Koumentakis

Blog

  • Cyber Risk: The Role Of The Legal Advisor

    Cyber Risk: The Role Of The Legal Advisor

    [vc_row][vc_column][vc_column_text]

    Cyber Risk: Does It Concern Everyone Or Exclusively The “Elite” And “Famous People”?

    “Many people working in cybersecurity will tell you that it’s not a question of whether a company shall suffer a cyber-attack but of when it will suffer it in any form. Whether you have been cyberattacked and you have not been aware of it or you have been cyberattacked and you know it, or you will be cyberattacked sometime in the future”.

    This is Martin Felli’s statement (CLO of JDA Software, one of the world’s largest software companies for logistics companies) to Dominic Carman, who conducted a special survey for Kroll.

    What Felli says is in fact an explanation of the statement of former FBI Director Robert Mueller who had already since 2012, stated that: “There are only two types of companies: those who have been already hacked and those that will be hacked in the future”.

    Despite the continuous digitization of all kinds of information and the use of electronic networks to carry out all sorts of transactions and operations, it is more than obvious that most companies in Greece are not aware of the risks they run themselves as well as their customers’ data from of every kind and form of cyberattacks.

    But why should your legal advisor deal with this issue? Isn’t it a matter of IT?

    In order to attempt a satisfactory answer to this question, we must set our sights to the recent past …

     

    Τhe Disclosure Οf Loss Οr Leakage Οf Information Αnd Its Consequences-General.

    The demonstration – disclosure of a loss or leak of information of any nature (whether it is a customer’s personal data or business secrets) starts with admitting publicly this leak. Such public action can be made either to the general public or to a limited circle of persons and legal entities whose data has been lost or leaked due to the cyberattack.

    In either case (: admitting publicly or limitedly a cyberattack) the legal consequences are always serious. Third injured parties are entitled to bring proceedings against the company that has suffered a cyberattack while the competent authorities have to impose the fines provided by the existing institutional framework. The extent of the damages to be awarded and the fines to be imposed will always be directly proportional to the extent of the leakage and the severity of data lost or hucked.

    In both cases (: in the first one immediately, in the second on time) the inevitable publicity attracts media’s interest and causes, inevitably, a serious damage in the company’s prestige and reputation. This second consequence of a cyberattack is similarly severe (sometimes even more) than the legal consequences of such disclosure (lawsuits, administrative fines, criminal liability).

     

    “There Has Not Been A Thorough Investigation Of The Causes Of the Leak Of Information”: Yahoo Case

    Relatively recently (in 2016), Yahoo has revealed two separate incidents of data hacking by hackers who have gained access to data for a billion users (the number actually causes vertigo). The first incident occurred in 2014 and was initially kept secret. But when 2016 a second violation took place the company was forced to make a total disclosure.

    The shock to the business world of the United States was so great that a detail perhaps went unnoticed: The first to resign was Yahoo’s Head IT (: as expected) but the second was the Chief Legal Advisor. Why, though, this second resignation?

    The Special Commission appointed by the Yahoo Board to investigate leakage circumstances, both in 2016 and 2014, considered that the whole group of Yahoo’s Legal Advisers failed to investigate thoroughly the causes and circumstances of the breaches in 2014. Notwithstanding the fact that it also had the data and conditions to do so. This particular failure by the legal counsel team had as a first result that no substantive measure was taken, and that, as a final and yet dramatic (result) to allow the widespread violation of 2016.

    What was the duty that Yahoo’s Chief Legal Advisor omitted? What is the responsibility of the Legal Advisors of a company?

     

    The Changes Brought In The Global Business Environment By The EU Regulation GDPR And The NIS Directive

    In 2016 the European Union legislated two major legal instruments: the General Data Protection Regulation 2016/679 and the Network and Information Security Directive 2016 / 1148).

    Many people are already aware of the first of them (GDPR). However, the second is ignored, despite the fact that it must also be incorporated into the domestic law of the Member States from May 2018. Member States are obliged to identify by November 2018 the operators and service providers of basic services (who now have increased responsibility for maintaining high security measures).

    These laws will affect (more precisely: they already affect) directly and in one way or another all the companies that process Personal Data of European citizens. It is emphasized that they affect not only European companies but also non-European Union entities that process Union citizens’ data.

    In Europe (as in North America earlier in the past), something important is changing in relation to the assessment of the risks posed by electronic data processing. The attitude of the legislative and auditing authorities appears to be abrupt and significant. With the above-mentioned legislation, the European Union is spearheaded on the issue of corporate responsibility for failing to protect and securely process information that in one way or another is processed by the companies.

    Both laws, apart from all their other consequences and the multiple regulatory compliance parameters they create, are also adding further adverse consequences in the event of a cyberattack that may result in data leakage.

     

    The Role Of The Company’s Legal Advisor

    In this context of the rapid (but at the same time important) changes in business behaviors and practices brought by the current legislative trends, the role of the Legal Advisor of a company proves to be extensive and, at the same time, crucial.

    The Legal Advisor of a company, as the head of the team concerned, owes to design, supervise and test in advance an Incident Response Plan for the case of a cyberattack.

    Perhaps it seems strange that a lawyer and not the IT Manager is at the head of such an effort. However, only in this way can there be effective protection of the company’s interests against the consequences of a possible loss or leakage of data.

    In the technical part it is obvious (and self – evident) the assistance of the specialists who will identify the type of invasion, the exploitation weakness, the identification of the volume of data leaked, etc. However, the main concern of the Legal Advisor will not only be disclosing to the management and the responsible employees of the company, but also ensuring the best implementation of the laws and best practices, mitigating the consequences of any breach and, in particular, harmonizing all the departments of the company in the implementation of the Incident Response Plan.

    Your Legal Advisor (ought to) know those provisions (before cyberattack) and the actions required (after cyberattack and data leakage) to:

    • Make clear to the competent Audit and Judicial Authorities that the company has done the best on both preventive (before cyberattack) and post-data leakage.
    • Identify the causes of the leakage, the persons liable, the existence of willful deception or fault that contributed to the leakage of the information in a clear and understandable way (to non-experts).
    • Creating optimal conditions and evidence for seeking to punish perpetrators and / or those responsible for the attack before the competent authorities and bodies.
    • Manage the communication of the consequences of the disclosure of data loss / leakage due to cyberattack.

