How to Obtain Third‑party Disclosure (right of Information) Orders in Greece (2026)

Third-party disclosure Greece is one of the most powerful tools available to a rights-holder who has found infringing content online but does not yet know who is behind it. When an anonymous seller lists counterfeit goods, an unidentified account distributes pirated software, or a shell operator runs an infringing storefront, the identity you need is almost always held by a platform, host or internet service provider, not by the wrongdoer. Under the Greek framework implementing the EU IPR Enforcement Directive, together with the general rules of Greek civil procedure, the procedure for compelling that disclosure, preserving ephemeral evidence and moving quickly against intermediaries is well established.

This guide takes a clear position: for identity-unknown online infringement where the platform holds the data, applying for a disclosure order is usually the right first move, and this article explains how to approach it, when to choose an alternative remedy, and how to enforce the result.

What is a third-party disclosure order in Greece?

The “Norwich Pharmacal” order is a common-law concept: a court order compelling an innocent third party, one who is “mixed up” in wrongdoing without necessarily being a wrongdoer themselves, to disclose information needed to identify the actual infringer or to enable a claim to proceed. Greece is a civil-law jurisdiction and does not use that common-law device by name, but Greek civil procedure achieves a comparable result through its disclosure and interim-relief mechanisms, read together with the right of information implemented from the EU Enforcement Directive (Directive 2004/48/EC, EUR-Lex).

In practice, third-party disclosure Greece means asking a Greek court to order a marketplace, social platform, hosting provider or ISP to hand over subscriber details, IP logs, billing data or transactional records.

The right of information under Article 8 of the Enforcement Directive is central: it obliges Member States to ensure that, in response to a justified and proportionate request, courts can order disclosure of information on the origin and distribution networks of infringing goods or services by persons found to be providing services used in infringing activities on a commercial scale. Greek law gives effect to that right. Any disclosure of personal data must be reconciled with the GDPR (Regulation (EU) 2016/679, EUR-Lex) and the ePrivacy rules, and may engage the guidance of the Hellenic Data Protection Authority.

Legal basis in Greece

Greek practitioners seeking disclosure against intermediaries rely on the general civil procedure provisions (including rules on the production of documents and on provisional measures under the Greek Code of Civil Procedure) read together with the transposed text of the Enforcement Directive. The right of information, evidence-preservation measures and provisional injunctions provide the statutory footing for identifying infringers and freezing evidence in IP matters. The substantive EU anchor is Directive 2004/48/EC (EUR-Lex). Because disclosure of subscriber identity engages traffic and personal data, the analysis must always be reconciled with the GDPR and the applicable national data-protection and ePrivacy framework.

When is disclosure the right remedy?

Disclosure is the right remedy when you have credible evidence of infringement but cannot name the defendant, and the data you need sits with a third party. If you already know who the infringer is, or if a direct takedown resolves the harm, disclosure may be unnecessary. The decision framework later in this guide sets out the test, but the short rule is this: use third-party disclosure Greece when identity is the obstacle to bringing your claim.

Legal standard, evidence checklist and affidavit drafting for disclosure

A disclosure application lives or dies on the quality of the evidence filed with it. Greek courts will not order an intermediary to disclose a user’s identity on a thin record; the applicant must demonstrate a genuine case of infringement, the necessity of the disclosure, and the proportionality of what is requested. Build the file before you file.

Elements the applicant must establish

To succeed in a third-party disclosure application, you should be prepared to establish each of the following:

• Prima facie infringement. Credible evidence that an intellectual property right you own is being infringed, not mere suspicion. Screenshots, listing URLs, test purchases and expert comparison of the infringing item against your protected work or mark all contribute.
• The third party holds the necessary information. The platform, host or ISP need not be a wrongdoer; it is enough that, through its services, it became involved in the infringing activity and now holds data identifying the wrongdoer.
• Necessity. The information sought is genuinely required to identify the infringer or to commence proceedings, and it is not reasonably available from another, less intrusive source.
• Proportionality. The scope of disclosure requested is tailored to what is needed, subscriber identity and relevant logs, rather than a broad fishing expedition into unrelated user data.

Evidence checklist, what to collect before filing

Assemble the following before drafting the application. A complete file both speeds the hearing and strengthens your position on proportionality:

• Proof of right. Registration certificates (trade mark, design, patent) or evidence of subsistence and ownership of copyright.
• Infringement evidence. Dated, hash-verified screenshots of the infringing listing, profile or content; full URLs; archived captures; and, where relevant, test-purchase records and invoices.
• Linkage evidence. Material connecting the infringing act to the specific account, handle, storefront or IP address held by the intermediary.
• Prior notices. Any takedown or notice-and-removal correspondence sent to the platform, and its response (or silence), which demonstrates necessity and good faith.
• Preservation request. A copy of any preservation letter already sent, showing the risk of data loss and your attempt to mitigate it.
• Data-protection analysis. A short note anticipating GDPR objections and explaining the lawful basis and balancing in your favour.

