• EL - ελληνικά
  • EN - English
Parliamentary question - E-007026/2020(ASW)Parliamentary question
E-007026/2020(ASW)
European Parliament

Answer given by Mr Reynders on behalf of the European Commission

10.3.2021

Written question

Transparency and accountability are key principles under the General Data Protection Regulation (GDPR)[1] and have to be ensured for all processing of personal data. Controllers, i.e. organisations determining the purposes and means of processing operations, have to be transparent about their processing activities (Articles 12 to 14 GDPR).

Controllers may rely on external parties acting as processors (Article 28 GDPR). In that case, they must bind the processor with a contract or other legal act meeting the requirements of GDPR.

Supervising and enforcing compliance with GDPR falls within the competence of national authorities, in particular data protection authorities and courts, without prejudice to the European Commission’s competences as guardian of the Treaties.

Whether particular processing operations by or on behalf of the Greek authorities comply with the GDPR is therefore for the Greek data protection authority and the Greek courts to assess. The Commission understands that the Greek data protection authority has opened an own-volition inquiry into the use of Palantir on 18 December 2020.

On a more general level, the Commission adopted a recommendation[2] to support exit strategies through technology. The EU Toolbox[3] and the related Commission guidance[4] recommend fully privacy-compliant and interoperable contact tracing and warning apps.

Member States, supported by the Commission, have also focused on the interoperability of these apps, agreeing on guidelines and technical specifications for interoperability. At the invitation of EU Member States, the Commission has set up an EU-wide system to ensure interoperability of EU contact tracing apps based on decentralised systems[5].

Last updated: 31 May 2021
Legal notice - Privacy policy