    The Legal Advisor of the company will identify the specific risks for each of his client companies according to their activity and their exposure to data processing (gap analysis). In cooperation with IT, the Legal Advisor will investigate possible cybercrime scenarios and prepare an Incident Response Plan that will be simple and comprehensible to all executives and departments of the company and, in particular, to a judge who may eventually deal with it later.

    To be clearly understood, let’s take a simple example: The lawyer who defends a client for medical negligence does not need to be a neurosurgeon. It is enough to be prepared to understand the philosophy and sequence of the protocol that his client ought to follow in order to respond to the disputed incident. The Legal Advisor of the company, having understood the technical issues with the valuable help of IT, will “translate” in a comprehensible manner the necessary actions and processes so that they are simple and easy to understand by both the Company’s Management and the employees and by third parties (auditing and judicial authorities).

    It is particularly notable that already in the US and Great Britain, the top law firms have developed their own Cyber Security Division to provide all the services required (legal and IT).

     

    The Issue Of Cyber-Security And Its Integration In The Company’s Regulatory Documents

    On the initiative of the Legal Advisor, the Cyber Security issue must be integrated in the company’s regulatory documents (Internal Working Rules, Internal Rules of Operation, Policies for Data Processing and / or Computer Management etc.).

    For illustrative purposes only it has to be noted that an Incident Response Plan should contain (indicatively – among others):

    • Who are the heads of the action groups, when and how they are alerted.
    • Who decides and within which time framework the (eventually) total shut down of the company’s networks or attempts to resume operations to identify the origin of the cyberattack.
    • Who is the external partner (who may) be involved in system monitoring.
    • What and of what nature are the written notices and reports that will be the proof of the time of awareness of the cyberattack and of the actions that took place.
    • Who is responsible for communication and PR (who may) have to manage the communication part of the disclosure.

     

    Does The Legal Advisor Have To Deal ALSO With The Insurance Against Civil Liability?

    In the same context, the Legal Advisor of the company will accurately identify the most likely sources of risk and will be able to choose the right insurance against civil liability plan in relation to cyberattack. This in contravention of the usual business practice, when the cheapest offer is chosen and the first text / draft insurance contract to be sent by the selected insurance company (which may cover on the one hand absolutely unnecessary risks while on the other hand not cover what is absolutely necessary).

     

    The Link Of The Company’s Good Repute With Its Protection

    All the above actions of the Legal Advisor (: existence of clear regulatory documents, policies, Incident Response Plan, Insurance Coverage etc.), but mainly the alignment of the company and of its executives with what is provided can only have the effect of increasing the trust of customers and collaborators towards it.

    Given that we all want to work with trusted partners, the (regional) benefits of the company are more than obvious: customers see that they are dealing with a serious business partner rather than a “little store”.

     

    Creating The Conditions To Prevent an “Internal” Cyber Attack

    Over the past few years, we have been facing business-secrets violations by (dissatisfied or not, active or retiring) company’s executives in the context of their long-term or opportunistic planning. Our case law has dealt with some individual cases, until now, where executives either wanted (simply) to harm their employer’s company or their personal enrichment or their transfer to a competitor-along with the business secrets of their previous employer.

    The protection of the company by its (malicious) executives, although not automatic or self-evident, is, to a very large extent, feasible, with significant leverage in the existing institutional framework and the Constitution. (http://koumentakislaw.gr/en/blog/articles/enterprises-and-confidentiality/)

    So, what happens when cyberattack comes “from the inside”, that is when the offender is an executive of the company? Is protection and deterrence possible? Is it possible (in the non-desired case) to detect the origin and identify the offenders so as to make an (internal) example of them and for (future) deterrence?

    The Legal Advisor is the one who must create the framework and the background of business secrets. It is precisely in this same context (in close co-operation with the IT section) that he must create the conditions to prevent an “internal cyberattack”, which could seriously damage the interests of the company he represents. He is the first to “raise” the alarm but also the one who should urge the company to establish appropriate policies and procedures for the safe use of the company’s networks, electronic communications, the control of access to the company’s systems and records by its executives.

    By Way Of Epilogue

    The resources available are always limited. The need for their rational management is more than obvious and (also) in relation to the maximum possible protection from Cyber Risk.

    If there is no rapid and thorough identification of the needs and potential risks for the particular company, it is likely that the company’s resources be “spent” in a way that will not be the optimal one.

    Your Legal Advisor can lead you to a more rational and efficient use of available resources and also take the responsibility for coordinating all stakeholders.

    Even if you do not choose to assign to him the specific projects, please just search for his assistance. You can be sure that the result will be infinitely better.

    Lambros Timotheou
    Partner

    [/vc_column_text][/vc_column][/vc_row]

  • Workshop On The Implementation Of GDPR In Tourism

    Workshop On The Implementation Of GDPR In Tourism

    [vc_row][vc_column][vc_column_text] Koumentakis & Associates Law Firm participated in the workshop organized by the Hoteliers Association of Rethymnon, entitled: “The application of the General Data Protection Regulation (GDPR) with emphasis on the tourism sector”.

     

    GDPR in Tourism

    The workshop aimed at the complete presentation of the Regulation on topics such as:

    • The new General Data Protection Regulation: Organization and preparation for full compliance with the new regulatory framework,
    • The Practical Implementation of the Regulation in the Tourism Sector,
    • Tools & solutions for the Security of Information Systems in compliance with GDPR,
    • The critical role of Data Protection Officer (DPO) Education and Certification (ISO 27001, ISMS)

     

    The Attorney-At-Law Konstantinos Kornilakis, Partner of Koumentakis & Associates who represented the firm, referred to the issue of personal data, the obligations and rights of employees and associates and the capabilities of companies to ensure Confidentiality (e-mail monitoring, retrieval of deleted correspondence, recording of data from the computers of the company, etc.). He also referred to the benefits of confidentiality, which are obvious to companies, their clients, their employees and their families, and to the entire industry in general.