Supporting statements and pleaded language, drafting tips

Draft the supporting statement in the first person of the person with direct knowledge, exhibit every item of evidence with a clear schedule, and plead the four elements expressly. Use operative language such as: “The Respondent, through the provision of its hosting/marketplace services, holds subscriber and access-log data necessary to identify the person responsible for the infringing listing at [URL]; such disclosure is necessary to enable the Applicant to pursue its claim and is limited to [specified data categories].” Keep the requested categories narrow and itemised, courts grant tailored orders far more readily than open-ended ones.

How to compel platforms and ISPs to disclose user data, step by step

Compelling a disclosure order against platforms in Greece follows a logical sequence from pre-action correspondence to enforcement. Skipping the pre-action steps weakens your necessity argument; rushing to court without a preservation request risks losing the very data you seek.

Notice, takedown and communication with platforms

Begin with the platform’s own notice-and-removal channel. A well-documented takedown request may resolve the immediate harm and, critically, creates a paper trail. At the same time, send a formal preservation letter asking the provider to retain all data associated with the infringing account pending a court order, subscriber details, IP and access logs, billing records and the content itself. Many providers will preserve on request even where they will not voluntarily disclose. This correspondence becomes exhibit material demonstrating both the risk of evidence loss and the necessity of judicial compulsion.

Court application process, jurisdiction, forum and supporting material

File the disclosure application before the competent Greek court, supported by witness/supporting statements, the full evidence schedule and your data-protection note. Identify the correct respondent precisely, the hosting entity, marketplace operator or ISP that actually holds the data, and specify the categories of information sought. Plead the statutory and EU basis expressly, grounding the request in the right of information under Directive 2004/48/EC and the relevant provisions of Greek civil procedure. For urgent matters, request expedited handling under the provisional-measures procedure and, where evidence is at risk, a parallel evidence-preservation order. For tailored assistance in preparing and running such applications, readers can consult Dr Henning Voelkel, GLE profile.

Service, enforcement and cross-border data issues

Once granted, the order must be served on the respondent. A domestic Greek intermediary will ordinarily comply within the ordered timeframe; non-compliance can expose it to coercive measures through the courts. The complication arises where the data is held abroad. If the platform or ISP stores identifying information outside Greece, enforcement may depend on cross-border cooperation, the provider’s EU establishment, or recognition mechanisms, and foreign privacy regimes may constrain what can be produced. This is precisely why the decision framework below flags overseas data storage as a factor that may favour an alternative remedy. Where data sits with an EU-established provider, disclosure against ISPs in Greece and against hosts generally remains enforceable through domestic proceedings read with the Enforcement Directive.

Timelines, expedited relief and enforcement

Speed is often decisive. Infringing listings can be deleted, accounts abandoned and logs rotated within days. Greek procedure offers both a standard track and expedited provisional-measures routes, and choosing the right one depends on how imminent the risk of data loss is.

Emergency preservation

Where evidence is at imminent risk, apply for an evidence-preservation measure. In a genuine emergency, a provisional measure can be sought on an expedited basis, in the most urgent cases through a temporary order (προσωρινή διαταγή) pending the full hearing on provisional measures, freezing the data in place and, where appropriate, directing the creation of a forensic copy. Preservation does not give you the data, it stops the data disappearing while your disclosure application is heard. Pair the two: send the preservation letter, apply for the preservation measure if the provider will not cooperate, and pursue the disclosure application in parallel.

Disclosure procedure and indicative timetable

Timelines depend heavily on the court’s list, the procedural track chosen and the complexity of the data-protection balancing, so any figures below are indicative only. A temporary order can sometimes be obtained very quickly where urgency is shown, while a full hearing on provisional measures and a reasoned decision will take longer. A realistic working sequence looks like this:

• Day 0. Send preservation letter; begin assembling the evidence schedule.
• Immediate. If data is at risk, file for a temporary order / evidence-preservation measure.
• Early stage. File disclosure application with full supporting material; request expedited handling.
• Hearing stage. Hearing and reasoned decision on the provisional-measures track; faster where a temporary order is granted.
• On grant. Serve the order; monitor compliance; escalate to coercive measures for non-compliance.

Tactical considerations, privacy, GDPR, proportionality and defences

Every disclosure of user identity engages data protection and, sometimes, free-expression interests. Anticipate the objections and defuse them in your filing rather than waiting to meet them at the hearing.

Responding to platform and data-protection objections

The most common resistance is that disclosure would breach the GDPR. That objection can usually be answered where the request is correctly framed. Disclosure in response to a court order pursued to establish, exercise or defend legal claims can rest on a lawful basis under the GDPR (Regulation (EU) 2016/679, EUR-Lex), and a controller that complies with a lawful judicial order acts within that framework. Note that access to electronic communications traffic data is subject to additional, stricter conditions under EU case law, so disclosure of IP-based identification data must be carefully justified.

