CCTV warning sign in Greece: what it must say

The Hellenic Data Protection Authority lists the mandatory first-layer information:

• the purpose of the processing;
• the identity of the controller and/or its representative;
• a reference to data-subject rights;
• a pointer to the detailed notice: the Authority recommends a web link (URL or QR); with no website, state where the notice can be found;
• the DPO’s contact details, where one has been appointed.

If the processing is not what people would expect, such as a transfer outside the EU or retention beyond Directive 1/2011’s limits, it must be stated on the sign itself. Police and judicial authorities count as expected recipients (art. 9 of the Directive).

Article 12 of Directive 1/2011 requires people to be informed before they enter the system’s range, in a visible and understandable way, with clearly visible signs in sufficient numbers and in a prominent place. The Authority adds that signs must be visible from all possible entry points.

• One sign at every entrance for people and vehicles, not just the main one.
• At eye level and outside the camera’s view, so it is read before anyone is filmed.
• In car parks and yards, where vehicles come in.

The Directive’s annex says size and shape may vary, as long as everyone is informed before entering. A camera symbol may be used.

The annex to Directive 1/2011 gives sample wording: “This area is monitored by closed-circuit television for the protection of people and property”, refers to the right of access under article 12 of Law 2472/1997 and leaves a “Controller” field. The annex itself says the template may be adapted and that writing “under Law 2472/1997” is not correct.

Law 2472/1997 was repealed by article 84 of Law 4624/2019, except for a few provisions that do not include article 12. The Authority applies the Directive together with the GDPR and Law 4624/2019, and since 2020 has published new sign templates in four versions: with or without a QR code, with or without DPO details.

If your sign still says “article 12 of Law 2472/1997”, replace it with a reference to GDPR rights and a pointer to the detailed notice.

The structure below covers the Authority’s mandatory items. It is a sample, not official wording; for the final sign, start from the Authority’s templates.

1. CCTV IN OPERATION, with a camera symbol.
2. Purpose: protection of people and property.
3. Controller: [company name], [address], [phone or email].
4. Data Protection Officer: [email], only if one has been appointed.
5. Your rights: you have rights under the GDPR (e.g. access, restriction, objection, erasure).
6. Full notice: [URL] or [QR code] or [place on site where it is available].
7. Only if it applies: retention beyond Directive 1/2011’s limits, or transfer outside the EU.

The Authority notes that typical systems mainly involve the rights of access, restriction, objection and erasure. How to handle a request for footage is covered in the guide on CCTV footage retention.

Directive 1/2011 (art. 12(b)) required a detailed notice only on request. The Authority notes that under the GDPR this information is given without a request. It covers:

• the full identity and contact details of the controller, and of the DPO where there is one;
• the purpose and legal basis, and the legitimate interest where the basis is GDPR art. 6(1)(f);
• recipients, including those who operate the system;
• any transfer outside the EU;
• the retention period;
• how to exercise rights, and the right to complain to the Authority.

Article 12 of the Directive defines the controller as “the person on whose behalf the filming is done”. When someone else operates the system, the assignment must be in writing (art. 11 §2). The Authority asks for the detailed notice to list recipients, including those who operate the system.

Where cameras are allowed, what applies to employees and who is responsible are covered in CCTV and GDPR in a business. OVIT combines security equipment with field response and visibility in Guardly.