    GDPR – General Data Protection Regulation

    The new “General Data Protection Regulation” (GDPR) for the processing and management of personal data in the Member States of the European Union is entered into MANDATORY force on 25 May 2018. The parties are now obliged to manage the information in accordance with the provisions of the Regulation, to take all necessary measures to maximize the security of data management and to be able to demonstrate that they have taken these measures with a credible level of internal preparation. The Regulation provides for specific management procedures and demands compliance by the parties, under severe sanctions.

     

    [/vc_column_text][/vc_column][/vc_row]

  • Companies And Confidentiality

    Companies And Confidentiality

    [vc_row][vc_column][vc_column_text]

    The Importance Οf Securing Confidentiality

    Every company faces a lot of challenges to become and remain healthy, but also to maintain the high standards it has possibly achieved in terms of operation, efficiency and profitability. Maintaining (and, more importantly, increasing) its market share in the geographic areas of its activity requires a series of obstacles to be overcome daily.

    Achieving and maintaining healthy entrepreneurship is always not only a requirement but also an everyday challenge. One of its prerequisites is to ensure that the information that the business identifies as confidential will be maintained as such and, among other things, will not diffuse into competition.

    In some, special cases, the obligation to preserve the confidentiality of the information that is handled by the company is imposed by the institutional framework (see below on personal data). In these cases, the consequences do not refer to the smooth operation and development of the company. The consequences may refer to indefinitely high fines and penal sanctions!

     

    Persons Liable For Confidentiality

    The obligation to preserve confidentiality is an obligation that everyone has. Without exception!

    As the worker or the company’s usher is not excluded the same way (obviously), the executives, the senior management, the CEO or even the main shareholder are not excluded. It is important, however, to stress that this obligation also includes any third party with whom confidential information is shared, e.g. a close associate or consultant of a business.

     

    Form And Way Of Notification Of Privileged Information

    The form of the information is of no importance for its protection: It may be documents, electronic files, even for oral information disseminated to a specific number of persons and pertaining to a particular company or group of companies.

    Additionally, the way of knowing the information covered by the confidentiality obligation is also meaningless. It may be information that (e.g.) an executive has become acquainted with while performing his/her duties at his workplace or even outside such (e.g. at the client’s premises). It may still be information about matters handled by the person responsible for such, colleagues, business associates or consultants of the company. Finally, there may be information on issues related even to customers of the latter.

     

    Privileged Information

    Information covered by the confidentiality obligation may refer to commercial know-how (commercial information: e.g. customer and supplier lists, cost accounting and price calculations, sales strategies, marketing methods, and so on) and / or technical know-how (expertise, technical information). They may relate to the methodology, procedures, planning, data, development and results of any business activity, process, research, product output or service provision. They may relate to procedures, policies, documents of auditing authorities related to the company. It may, in the end, concern any issue of importance for the company.

     

    Particularly, On Personal (Personal and Sensitive Information) Data

    Thus, some of the protected information may even be related to personal data – personal and sensitive information. This scenario adds more obligations for companies as provided by the current institutional framework (EU / 1995/46 Directive incorporated by Law 2472/1997) as well as by the new Regulation (EU / 2016/679) which will be implemented as of 25 May 2018 and beyond – regardless of whether or not the (expected) law which implements it be adopted.

    However, it is not only the additional obligations of companies that are being created by the existing and the new institutional frameworks with regard to personal and sensitive data but also, especially, the threatened sanctions in case of non-compliance and / or violation (for all these issues please refer to the relevant article “Personal Data Protection and Companies”)

    The Obligations Of Executives And Partners

    Contracts that associate all employees and external partners with a company (must) include provisions that restrict the use of information that come to their knowledge during and solely in the context of their cooperation with the company. And even more: (they ought to) regulate the obligations of employees and associates during the period after the expiration of their cooperation (e.g. return of forms, documents, notes, deletion or return of electronic files) as well as the sanctions for breach of their (contractual and post-contractual) obligations (usually high penalties – in addition to general claims for compensation).

     

    Particularly, Decision 1/2017 Of The Arios Pagos (Supreme Court of Cassation)

    This decision has been a landmark on the specific issue.

    By virtue of this decision, it has been accepted that constitutionally protected rights (including the rights of the employees) such as the confidentiality of letters and communication (article 19 of the Constitution), the inviolability of private and family life (article 9C) and the protection of personal data (article 9A C) be limited on the basis of the constitutionally guaranteed principle of proportionality (article 25C).

    Therefore, in the context of this decision, the right to legal protection (article 20 par. 1 C) and of the freedom to conduct business (articles 5 & 106 par. 2 C) of an employer / company could prevail over the abovementioned rights of the employees.

    However, what was, practically, the meaning of the limitation of the constitutionally guaranteed employees’ rights in the framework of this specific and of other similar cases?

    There has been recognized the Employer’s right (whose above-mentioned constitutional rights were deemed to prevail, in the particular case and under the particular circumstances) to:

    • Monitor the electronic (professional and personal) correspondence of its employees as it is imprinted on the computers and on the other means of its company
    • Draw the deleted mail from these computers that constitute its property
    • Record the data obtained from the computers of its company and, in particular,
    • Exercise its legal rights on the basis of data contained in the personal or professional correspondence of its employees which took place through the company’s computers even if they had been deleted in the meantime.

    There is no doubt that this decision is extremely important: The Company does not remain (legally) unprotected against malicious employees who, under the guise of their constitutionally protected rights, attempt to harm it for their own benefit.

     

    When Does The Confidentiality Obligation Recede?

    The confidentiality obligation recedes:

    • when the information to which it refers is public (and a priori) known
    • when there is an obligation to disclose this information arises from the existing institutional framework or is imposed by a competent authority or a competent court.

