Digital Transformation and the Public Sector: The Legal Framework for Protecting Citizens against Algorithmic and Artificial Intelligence Errors

Digital Transformation and the Public Sector: The Legal Framework for Protecting Citizens against Algorithmic and Artificial Intelligence Errors
Digital Transformation and the Public Sector: The Legal Framework for Protecting Citizens against Algorithmic and Artificial Intelligence Errors
The digital transformation of the Greek Public Administration (gov.gr) has radically reshaped state-citizen relations, introducing automated procedures in tax administration (IAPR/AADE), social security (e-EFKA), and the issuance of administrative acts. However, the deployment of algorithmic systems and Artificial Intelligence (AI) tools introduces new legal risks, most notably algorithmic error, which can lead to arbitrary tax assessments, benefit cuts, or erroneous digital cross-checks.
In a modern Rule of Law, the introduction of new technologies into the Public Administration is strictly limited by the Constitution and European Union law. Citizens are not left defenseless against the “impersonal” machine, as they possess a robust framework of legal safeguards.
1. The European Framework: Article 22 of the GDPR
The fundamental legal buffer against algorithmic arbitrariness is rooted in Article 22 of the General Data Protection Regulation (EU) 2016/679 (GDPR). The provision explicitly states:
“The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.”
Although paragraph 2 of the same article allows an exception for automated decision-making when it is based on an explicit provision of law (as is frequently the case in Public Law for reasons of public interest), the lawfulness of this processing is strictly conditional upon the establishment of suitable measures to safeguard the data subject’s rights, freedoms, and legitimate interests.
These measures must mandatorily include:
    • The right to obtain human intervention on the part of the competent public body (human-in-the-loop).
    • The right to express one’s point of view and submit objections before the act is finalized.
    • The right to contest the decision before the Administration or the Courts.

2. The National Legislative Framework: Law 4961/2022
Greece pioneered this area by enacting Law 4961/2022 (Government Gazette A’ 146/27.07.2022) on “Emerging information and communication technologies,” which establishes the regulatory framework for the use of Artificial Intelligence in the public sector.
Pursuant to Articles 9 to 13 of Law 4961/2022, any public body intending to use an AI system to make decisions or to support decision-making that impacts citizens is required to:
    1. Conduct a Data Protection Impact Assessment (DPIA), in accordance with Article 35 of the GDPR.
    2. Adhere to the principles of transparency and explainability. The citizen is entitled to know the parameters, the input data, and the logic on which the algorithm relied to reach a specific judgment.

3. Constitutional Principles and the Code of Administrative Procedure
Every automated administrative act must align with the established principles of Greek Administrative Law:
    • The right to a prior hearing (Article 20 paragraph 2 of the Constitution & Article 6 of the Code of Administrative Procedure – Law 2690/1999): The Administration cannot issue an adverse administrative act based solely on an algorithmic finding without first inviting the citizen to present their views and submit counter-evidence.
    • The obligation to provide specific and thorough reasoning (Article 17 of the Code of Administrative Procedure): A simple reference to a “digital cross-check result” or a “finding of the information system” does not constitute lawful reasoning. The act can be judicially annulled due to a lack of reasoning if the specific facts and legal criteria applied by the system are not detailed.

4. Legal Defense Mechanisms for Citizens
In the event that an erroneous act is issued due to a digital or algorithmic error, citizens have specific legal remedies and means at their disposal:
    • Administrative Appeal / Petition for Redress: Within the statutory limitation periods, an appeal is filed before the issuing or superior authority, requesting a human review of the data and the correction of the error.
    • Application for Annulment or Substantive Appeal to the Administrative Courts: If the Administration rejects the objection, the case is brought before the Administrative Courts of First Instance/Appeal or the Council of State (StE). The primary grounds for annulment include the violation of an essential procedural requirement (lack of a prior hearing) or a mistake of fact (factual error) caused by the information system.
    • Complaint to the Hellenic Data Protection Authority (HDPA): For violations of the terms of Article 22 of the GDPR or the failure of the public body to conduct the required DPIA.

Conclusion
Digital transformation is a driver of growth, but the principle of legality governing the actions of the Public Administration (Article 43 et seq. of the Constitution) dictates that technology must remain subject to the rule of law and respect for human rights. The Rule of Law does not back down in the face of algorithms; on the contrary, it adapts its legal tools to guarantee that every state decision maintains its human-centric foundation.