By MD Brainnovation, Manos Dimogerontakis 

At MD Brainnovation we work mainly as GDPR compliance consultants. Since Greece passed Law 4990/2022, a large part of that work has been helping companies set up and review their whistleblowing channels. We quickly learned that most of the hard questions are not about whistleblowing law at all. They are about personal data. This article shares what we have learned along the way, from our side of the table. 

The starting point Directive (EU) 2019/1937 and the Greek law that transposed it both rely on the GDPR. The reporter's identity must stay with the people authorised to handle the report. Data that is clearly irrelevant should not be kept. Reports should be stored only as long as needed. Law 4990/2022 adds that companies with 50 or more employees must appoint a Reports Receipt and Monitoring Officer (Υ.Π.Π.Α.), and it allows certain limits on data subject rights where these would put the reporter or the investigation at risk. On paper, this is clear. In practice, four issues come up again and again. 

Lesson 1: Group companies and data transfers  

Many of our clients are Greek subsidiaries of international groups. The group usually already has a global hotline, often run by an external provider, with reports reviewed at headquarters. The natural reaction is to plug the Greek company into it and move on. That can work, but it needs more thought than most expect. The Greek company remains responsible for its own channel, so the group solution has to meet the Greek requirements, including a designated officer locally. When reports go to a parent company, each entity's role needs to be defined: who is controller, who is processor, and whether there is joint control. And when headquarters or the platform provider sits outside the EEA, a transfer mechanism such as Standard Contractual Clauses and a transfer impact assessment are required. What we tell clients is simple: map where a report actually travels, from the moment it is submitted until it is closed. Very often nobody has done this, and the map itself shows the gaps. 

Lesson 2: Access requests from people involved in a report  

Sooner or later, someone named in a report files a GDPR access request. Sometimes it is a genuine wish to know what is held about them. Sometimes it is an attempt to find out who reported them. The Greek law allows the company to restrict rights to protect the reporter and the investigation. But we have seen companies treat this as permission to refuse everything, and that is a mistake. The restriction has to be assessed case by case and documented. The person concerned is still entitled to data about themselves, as long as nothing reveals the reporter's identity or harms the investigation. In practice, this means careful redaction, clear reasoning in the file, and replying within the GDPR deadlines. Our advice is to prepare a short internal procedure for these requests before the first one arrives. Handling them under pressure is where most errors happen. 

Lesson 3: Anonymity and pseudonymisation 

Anonymous reporting sounds like the safest option, and for the reporter it often is. For the organisation, it makes follow-up harder, since there is no one to ask for more details or to keep informed. Good platforms solve this with an anonymous mailbox, so the case team can talk to the reporter without knowing who they are. Where the reporter is known, we recommend pseudonymisation inside the case. The identity is kept separately, accessible only to the officer, and the case file works with a reference number. This limits the damage if the file is shared or leaks. It is important to remember, though, that pseudonymised data is still personal data for the company that holds the key, so all GDPR obligations continue to apply. The biggest risk we see is not the name. It is everything around it: the department, the dates, a detail only one person could know. Before any summary leaves the case team, someone should read it with one question in mind: could this identify the reporter? 

Lesson 4: The DPIA is not optional in Greece 

We are often asked whether a data protection impact assessment is really needed for a whistleblowing channel. In Greece, the answer is yes. The Hellenic Data Protection Authority's list of processing operations that require a DPIA (Decision 65/2018, published in Government Gazette1622/10.05.2019) expressly mentions recording individuals in whistleblowing systems as an example of processing that may prevent people from exercising their rights. Under the list, meeting such a criterion is enough to make the DPIA mandatory.  In our experience, the DPIA is also the most useful document in the whole project. It forces the company to answer the questions above: where the data goes, who sees it, how long it stays and how rights requests will be handled. It should be done before the channel goes live and reviewed whenever the platform, the provider or the group structure changes. 

Closing thoughts 

A reporting channel only works if people trust it. If employees believe their name will get out, they will stay silent, whatever the law says. From our perspective as data protection consultants, getting the GDPR side right is how that trust is built, and it is something every organisation can start on now. 

Sources 

• Directive (EU) 2019/1937 on the protection of persons who report 

• breaches of Union law 

• Regulation (EU) 2016/679 (GDPR) 

• Hellenic DPA, Decision 65/2018, DPIA list under Article 35(4) GDPR 

• EY Greece, Law Alert on Law 4990/2022 

• Zepos & Yannopoulos, note on Law 4990/2022