(Articles 12-14 of the General Data Protection Regulation)
The Ministry of Shipping and Island Policy in compliance with articles 12-14 of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016), informs you that under the special guidelines for preventing and dealing with cases of COVID-19, passengers on ferry journeys longer than 30 minutes and passengers on commercial tourist excursion boats and commercial pleasure craft must, before boarding, complete a special questionnaire including personal data.
1. Controller:
For processing of data, the joint Controllers shall be:
(a) The Ministry of Shipping and Island Policy, as legally represented by the Minister of Shipping and Island Policy.
Contact Information:
Akti Vassiliadi, Gate Ε1-Ε2, 185 10, Piraeus
Switchboard: 213 1371700 - 213 1374700
https://www.ynanp.gr/el/contact/
Data Protection Officer:
https://www.ynanp.gr/el/contact/epikoinwnia-dpo/
The completed questionnaires shall not be transmitted from the ferry companies or ship owners or operators (natural or legal persons) to the Ministry of Shipping and Island Policy.
(b) The Attica Holdings S.A. (Attica Group) companies Superfast Ferries, Blue Star Ferries, and Hellenic Seaways (hereinafter Ferry Companies), with registered offices at 1-7 Lysikratous St & Evripidou, Kallithea, 17674, email: mydata@attica-group.com, and the Data Protection Officer: dpo@attica-group.com.
The Ferry Companies, as joint Controllers, shall collect and process personal data and transmit them, if required, to the National Public Health Organization (EODY), and must implement all the necessary measures and safeguards stemming from personal data protection legislation.
2. Purpose of processing and legal basis of processing:
Personal data processing carried out in the framework of the special guidelines for preventing and dealing with cases of COVID-19 through the completion of special questionnaires by passengers is governed by the provisions of European Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) as it applies on each occasion, as well as Law 4624/2019 (Government Gazette 137/A/2019) “Hellenic Data Protection Authority, measures for implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the incorporation into national law of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 and other provisions”, as it applies on each occasion:
The purpose of the processing is to prevent and deal with the consequences of the COVID-19 coronavirus and to record the spread of cases for reasons of public health protection, which requires the preparation and coordination of the personal data Controllers.
The legal basis for data processing:
(a) Article 6(1)(c) of the GDPR: “processing is necessary for compliance with a legal obligation to which the controller is subject” and
(b) Article 6(1)(d) of the GDPR “processing is necessary in order to protect the vital interests of the data subject or of another natural person” and
(c) Article 6(1)(e) of the GDPR “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” and Article 5 of Law 4624/2019 (Government Gazette 137/A/2019) for the Ministry of Shipping and Island Policy.
Legal basis for the processing of special categories of personal data (Article 9 of the GDPR)
The processing of special categories of personal data from the COVID 19 Questionnaires is governed by article 9 of the GDPR and article 22 of Law 4624/2019 (Government Gazette 137/A/2019). In particular, the legal basis for the processing of special categories of data of is:
(a) Article 9(2)(h) of the GDPR “processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of EU law or national regulations or pursuant to contract with a health professional” (b) Article 9(2)(i) of the GDPR “processing is necessary for reasons of public interest in the area of public health, such as “safety of health care and of medicinal products or protection of the population from the spread of disease on the basis of EU law or national regulations which provide for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy”.
3. The source of the personal data is: The data subject or in the case of minors, the adult accompanying them.
4. The rights of data subjects and exercising the rights of data subjects:
Data subjects have the following rights under the General Data Protection Regulation:
(a) a right of information, under articles 12, 13 and 14 of the GDPR,
(b) a right of access, under article 15 of the GDPR,
(c) a right to rectification, under article 16 of the GDPR,
(d) a right to erasure (‘the right to be forgotten’), under article 17 of the GDPR, after the prescribed period of two months.
(e) a right to restriction of processing, under article 18 of the GDPR and
The rights of the data subject shall be exercised through the Ferry Companies. These rights shall be exercised in the cases and under the conditions described in articles 12-20 of the GDPR, sending either a written letter, or an email to the Ferry Companies and/or their Data Protection Officer. As joint Controller, the Ferry Companies are exclusively liable for the collection and processing of personal data and for the satisfaction of the rights of data subjects for all personal data from the special questionnaires that are subject to processing, in accordance with the current provisions on data protection. They shall therefore suitably adapt the Samples of the Special Questionnaires posted on the www.ynanp.gr site for compliance with Articles 12-14 of the General Data Protection Regulation on the basis of this announcement, completing their contact information and the contact information of their Data Protection Officer, if one has been appointed.
5. The period of storage of the data by the ferry companies shall be two (02) months from the from the date of their receipt under current legislation on personal data protection.
6. Recipient of personal data
The Recipients of the personal data entered on the Special Questionnaire Forms by passengers are the data subjects themselves in the case of them exercising their right of access and, if necessary, the relevant departments of the General Secretariat for Civil Protection and the National Public Health Organization (EODY), for the purpose of fulfilling the public interest in the sphere of public health.
7. Transfer of Personal Data: The joint Controllers shall not transmit or disclose the Personal Data to third parties, apart from the aforementioned recipients, unless required by law or domestic or foreign judicial decision. The public authorities which may receive information under a specific investigation in the performance of their duties in accordance with EU law or national regulations are not considered recipients. The processing of such data by the public authorities in question shall be performed in accordance with the current provisions on data protection commensurate with the purposes of the processing.
8. Right to remedy / complaint to a competent supervisory authority:
You have the right to appeal to the Hellenic Data Protection Authority in matters concerning the processing of your personal data. For the remit of the Authority and how to make a complaint, visit its website (www.dpa.gr – Individuals – Lodge a complaint), where there is detailed information.