restrictions and salary incentives for budgetary reasons.

The opinion also addresses several technical points of the draft bill, designating the DPA as the market surveillance authority for prohibited, high-risk AI systems and those subject to transparency obligations. The Authority made recommendations to clarify cooperation mechanisms with other entities, notably the National Telecommunications and Post Commission (EETT), and to review the complaint handling procedure, particularly the transfer of competence in case of deadline overruns. It also proposed amendments concerning the collection of fines, suggesting they be managed by the tax administration, and requested the power to decide on the anonymization of published sanction decisions to protect sensitive data.