The Hellenic Data Protection Authority is taking part in the 2022 coordinated enforcement action of the European Data Protection Board (EDPB) on the use of cloud-based services by public bodies. This is a joint initiative whereby the majority of EDPB members pursue a common topic in a coordinated manner. Hence, over the coming months, 22 national Supervisory Authorities, including the European Data Protection Supervisor, will launch investigations into the use of cloud-based services by the public sector (see https://edpb.europa.eu/news/news/2022/launch-coordinated-enforcement-use-cloud-public-sector_en).
In the context of its participation in this coordinated action, the Authority, following a relevant preliminary assessment, has decided to send the questionnaire drawn up by the EDPB specifically to five public bodies whose activities, performed with the use of cloud-based services, have a significant impact on the protection of personal data. This questionnaire contains detailed questions on different aspects of data protection when selecting Cloud Service Providers and using the relevant services which include, among others, selection-related processes and safeguards, challenges in relation to any international transfers and provisions governing the controller-processor relationship.
Subsequently, after processing the answers that will be received at national and European level, the Authority will take initiatives of proper guidance to public bodies, including the issuance of relevant Guidelines and/or other information activities. Furthermore, the results will be aggregated by the EDPB, generating deeper insights into this topic and taking further action at EU level. The EDPB will publish a relevant report by the end of 2022.