     

    Confidentiality Provisions In Business Level

    In business level, the provisions that refer to confidentiality are (or should be) normally contained:

    • in the employment contracts, in the service agreements, in work contracts etc. of the company
    • in the company’s Work Rules (where applicable)
    • in the Code of Ethics (or Code of Conduct) of the company
    • in the NDA’s of the company and its customers- clients τόσο της επιχείρησης όσο και των πελατών της (to the extent that the latter apply to the company and, in addition, to its employees)

     

    Confidentiality Provisions Contained Into Legislation – Generally

    In cases where (contrary to what is agreed or what the law requires) the person who breaches the confidentiality obligation causes damage, the person responsible is obliged to restore it in its entirety (losses and damages – article 914 of the Civil Code, moral damage – article 932 of the Civil Code)

    However, irrespective of the civil claims maintained by the injured person against the person responsible, there are a number of criminal provisions relating to the criminal offense of the offender [indicatively: article 370 of the Penal Code (violation of letters privacy), article 370A of the Penal Code (violation of the telephone conversation and oral conversation privacy) , article 370C of the Penal Code (illegal access to an information system) and the related provisions of articles 370B, 370D, 370E of the Penal Code]

    There are, of course, also provisions referring to specific issues arising from the breach of confidentiality, as (indicatively):

    There are, of course, also provisions referring to specific issues arising from the breach of confidentiality, as (indicatively):

    More Specific Provisions

    (a) With regard to personal data breach

    Whenever the confidentiality obligation breach is related to personal data breach, there are administrative, criminal and civil penalties directly or indirectly imposed (also) on the offender.

    On the basis of the existing institutional framework (Law 2472/1997) which is in force until 25.5.2018 – when Regulation 2016/679 –  http://koumentakislaw.gr/en/blog/articles/personal-data-protection-and-companies/ enters into force, there are provided specific administrative penalties (Article 21), criminal sanctions (Article 22) and also civil liability of the offender (Article 23).

    Regulation 2016/679, of course, provides for very serious administrative sanctions (Article 83) and for civil liability for those who violate personal data (Article 82). It is expected that the law currently being drafted will further specify said sanctions or even impose additional (e.g. criminal) for the offenders (Article 84).

    (b) With regard to unfair competition

    Where through confidentiality breach there is also violation of the provisions of unfair competition (Law 146/1914), both criminal penalties (Article 16 & 17) and civil sanctions (Article 18) are provided for.

    (c) With regard to Codes Of Ethics

    It is not unusual for the operation of certain business sectors to be governed by Codes of Ethics. In these Codes, we often encounter a number of provisions regarding the obligation to ensure confidential data as well as sanctions in case of breach. (Indicatively: Code of  Greek Pharmaceutical Conduct – provisions of articles 26-chapter A and 4 of chapter C)

     

    Penalties on Breach of Confidentiality: Legal, Business And Not Only …

    In general, in view of the above, one could say that the obligation to preserve confidentiality directly or indirectly is supported in almost the whole range of law (e.g. civil, criminal, administrative). More specific provisions of the existing institutional framework and of the contractual relationships that have arisen in the course of the negotiations, specify both this obligation and the many consequences of its breach.

    The penalties provided envisaged relate to offenders-natural persons and, sometimes, the directly or indirectly involved companies: those who did not do the appropriate to protect those affected as well as those who urged the offenders into their unlawful actions.

    Thus, the sanctions are not only legal:

    The persons who violate this obligation they also suffer the corresponding personal and professional demerit.

    However, in the case of companies where the offenders were employed, the consequences are sometimes unbearable: For how long can a company operate when data, personal data (or even worse sensitive personal data) of its customers are loaded into the Internet? For how long can a company operate when its critical business secrets (whether it’s recipes or clientele, or production or marketing methods or whatever) are diffused to its competitors?

     

    Necessity Of Compliance And Consequences Of Non-Application Of Confidentiality – The Role Of The Legal Advisor

    Storing and disseminating information (also at business level) is an element of everyday life-one that does not seem to be differentiated from vital, human, functions..

    Safeguarding the integrity and confidentiality of information, notwithstanding the avoidance of the aforementioned sanctions, ensures the existence of high professional standards (in particular) for the companies concerned. This fact, inevitably, is reflected in its existence and development, in its relations with its customers and suppliers. It is reflected into the shareholders, the employees, the associates and their families.

    There is no doubt that securing confidentiality is an obligation of all those who are directly or indirectly involved in operating a company. However, the responsibility of the legal advisor is a little more special as he/she has the burden of: (a) informing the parties involved; (b) creating a coherent grid of contractual and other regulations, dissuasive to be breached; and (c) managing the critical situation created in the case of violation of any kind of confidential information.

    It is also not of a minor importance that your Legal Advisor’s involvement in Cyber Risk issues is already covered by Directive 2016/1148 on Measures for a High Level of Network and Information Security for Networks across the Union ( Network and Information Security Directive 2016/1148 – also known as NIS) – but for this issue, there shall be a specialized screening and filing on the same site.

     

    The Challenge (By Way Of Conclusion)

    In any case, it is more than obvious that securing confidentiality is one of the challenges of today’s business. It is up to us, the directly and indirectly involved (us Legal Advisors in particular), to assist and respond positively to this challenge by providing our own small contribution to what everybody desires, that is to secure and develop healthy entrepreneurship.

    Koumentakis-and-Associates-Stavros-Koumentakis

    Stavros Koumentakis
    Senior Partner

    [/vc_column_text][/vc_column][/vc_row]

  • Workshop Of Creative Pharma Services for Confidentiality

    Workshop Of Creative Pharma Services for Confidentiality

    [vc_row][vc_column][vc_column_text] Koumentakis & Associates Law Firm was invited and participated in the annual training conference of Creative Pharma Services, with a presentation titled: “Companies and Confidentiality”.

    The presentation of Mr. Stavros Koumentakis gathered the high interest of nearly one hundred executives and associates of the company who participated, as, apart from the general context of the issue, Mr. Koumentakis also referred to the specific issues arising for the Pharmaceutical market.

