Information on the processing of personal data through the video surveillance system
1.Data Controller:
NEA ODOS ANONYMI ETAIREIA PARACHORISIS
No. GEMI 007349501000
Registered office: Athens, 87 Themistokleous Street, Postal Code 106 83, and offices in Nea Erythraia, Leof. 19 Nea Erythraias Avenue, Postal Code 146 71
VAT: 998807387
TELEPHONE: +30 210 34 47 300, e-mail: info@neaodos.gr
- Especially for the cases of cameras installed along the motorway (including open sections of the road, tunnels, toll stations, temporary parking areas), GEK TERNA SA (No. GEMI 000253001000, Headquarters: Athens, 85 Mesogeion Avenue, 85, Postal Code. 11526, VAT: 094005751, TELEPHONE: +30 210 6968000, e-mail address: info@gekterna.com), pursuant to the Operation and Maintenance Contract dated 05-03-2021 (“O&M Contract”), which has been approved by the Hellenic State, has undertaken the daily operation and maintenance of the Concession Project as the Operator. In the context of providing services under the O&M Contract, GEK TERNA SA processes the personal data of motorway users and subscribers to the subscription programs, but only the absolutely necessary data. GEK TERNA SA is jointly responsible for the processing of the aforementioned data with NEA ODOS ANONYMI ETAIREIA PARACHORISIS.
- Especially in the case of confirming violations of the Highway Code and non-payment of the prescribed toll fees, the locally competent Directorate of the Traffic Police is jointly responsible for processing personal data specifically for this purpose in accordance with Article 104, paragraph 4 of the Highway Code, P.D. No. 287/2001, Article 14(5) of Law 3917/2011, and the document issued by the Hellenic Data Protection Authority No. Γ/ΕΞ/5888/02-10-2014.
2.Data Protection Officer (DPO)
“ANDERSEN LEGAL, PISTIOLIS – TRIANTAFYLLOS & ASSOCIATES LAW FIRM”, email: dpo@neaodos.gr.
3.Purpose of the processing
We use a video surveillance system at our facilities (Headquarters, Toll Administration Buildings, Traffic Management Centres (TTCs), Tunnel Control Centres (TCCs), Customer Service Centres), as well as along the motorway (including open sections of the road, tunnels, toll stations, and temporary parking areas), for the purposes of regulating and managing vehicle traffic, safeguarding the interests of the Company, and ensuring the protection of persons, property, infrastructure, and public property.
- Especially for the cameras located at toll stations, there is an additional purpose of recording violations of the Highway Code due to non-payment of the prescribed toll fees.
4.Legal basis of processing
Legal bases for processing your personal data (video, image) through the video surveillance system are:
- Performing a task carried out in the public interest or in the exercise of public authority, particularly for the management of traffic flow and the recording of infringements (illegal vehicle passages) at Toll Stations.
- Legitimate interest of the Data Controller in managing vehicle traffic, reviewing incidents [in accordance with Article 14 of Law No. 3917/2011 as in force, which allows the relevant facility to process data for reasons of public interest, in conjunction with its legal obligation arising from Article 23.2.1 of the relevant Concession Agreement (Law 3555/2007), and specified in Article 32.6. 17 of Appendix 2 (Special Specifications) of the Concession Contract, and the document of the Hellenic Data Protection Authority (No. Γ/ΕΞ/2067/07-12-2014) regarding the legality of the processing], the judicial pursuit of toll fee collection [in accordance with article 24.1.5.(2) of the relevant Concession Contract, ratified by Law No. 3555/2007 (Government Gazette A’ 81), Article 29 par. 10 of the Highway Code, and the document No. Γ/ΕΞ/6887-1/20.12.2010 of the Hellenic Data Protection Authority], as well as for the safety of the facilities and the protection of persons, property, infrastructure and public property.
5.Legitimate interests analysis
Our legitimate interest lies in:
- Ensuring the safe and unimpeded flow of traffic.
- Protecting our premises and the goods within them from illegal acts, such as theft. This also applies to safeguarding the life, physical integrity, health and property of our staff and third parties lawfully present in the premises under surveillance. We only collect image data and limit the recording to areas where there is an increased likelihood of unlawful acts, such as theft (e.g., building entrances and toll stations). We avoid focusing on areas where the private lives of individuals could be unduly restricted, ensuring their right to the respect of personal data is maintained.