The Hellenic Data Protection Authority has an interest in ensuring the balance between a subscriber’s privacy and a rights-holder’s effective remedy is properly struck, which is why your proportionality case, narrow categories, genuine necessity, documented infringement, is the heart of the application. Platforms may also raise jurisdictional or intermediary-liability arguments; address these by identifying the correct respondent entity and grounding the request in the right of information under the Enforcement Directive. Objections that the data is stored overseas should be met head-on with your cross-border enforcement strategy.

Minimising litigation risk and costs

Keep requests proportionate, document every pre-action step, and avoid overreach, an overbroad application invites refusal and cost exposure. Coordinate preservation and disclosure so you do not pay twice for parallel emergency work that could have been combined. Where a provider signals willingness to preserve but not disclose, that cooperation reduces the urgency and may let you proceed on the standard track at lower cost.

Comparison: disclosure vs. alternative interim remedies

Disclosure is not the only interim tool, and the right choice depends on whether your obstacle is identity, ongoing harm or disappearing evidence. The table below sets out the options side by side so you can choose decisively.

Decision framework.

Choose a third-party disclosure order when:

• You have credible, documented evidence of infringement but lack the defendant’s identity;
• The platform or ISP holds identifying data necessary to commence main proceedings; and
• You can show necessity and proportionality, continuing harm or an inability to proceed without disclosure.

Choose an alternative remedy first when:

• Effective relief is available via direct takedown, blocking or preservation (fast marketplace takedowns resolve the harm);
• The data is stored overseas and subject to foreign privacy laws that make disclosure unlikely; or
• The harm is immediate and demands a blocking injunction or evidence-securing measure rather than identity disclosure.

Practical checklist, pre-filing, filing, enforcement and preservation playbook

Quick checklist. Work through these in order:

1. Capture evidence. Hash-verified, dated screenshots; archived URL captures; test-purchase records.
2. Confirm your right. Pull registration certificates or copyright subsistence evidence.
3. Send the preservation letter. Request retention of subscriber data, logs, billing records and content.
4. Identify the correct respondent. The entity that actually holds the data, host, marketplace operator or ISP.
5. Draft the supporting statement. Plead prima facie infringement, the third party’s involvement, necessity and proportionality; schedule every exhibit.
6. Prepare the data-protection note. State the lawful basis and the balancing in your favour.
7. File for a preservation measure if data is at risk. Seek a temporary order where urgency justifies it.
8. File the disclosure application. Request expedited handling where harm is ongoing.
9. Serve and monitor. Track compliance; escalate to coercive measures for non-compliance.
10. Engage a forensic vendor. For imaging and chain-of-custody where seizure or forensic copying is ordered.

When to call counsel, urgent triggers. Contact a litigator immediately if the infringing account shows signs of imminent deletion, if logs are about to rotate, if a large-scale commercial infringement is live during a sales peak, or if the data appears to be held by an overseas provider requiring a cross-border strategy.

Costs, likely outcomes and risk matrix

Costs vary with urgency and whether parallel preservation is needed. A standard disclosure application on documented evidence is more economical than a contested, multi-track matter involving emergency preservation, forensic imaging and cross-border enforcement. Success is most likely where the evidence of infringement is strong, the respondent is EU-established and the requested data is narrow. Outcomes are least certain where the record is thin, the request is overbroad, or the data is held under a foreign privacy regime. The practical lesson is that investment in evidence quality and proportionate drafting at the outset is the single biggest driver of a favourable, cost-effective result.

Case law and templates

Greek courts assess disclosure and interim relief against the balancing principles developed in national jurisprudence and the EU framework, including Court of Justice of the EU case law on the right of information and on access to subscriber and traffic data. Administrative and constitutional balancing questions may be researched through the Council of State; the statutory and gazetted texts can be consulted through the official Government Gazette database. Two template assets support this guide: a sample disclosure supporting statement (with an English and Greek evidence checklist) and a template preservation letter, each dated and labelled for versioning. Supporting cluster resources on preserving digital evidence and enforcing rights against online marketplaces complement this pillar.

Conclusion

Third-party disclosure Greece remains a decisive route to unmasking anonymous online infringers. The recommendation is clear: where identity is your obstacle, you hold credible infringement evidence, and the data sits with a platform or ISP, pursue a disclosure order, but send a preservation letter first, keep your requests narrow and proportionate, and build the evidence file before you file. Where the harm is immediate, the data is held overseas, or a simple takedown resolves the problem, choose the alternative remedy instead. Used well, third-party disclosure Greece turns an anonymous listing into a named defendant and a preserved evidential record you can take to trial.

Sources

1. EUR-Lex, Directive 2004/48/EC (IPR Enforcement Directive)
2. EUR-Lex, Regulation (EU) 2016/679 (GDPR)
3. Hellenic Data Protection Authority (HDPA)
4. National Printing Office / Government Gazette (Εθνικό Τυπογραφείο)
5. Council of State (Συμβούλιο της Επικρατείας)
6. Athens Bar Association (Δικηγορικός Σύλλογος Αθηνών)