     

    Obligation Of Confidentiality

    Mr. Stavros Koumentakis, Senior Partner of Koumentakis & Associates Law Firm started his address with a reference into the obligation of confidentiality for all information related to a company and its stakeholders, such as associates, clients and employees and he furtherly focused on the particular issues related to pharmaceutical industry, including any information related to studies and pharmacovigilance as well as products, designs, patents, documents on policies and procedures.

     

    Personal Data

    Mr. Koumentakis then referred to the issue of personal data, the obligations and rights of employees and associates, and the capabilities that companies have in order to ensure Confidentiality (e-mail monitoring, retrieving deleted mail, recording of data from the company’s computers, etc.).

    Confidentiality Regulations And Sanctions

    As Mr. Koumentakis stated, the legal framework for confidentiality regulations is quite comprehensive both in general (Civil Code and Penal Code), and in particular (Law 2472/1997, Law 144/1914, Greek Code of Ethics for Pharmacists), as well as at the level of a company (Employment Agreements, Labor Code, Code of Ethics, NDA’s), while the sanctions for a confidentiality breach are Civil Penalties (two times the annual remuneration,  compensation for any damage), Penal sanctions (custodial sentences, financial penalties) and Professional penalties.

     

    The Benefits Of Confidentiality

    In conclusion, Mr. Koumentakis, noted that the issue is NOT, mainly legal, and that the benefits of securing confidentiality are obvious to the company, its clients, its employees and their families. Since, on the one hand, the company believes in its partners and trust in them, and on the other hand the partners confirm the high levels of professionalism with respectful confidentiality, this is a factor of growth and prosperity. “Regardless of sanctions, it is necessary to align the philosophy of the stakeholders and maintain high professional standards”.

    Koumentakis & Associates Law Firm was represented in the conference by Konstantinos Kornilakis, Partner and by Petrini Naidou, Senior Associate.

    [/vc_column_text][/vc_column][/vc_row]

  • Personal Data Protection And Companies

    Personal Data Protection And Companies

    [vc_row][vc_column][vc_column_text] European requirement the enforcement for Personal Data Protection. New compliance rules (Regulation 2016/679)

     

    Preamble: What Does Non-Compliance Mean

    It is true that any new obligation created for a company burdens its operating costs. But could anyone suggest non-compliance with the obligations under this Regulation for Personal Data Protection?

    To this case we could not remain indifferent. European Regulation (2016/679) is in force without the need for ratification by the Greek legislator.

    Sanctions threatened? Unsustainable! Without going into the details of criminal sanctions, the maximum penalties (fines) amount to € 10.000.000 or € 20.000.000 and at a percentage of 2% or 4% respectively of the infringer’s worldwide turnover (if the above amounts are below the respective percentages on its worldwide turnover!)

    Things are NOT simple …

     

    The Existing Institutional Framework

    The need to protect individuals from the constantly evolving (due to the rapid developments in technology) exposure of their Personal Data and the creation of a secure modus operandi of the data processors is underlined by the European Regulation 679 of 27 April 2016, which shall be in full effect for all Member States (among which our country, of course) on 25.5.2018.  

    In accordance with Law 2472/1997 on the Protection of Individuals with regard to the Processing of Personal Data (and its revisions), the Greek legislator has incorporated the European Directive 95/46 / EC “On the protection of individuals with regard to the processing of personal data and the free movement of such data”.

    The key foundations for the Protection of Personal Data that had already been set twenty years ago referred to the identification of:

    (a) the basic concepts such as “record”, “data subject”, “simple data”, “sensitive data”, “controller”, “processor”

    (b) the rights of the Subjects of Processing (each of us)

    (c) the obligations of Personal Data Controllers (natural and legal persons, bodies and organizations with whom we are required to have transactions in our daily lives from our employer to the Register of a Taxation); and

    (d) the establishment of the Personal Data Protection Authority, which would then function independently, as a supervising body and as an institutional guarantor for verifying compliance with the European requirements.

    The Personal Data Protection Authority has been set up and operating since then, it undertakes vigorous action while its decisions have become a serious item in the agenda of not only the legal world bit also of the public opinion, as for example in the case of identifying religion in identities.

    The European Parliament chooses in this Regulation a more dynamic position than the previous Directive, since the former is a law of increased formal validity (it raises upward the laws of each member – state) and is (unlike the Directive) directly applicable horizontally (its incorporation by the national legislator is not required).

     

    The Tightening For The Protection Of Personal Data In The Context Of The European Regulation

    The Regulation strengthens the protection framework and in particular:

    (a) the Controller is required to choose the most secure, organizational and technical measures both at the time when the data collection and processing measures are defined and at the time of processing.

    The obligations of the Controller and the Processor expanded (: record-keeping – specifications – processing activities) and acquire specific responsibility to receive and be able to demonstrate that it has taken all necessary measures to ensure that processing is carried out in accordance with the Regulation.

    (b) The rights of the Subjects are enhanced, including: (i) the right of access, (ii) the right of correction (or completion) (iii) the right to be forgotten (conditionally, the right to erase data), (iv) the right to object (v) the portability of data.

    (c) It is specifically provided for cases of systematic, extensive and large-scale assessment of personal data or systematic monitoring on a large scale of public places, an obligation to carry out an impact assessment of potential risks and consequences for the rights and freedoms of individuals arising from the type, the framework, the scope and the purpose of processing.

    (d) the Controller is required to immediately inform the authority of any breach of the system security (within 72 hours as from the moment he becomes aware of such)

    (e) the Controller (in cases explicitly mentioned in the Regulation, indicatively large-scale processing of data and / or sensitive data) appoints a Data Protection Officer, an internal supervisor (employee or external partner) (such as a security technician) who will ensure compliance with the regulatory framework (in conjunction with any specific regulation, if any, envisaged by the national legislator in the scope of his discretion) and has direct contact, cooperation with and reporting obligation for any violation to the Personal Data Protection Authority.

    (f) There are provided considerably stricter sanctions than the existing administrative and criminal penalties, with fines of between € 10.000.000 or € 20.000.000, and a percentage of the company’s turnover, as the case and the offender may be (if that percentage exceeds the above amounts).