6.Recipients
The material stored is accessible only by our competent/authorized personnel responsible for premises security. This material is not transmitted to third parties, except in the following cases: (a) to the competent state, judicial, prosecutorial, and police authorities when it contains information necessary for the investigation of a criminal act involving either persons or goods of the controller, or any violations of the Highway Code and Greek legislation in general (e.g. for toll collection); (b) to the competent state, judicial, prosecutorial, and police authorities when they lawfully request data in the exercise of their functions; (c) to the victim or perpetrator of a criminal offence, with respect to data that may constitute evidence of the offence; (d) to external security companies entrusted with the control and operation of the CCTV system, and to which processing has been entrusted in writing in accordance with the specific conditions of Article 28 of the GDPR; (e) to cooperating companies for the purpose of developing an algorithm for automatic incident detection, as described above; and (f) to cooperating companies for the maintenance and technical support of the Toll Station Infringement Management System.
It should be noted that the locally competent Traffic Directorates have access to video footage from specific toll station cameras in order to identify instances of non-payment of toll fees, which constitutes a violation of the Highway Code.
7.Retention period
We retain the data for fifteen (15) days, after which it is automatically deleted. If, during this period, an incident is identified, we isolate the relevant section of the video and retain it for up to one (1) additional month for the purpose of investigating the incident and initiating legal proceedings to protect our legitimate interests. If the incident involves a third party, we will retain the video for up to three (3) additional months.
In the event of an incident, the video recording shall be kept in a separate file for as long as necessary to transmit it to the competent authorities or to complete the investigation of the incident.
Additionally, photos and videos taken by the video surveillance system that capture violations of the Highway Code (passing without paying toll fees) will be kept until the limitation period for claims has expired, in order to facilitate the collection of the debt.
8.Automatic incident detection
We would like to inform you that video footage captured by specific cameras located along the motorway, as well as at the ramps entering and exiting the motorway, is used to develop an for the automatic detection of incidents, ensuring more immediate intervention in emergency situations. The Company has taken appropriate technical and organizational measures to ensure that the images captured by these cameras are processed in a manner that prevents the identification of individuals.
9.Confidentiality and security of processing
The Company and all parties processing data on its behalf undertake to respect the confidentiality and security of processing, and, in particular, to ensure the protection of data from any form of unlawful processing throughout the period of the retention period, by implementing appropriate technical and organizational measures. In particular, the Company ensures, by way of example:
- The security of the recorded material and the prevention of its disclosure to unauthorized recipients.
- Control of access to the central control room, the storage area of the recorded material, and any processing systems (hardware and software levels).
- Minimizing unnecessary use of projection screens.
- The secure transmission of recorded incidents to the legitimate recipients and the prevention of disclosure to unauthorized recipients.
- The selection of appropriate personnel to operate the video surveillance system.
- Continuous training of staff on personal data protection and the general adherence to the applicable regulatory framework.
- The use of image capture devices with the capability to mask areas, where necessary.
In cases where the operation of the video surveillance system is entrusted to a processor, this assignment is made in writing and in accordance with Article 28 of the GDPR, binding the parties to the respective obligations set forth therein.
10.Data subjects’ rights
Data subjects have the following rights:
- Right of access: You have the right to know whether we are processing your image and, if so, to receive a copy of it.
The Company is required to provide a copy of the part of the image signal recording where the data subject appears, or a printed series of snapshots of the recorded images, within one month of the submission of the relevant request. This is subject to the conditions and provisions of the law. Alternatively, the Company must inform the person concerned in writing within the same period, either that the data subject is not visible in the recording or that the relevant part of the recording has been destroyed.
If the data subject agrees, the Company may alternatively display the relevant section directly. In this case, the data subject must specify the exact time and location where they were within the camera’s range.
When providing a copy of an image, the Company must obscure the image of third parties (e.g. by blurring parts of the image) if their right to privacy could be violated. In the case of a simple display, masking the image of third parties is not required.
- Right to restrict processing: You have the right to request that we restrict processing, such as not deleting data that you consider necessary for the establishment, exercise, or defense of legal claims.
- Right to object: You have the right to object to processing at any time.
- Right to erasure: You have the right to request the deletion of your personal data processed by us.
You can exercise your rights by sending an e-mail to dpo@neaodos.gr, mailing a letter to our postal address, or submitting the request in person at the company’s registered seat. To process a request related to your image, please provide an approximate time when you were within the camera’s range and, if possible, an image of yourself to help us identify your data and ensure the protection of third-party privacy. Alternatively, we offer the option to visit our premises to view the images in which you appear. Please note that exercising the right to object or request erasure does not imply immediate deletion of data or alteration of processing activities. In any case, we will respond to your request in detail as soon as possible, within the time limits set by the GDPR.
11. Right to lodge a complaint
In case you consider that the processing of your data violates Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority.
The competent supervisory authority in Greece is the Hellenic Data Protection Authority, located at Kifisias 1-3, 115 23, Athens, https://www.dpa.gr/, phone: 210 6475600. Complaints can be submitted electronically via their online portal: https://eservices.dpa.gr/.