Greece Ran AI Surveillance on Asylum Seekers for Years Before Anyone Checked If It Was Legal
What happened
Greece's Ministry of Migration and Asylum spent years operating two AI-powered surveillance systems inside asylum centres on the Aegean islands without the data protection safeguards the law required. The Greek data protection authority eventually fined the ministry EUR 175,000, the largest penalty ever imposed on a Greek public body, for the way those systems were developed and deployed. The surveillance ran from 2021 through 2024 before regulators formally intervened.
The two systems, named Centaur and Hyperion, were installed at reception and hospitality structures for asylum seekers on the islands. Centaur is an integrated physical and electronic security platform that uses cameras, drones, and motion analysis algorithms to monitor movement across the facilities. Hyperion functions as an entry-exit control system, pairing RFID card readers with fingerprint scanners to track who enters and leaves. Both systems process biometric and location data about some of the most legally vulnerable people in Europe, individuals waiting on asylum decisions that will shape the rest of their lives.
Greece's data protection authority concluded that the ministry had failed to meet several specific requirements under the EU's General Data Protection Regulation. The data protection impact assessments for both systems were incomplete, and the authority found serious omissions in how the ministry documented its compliance obligations. Those assessments exist precisely to force deployers to work through privacy risks before a system goes live, not after complaints surface. Completing them inadequately means the systems collected and processed personal data for years without a legal foundation sufficient to justify what they were doing.
Both systems received funding from the European Union, which adds a layer of accountability complexity: public money from a bloc whose data protection rules the systems violated underwrote the infrastructure that broke those rules. The EUR 175,000 fine signals that deploying AI surveillance on a vulnerable population without proper documentation is not a procedural shortcut, it is a legal violation with consequences. But the fine arrived years after the systems were already running, after years of data had already been collected.
The gap this incident exposes repeats across government AI deployments: a system goes live, it processes data about thousands of people, and the compliance documentation is incomplete or missing. By the time a regulator finishes its assessment, the unlawful surveillance has already occurred. The individuals whose movements, biometrics, and presence were logged have no way to know what was captured, who accessed it, or how long it will be retained. A provable record of what a system did, generated at the time of deployment rather than assembled retroactively under the pressure of a fine, would shift that burden before the harm accumulates rather than after.
Reported impact
- Affected parties
- Not publicly disclosed
- Harm type
- Not publicly disclosed
- Scale
- Not publicly disclosed
- Financial impact
- Not publicly disclosed
- Regulatory action
- Not publicly disclosed
Classification
Relevant governance controls
Governance control mapping is not available for this record.
- No controls mapped
Not publicly disclosed
Control mapping is analytical. It does not state that any control would have prevented the incident.
Sources and evidence
This record was researched and written by the Index. The event is also catalogued in the following database, which is listed for cross-reference.