    A significant difference with the current legal framework is that no disclosure to the Authority is foreseen, rather than the availability of the material (: processing file) at the direct request of the Authority. However, each national legislator may specify his requirements and request for Disclosures or Licenses, especially in cases related to processing of sensitive personal data. In order to examine the possible adoption of legislative measures for the implementation of the Regulation, a Legislative Committee has been already set up (Government Gazette 1913 / 27.6.2016) whose work we expect to be completed before the implementation of the Regulation.

    It is imperative that each Controller reviews (with the appropriate collaborators) the security status of his technical systems and of its organizational structure so that he is ready to comply with the requirements of the Regulation.

     

    However, Is There, Any Time?

    As already mentioned, the date the new European Regulation comes into effect is 25.5.2018 – i.e. at first reading, we have enough time to act. Still, is that the case?

    Many factors are to be evaluated in order to provide the answer: “Okay, we have a lot of time”.

    The kind of business activity, compliance with the current institutional framework, the concentration (and / or handling) of sensitive, apart from simple, personal data, and so on.

    Let us not rush to answer that “we do not have sensitive personal data”. Do we ask for criminal records for some of our employees? Do we have a record of the health status of some of them? Do we have security cameras for the security of our company?

     

    Conclusion

    While we expect what (also) the national legislator will impose, the institutional framework for the protection of personal data has already become more complex. Threatened sanctions not only are significant but also, in fact, dramatically high.

    Preparing the company, most of the time, is neither easy nor quick.

    The need for more detailed information, a first assessment and for the first procedural steps, is present.

    Today!

     

    [/vc_column_text][/vc_column][/vc_row]

  • Participation In The Entrepreneurship Program Of Mandoulides Schools

    Participation In The Entrepreneurship Program Of Mandoulides Schools

    [vc_row][vc_column][vc_column_text]

    Experiencing Vocational Guidance

    “Koumentakis & Associates Law Firm” has cooperated with Mandoulides Schools within the framework of the latter’s Entrepreneurship Program which is implemented with the aim of enhancing experiencing vocational guidance for students over 16 years of age.

    More specifically, within the framework of the Entrepreneurship Program of Mandoulides Schools, “Koumentakis & Associates Law Firm” hosted for 4 weeks the student of the Schools Mr. Nikos Kipouros, who attended the main activities of the firm, such as associates’ meetings, meetings with clients, secretarial functions and was informed about issues related to the scientific subject.

    Mandoulides Schools

    The Schools, always believing in the provision of high educational services such as experiencing vocational guidance. In this context the schools collaborate with organizations that can offer a rich experience, since the main learning tools are the observation and oral interaction of the students with the executives of the companies.

    Victoria Pervizou, Head of the Entrepreneurship Program of Mandoulides Schools. Nikos Kipouros, Student. Stavros Koumentakis, Senior Partner of KOUMENTAKIS & ASSOCIATES.

    The program in KOUMENTAKIS & ASSOCIATES

    Koumentakis & Associates Law Firm encourages the continuous education and development of pupils and students through work. Within the firm’s environment, trainees feel new experiences, explore their professional interests and develop new skills, while at the same time, they have the opportunity to get acquainted with tools and methods that help them acquire assets of great value.

    The apprenticeship

    Apprenticeship is a special form of vocational education, which is an important strategic advantage for an educational institution, a student and a business. It is a combination of work and vocational training, which offers benefits to all sides, as new talents and fresh ideas flow, trainees acquire new skills and the operator offers opportunities to practice, train and gain experience.

    [/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_text_separator title=”Gallery” border_width=”3″][/vc_column][/vc_row][vc_row][vc_column][vc_images_carousel images=”35274,35271,35273,35275″ img_size=”” slides_per_view=”3″ autoplay=”yes” hide_pagination_control=”yes”][/vc_column][/vc_row]

  • The Proper Legal Advisor

    The Proper Legal Advisor

    [vc_row][vc_column][vc_column_text] Legal Advisor, Attorney, Counsel. How many times have we all been wondering about who is the appropriate? Is it a question of remuneration (: cheap / expensive), promoted by the media (: unknown / famous), studies and experience, age or gender? And me, I’m neither from the Boston Legals nor member of the team of Suits. No such luck nor experiences! I managed to write a simple decalogue, which does not even refer to the level of fees … Who is the appropriate legal advisor and lawyer? Is it yours?

    1. Trust, Integrity, Prestige

    A constituent element of the client – lawyer relationship is trust. If we do not trust the (potential) lawyer, legal advisor, or if he does not trust you, I shall be dogmatic: We DOT not start a cooperation. But in the case that we have started the cooperation and we already see that mutual trust has been lost, we stop it DIRECTLY! We seek for another lawyer. A lawyer we can trust.

    But in order to trust our lawyer, he must have inspired us and still, unfailingly and continuously, inspire us with his integrity, credibility, seriousness and prestige. If, hopefully, he did not succeed with us, how will he succeed in court, clients and colleagues while defending our interests?

    2. Strategy And Details

    It is usually easy for any lawyer to deal with our affairs. But is that all we need? We must not forget that our legal advisor must develop a strategy for handling each case (small or large). And it is certain he will do well if he can be two steps ahead of others – not just one. But this strategy should be dynamic. At all times, and depending on the developments, its correctness should be assessed and, when necessary, revised. Caution! We are not only interested in the “forest”, we are also interested in the “trees”. No single case was won by strategy alone. It is necessary to look into the details that our counterparts and contractors have not identified. Our Attorney is the right person to deal with them-better not you!

    3. Knowledge And Experience

    No one would like to (and should not) choose an “illiterate” lawyer or someone (who thinks he) “knows everything”. An appropriate legal advisor is not only he who has the appropriate scientific knowledge and expertise, but also, he who has the courage to accept the limits of his abilities. And for the rest to refer (or he himself to address) to the experts. And if, hopefully, our lawyer, focusing on our pocket or to impress us, makes us believe that “he knows everything and that he can do anything” you should introduce him to me. Because I still believe that there is NO such a lawyer.

