Greece Law 4624/2019 Chapter E - sanctions + final provisions. ADMINISTRATIVE FINES (Article 68): HDPA may impose fines up to GDPR maximums of EUR 20 MILLION or 4 PERCENT global annual turnover (whichever higher) for serious violations + GDPR Art. 83(5) violations; for lesser violations + GDPR Art. 83(4) maximum EUR 10 MILLION or 2 PERCENT global annual turnover. Public bodies subject to administrative fines too (with limits). PROPORTIONALITY + MITIGATION + AGGRAVATION factors per GDPR Art. 83(2) applied. CRIMINAL OFFENCES (Article 38): criminal sanctions for (a) unauthorised access to personal data; (b) unauthorised processing of sensitive categories; (c) breach of confidentiality + secrecy obligations; (d) destruction/alteration of personal data with intent to damage; (e) misuse for unauthorised purposes; (f) failure to comply with HDPA orders; penalties include imprisonment up to 5 years + monetary fines + criminal records + civil liability + reputational damage. CIVIL LIABILITY (Article 39): data subjects may claim damages from controllers/processors for material + non-material damage per GDPR Art. 82 + Greek Civil Code; minimum compensation thresholds + non-material damages + class actions + collective redress. APPEALS + JUDICIAL REVIEW: HDPA decisions appealable to Athens Administrative Court of Appeal (Dioikitiko Efeteio Athinon) + Council of State (Symvoulio tis Epikrateias) + ECtHR for human-rights claims. RECENT ENFORCEMENT (2023-2025): HDPA has imposed multiple GDPR fines + actions against banks + telecoms + retailers + healthcare + public bodies; ongoing investigations + decisions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.