    4. Consistency, Judgement And Perception

    What is more attractive than the spiritual consistency and the satisfactory, at least, judgment and perception? Does anyone imagine a lawyer who not only is he not able to perceive those that happen but is also unable to decode them and use them in his client’s benefit? Does anyone imagine a lawyer without analytical and, at the same time, synthetic thinking? And more over: Does anyone imagine a lawyer whose speech (spoken or written) is not understood or attractive? We must not forget that every lawyer has listeners, judges or co-contractors before him. And if he cannot bring the interest of the listener or reader to what he himself supports or, worse, be understood in the formulation of his thoughts, he probably should not be our legal advisor.

    5. Negotiating capacity, Persuasion And Passion

    And if I take for granted the judgment and perception of the lawyer we have chosen, I should also take for granted his negotiating capacity in the defense of our affairs and interests. It is precisely in this capacity that our legal advisor must be able to convince the people he is dealing with on our behalf.

    But it is a prerequisite that he himself has been convinced. And more over: to defend us and our interests with passion. For if he is not convinced himself, and is confined to the simple, lukewarm, quote or reading of our argument, we must also assume that even the people he has before him will not be convinced.

    6. Qualitative And Quantitative Performance. Speed Of Response And Availability

    We cannot expect from our lawyer anything less than the best. The best in quality, the most in quantity and at the right (fastest) time. And that because, think of a lawyer who does his job extremely good thus without respect (or commitment) to procedural deadlines or to the client’s business needs. A lawyer that has been just today able to start working on the job he was assigned with a month ago. And to complete it, “God will provide” …

    And just to meet our needs, experience has shown that it is not possible for a lawyer to invoke or use a timetable, to divide the days into working and unparalleled, or to systematic lack, for whatever reason, availability and inability to communicate. Availability is required when and wherever needed!

    7. Efficiency

    We have all met competent people who, however, are unable to focus on the outcome and often to succeed getting one. And it is true that each interested person, by nature, always wants to win (whether he says it or not). However, it is important that our attorney focuses on the best result and does not leave “incomplete” his or her relative effort either by indolence or by indifference or for any other reason. It is important that our lawyer does not leave the case file aside before completing whatever is necessary and possible.

    8. Calmness And Sobriety

    When someone reaches the point of seeking the advice or assistance of his lawyer, it means that a matter of importance is of concern to him. Sometimes these issues prove to be complex and highly complicated. And some others, are reaching the point of crushing, with their consequences, those concerned. And here is the need for an appropriate legal advisor: not to share (client’s) panic attack (but eventually), to decode the data and put them in their true dimension, to propose the appropriate strategy, but also to implement it, to select and oversee the individual solutions.

    Crisis management (whether it refers to smaller or larger or / and really big crises) is, beyond any doubt, an almost daily necessity to which our legal advisor must successfully respond.

    9. Self-Confidence And Ability to Collaborate.

    We all know what a lack of self-confidence means. And if we refer to children, we can reasonably look forward to strengthening it over time. But if we meet the lack of confidence in our doctor or lawyer, can we have hope? It may be the case if, in order to strengthen it, he will appeal to willing and better than its own colleagues. But if such are not available or are already tired of him? If he tries to “cling” to our own thought and opinion to choose or strengthen his own? He’s probably not the appropriate lawyer.

    It also does not seem for our legal counsel to be the right person if he lacks team spirit and of the ability to co-operate with the useful and necessary persons, to recognize their assistance and contribution and the fact that he relies (to any extent) on those. If our lawyer needs a confirmation of his skills by concealing the necessity of collaborations and of his associates, we should probably start to doubt both his abilities and him.

    And something more: Our legal advisor should have leadership skills, he must be able to set up a team and manage it for the best result but also to “take upon himself” our case. But, in particular: to be in a position to remove the burden that our case, personally, and fair, creates.

    10. Does He “Lay Down A Part Of His Life” For Your Cases?

    And if we identified the appropriate lawyer who has “everything in the world” -and more and even more, there is one last question: Do we feel that our lawyer deals with our affairs, simply as a good professional or that, in addition, he lays down a part of his life for them? If the second ALSO happens I think we should not leave him.

    He is the one who will do what is humanly possible for us and for our interests, the one who will “turn night into day” and who will “upset everything” for us. It is he who is honestly happy with our joy and who does not “give up” in our dead ends. He is the one who will continue to fight until victory or up to the end. He is the one who deserves to be OUR LAWYER!!!

    So, is your lawyer the proper lawyer, legal advisor and counsel? I guess you have, already, concluded…

    [/vc_column_text][/vc_column][/vc_row]

  • New Era For Koumentakis And Associates Law Firm

    New Era For Koumentakis And Associates Law Firm

    [vc_row][vc_column][vc_column_text]

    Goodbye Mitropoleos St.: Growth Romped To Victory!

    *Niki(s) in Greek means Victory

    New offices and New Era for Koumentakis & Associates Law Firm, that moved to Nikis Avenue & Morgentau St., in a strategic location in the heart of Thessaloniki (and, semiologically, beside the main symbol of the city: the White Tower).

    New Era

    The source of inspiration for the new offices was the firm’s extrovert strategy to serve its Growth, to “house” new possibilities and new prospects for the firm, its Clients and Associates and to increase the already high level of the services it offers to its Clients and Associates.

    Beyond Legal Services

    Mr. Stavros Koumentakis characteristically said, “After 20 years of presence in our previous, owned offices, it is time to leave behind the past, to turn over a new leaf looking to the future with optimism and to prepare ourselves for the transition to the new era. From a smaller scheme of four associates, we have gradually grown into a boutique law firm of twelve, to date, associates.

    We are already able to offer comprehensive and reliable legal services across a wide range of areas and expertise within the overall support of companies, key shareholders, senior management – and beyond”.

    Easy Cases Are For Others

    Mr. Stavros Koumentakis also noted, “Despite the unfavorable (national and international) economic environment, we are constantly moving towards investing in our growth and in the growth of our clients. We have no doubt that we are facing challenges. But we respond dynamically: “Easy cases are for others”. [/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_text_separator title=”Corporate Video” border_width=”3″][vc_video link=”https://youtu.be/ipGtyvwcqhU” align=”center”][/vc_column][/vc_row][vc_row][vc_column][vc_text_separator title=”Gallery” border_width=”3″][/vc_column][/vc_row][vc_row][vc_column][vc_images_carousel images=”35167,35168,35169,35170,35171,35172,35174,35175″ img_size=”” speed=”6000″ slides_per_view=”4″ hide_pagination_control=”yes”][/vc_column][/vc_row]

  • Participation In The Workshop “Corporate And Household Insolvency”

    Participation In The Workshop “Corporate And Household Insolvency”

    [vc_row][vc_column][vc_column_text] George Karanikolas, Associate at Koumentakis & Associates Law Firm, was invited and participated in the workshop organized by the Legal Department of the IMF on “Corporate and Household Insolvency in Europe”.

     

    Workshop For Insolvency

    In the recent workshop at the Joint Vienna Institute, presenters and participants evaluated the interaction between policy objectives and technical solutions in corporate and household insolvency and discussed on the trends for the future development of relevant legislation.

    The workshop is interactive and designed for policy makers by a diverse group of European countries dealing with corporate and household insolvency issues, by leading international experts and representatives of the legal and European departments of the IMF, the World Bank, the EBRD and of other international organizations.

     

    Workshop’s Objective

    The objective of the workshop was to provide a forum for executives from European countries in order to share with their colleagues from other countries their experience of reforms and of the implementation of the bankruptcy law for companies and households as well as the requirements and alternative techniques for the management of adverse debt.

     

    Knowledge transfer

    The global financial crisis and the subsequent European crises reinforced the need for adequate and effective debt reductions and many countries have implemented or have implemented debt adjustments to deal with the consequences of changes in the economic environment.

     

    In this two-day workshop senior executives from European countries responsible for planning or implementing bankruptcy laws for companies and households and related issues participated. Upon completion of this workshop, participants are able to:

    • Evaluate the interaction between policy objectives and technical solutions in corporate and household insolvency
    • Identify trends for the future development of bankruptcy legislation
    • Draw lessons from positive and negative experiences in European countries

     

    Curriculum Vitae

    George Karanikolas studied at the Law School of the Democritus University of Thrace and received a postgraduate diploma (LLM) from the Law School of the University of Bristol (Law & Philosophy). Since 2013, he is an external associate of the Greek Translation Department of the Court of Justice of the European Union and since 2015 he is a scientific and expert associate of the Ministry of Justice, Transparency and Human Rights and also a PhD candidate of the Department of Penal and Criminal Studies of the Law School of the Aristotle University of Thessaloniki. George has been an associate of Koumentakis & Associates Law Firm and specializes in issues of bankruptcy and criminal law.[/vc_column_text][/vc_column][/vc_row]

  • Participation In Mare Nostrum VIII Congress

    Participation In Mare Nostrum VIII Congress

    [vc_row][vc_column][vc_column_text] Eleftheria Bitzaraki, Trainee at Koumentakis & Associates Law Firm participated in Mare Nostrum VIII, an annual congress organized for the eighth consecutive year in Rhodes by the Department of Mediterranean Studies at the University of the Aegean, with the scientific support of the Center for the Study of Mediterranean – Middle Eastern policy and culture.

     

    Mare Nostrum’s Objective

    The objective of the congress was to highlight as much as possible the multiple aspects of accumulated crises at the legal, political, ideological, economic and social levels as well as the interaction between them.

     

    The Presentation Of Eleftheria Bitzaraki

    In this context, Eleftheria was called upon to develop the legal parameters of the refugee crisis in the Mediterranean, since the last two years (2014-2016), and especially 2016, have been the most lethal year in recent years at the level of refugees. And why is it the Mediterranean? Because there is a variety of international problems in it. The only stable that exists in the Mediterranean at this time is the instability from the constant movement of populations and, along with them, the overthrow of borders and regimes.

    In the presentation of Eleftheria Bitzaraki there are developed purely legal issues about the way in which the states have taken measures, both at international level and at our country level, by passing laws, by adopting decrees, by ratifying international or European conventions, in order to check the huge number of refugee flows that crossed and cross the Mediterranean even today.

     

    Reference To The International Conventions

    More characteristically, reference has been made to the well-known and with a variety of extensions Agreement between the European Union and Turkey on the control of the refugee population and the positive (for some) and negative (according to others) results it has brought, as well as the crucial role of the Court of Justice of the European Union (CJEU) by adopting both legislation and case law on this issue. Also, reference was made to the procedures for the admission of refugee flows under the Directive 2013/33 / EU and Presidential Decree 220/2007 as well as the important role of NGOs in this. Without omitting the extensive reference to the Geneva Convention 1951 and to the New York Declaration which followed, as key elements of the international legal framework for the protection of refugees and the role of the UN High Commissioner for Refugees. Finally, Eleftheria also referred to the Dublin Regulation on Access to Asylum Procedures and the way in which Greece with Laws 4375/2016 and 4399/2016 succeeded (or not) to incorporate European directives into domestic law.

     

    Curriculum Vitae

    Eleftheria Bitzaraki was born in Heraklion, Crete, in 1992, and completed her studies in the Law Department of the Aristotle University of Thessaloniki in 2016. She participated in virtual trials organized by legal entities in the country in collaboration with the Aristotle University of Thessaloniki. Eleftheria speaks Greek, English, German, Russian.

     

     

     

     

     

     

     

     

     

     

     

     

    [/vc_column_text][/vc_column][/vc_row][vc_row][vc_column][vc_text_separator title=”Gallery” border_width=”3″][/vc_column][/vc_row][vc_row][vc_column][vc_images_carousel images=”35151,35150,35149″ img_size=”” speed=”6000″ slides_per_view=”3″ hide_pagination_control=”yes”][/vc_column][/vc_row]

This site is registered on wpml.org as a development site. Switch to a production site key to remove this banner.