Commissioner (Cyprus) - 17.05.23: Difference between revisions

Revision as of 08:48, 16 October 2023

Comissioner - XXXXXXXXX
[[File:\|center\|250px]]
Authority:	Comissioner (Cyprus)
Jurisdiction:	Cyprus
Relevant Law:	Article 5(1)(c) GDPR Article 6 GDPR Article 29(1) of Law 125(I)/2018
Type:	Complaint
Outcome:	Upheld
Started:	17.10.2018
Decided:
Published:	17.05.2023
Fine:	3000 EUR
Parties:	Breikot Management Ltd 5 anonymous complainants
National Case Number/Name:	XXXXXXXXX
European Case Law Identifier:	XXXXXXXXX
Appeal:	Appealed - Partly Confirmed Administrative Court 962/2019
Original Language(s):	Greek
Original Source:	Commissioner (Cyprus) (in EL) (in EL)
Initial Contributor:	Evangelia Tsimpida

The DPA of Cyprus reviewed a the imposition of a fine against a local newspaper, against whom violations of Articles 5(1)(c) and 6 GDPR and Article 29(1) of Law 125(I)/2018 were found. Following an appeal by the controller to the Administrative Courts, the DPA upheld its initial fine of €3,000.

English Summary

Facts

In September and October 2018, four articles were published in the print edition of the newspaper "24h", owned by Breikot Management Ltd., (the controller). In these articles, the names and photographs of five persons, and a reference to the conviction of one of them were published. A complaint was made to the DPA by the persons concerned on 17 October 2018.

Following the complaint, the DPA issued an initial decision, in which it found violations of Articles 5(1)(c) and 6 GDPR and Article 29(1) of Law 125(I)/2018.

Concerning the violation of Article 29(1) of Law 125(I)/2018, the DPA took into account the public interest and the principle of data minimisation, and found that for the purposes of public interest the mentioning of the names of the complainants and the conviction of one of them outweighed the interests, fundamental rights and freedoms of the complainants. The publication was excessive in relation to the purpose pursued, in violation of Article 29(1) of Law 125(I)/2018. Article 85 GDPR allows for member states to legislate for the reconciliation of data protection and journalistic freedom. Law 125(I)/2018 does this through Article 29(1), which provides that:

"29(1) The processing of personal data or special categories of personal data or personal data relating to criminal convictions and offenses, which is carried out for journalistic or academic purposes or for purposes of artistic or literary expression, is permitted, provided that those purposes are proportionate to the aim pursued and respect the essence of the rights as set out in the Charter of Fundamental Rights of the European Union and in the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), which was ratified by the ratifying law on the European Convention for the Protection of Fundamental Rights and in Part II of the Constitution."

Moreover, the Cypriot DPA found that the publication of the photographs of three (3) of the five (5) complainants in three (3) of the four (4) publications exceeded the principle of data minimisation in violation of Article 5(1)(c) GDPR, and the controller had no legal basis for the processing as required by Article 6 GDPR.

As a result of the violations, The DPA imposed a fine of €3,000 on the controller. This decision was appealed by the controller before the Administrative Court on 24 January 2019. The Administrative Court upheld the DPA's Decision in regard to the infringements found, but annulled the administrative fine imposed. The Administrative Court requested that the DPA review the amount of the fine.

Holding

The DPA upheld the administrative fine of €3,000 for its violation of Articles 5(1)(c) and 6 GDPR and Article 29(1) of Law 125(I)/2018, as there was no differentiation of the burdening and reducing factors compared to the first decision to justify a reduction of the fine.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

@@ Line 67: / Line 67: @@
 }}
-The DPA of Cyprus reviews a case of imposition of an administrative fine for violation of Articles 5(1)(c) and 6 GDPR and Article 29(1) of Law 125(I)/2018 following an appeal by the data controller to the Administrative Courts.
+The DPA of Cyprus reviewed a the imposition of a fine against a local newspaper, against whom violations of [[Article 5 GDPR|Articles&nbsp;5(1)(c)]] and [[Article 6 GDPR|6 GDPR]] and Article 29(1) of Law 125(I)/2018 were found. Following an appeal by the controller to the Administrative Courts, the DPA upheld its initial fine of €3,000.
 == English Summary ==
 === Facts ===
-In September and October 2018, four articles were published in the print edition of the newspaper "24h", owned by Breikot Management Ltd, a member of the Nikodea Media Group, in which the names of five persons, photographs of three of them and a reference to the conviction of one of them were published. Following complaints by the persons concerned on 17/10/2018, whose details were published in the newspaper, the DPA taking into account factors such as the deletion of the relevant publications from the company's website, and the failure to withdraw the printed newspapers, issued a decision, which was appealed before the Administrative Court on January 24, 2019, by the Breikot Management Ltd, which constitutes the data controller. Following the Administrative Court's decision, the DPA was asked to review the case against the data controller.
+In September and October 2018, four articles were published in the print edition of the newspaper "24h", owned by Breikot Management Ltd., (the controller). In these articles, the names and photographs of five persons, and a reference to the conviction of one of them were published. A complaint was made to the DPA by the persons concerned on 17 October 2018.
+Following the complaint, the DPA issued an initial decision, in which it found violations of [[Article 5 GDPR|Articles&nbsp;5(1)(c)]] and [[Article 6 GDPR|6 GDPR]] and Article&nbsp;29(1) of Law 125(I)/2018.
+Concerning the violation of Article&nbsp;29(1) of Law 125(I)/2018, the DPA took into account the public interest and the principle of data minimisation, and found that for the purposes of public interest the mentioning of the names of the complainants and the conviction of one of them outweighed the interests, fundamental rights and freedoms of the complainants. The publication was excessive in relation to the purpose pursued, in violation of Article&nbsp;29(1) of Law 125(I)/2018. [[Article 85 GDPR]] allows for member states to legislate for the reconciliation of data protection and journalistic freedom. Law 125(I)/2018 does this through Article 29(1), which provides that:
+''"29(1) The processing of personal data or special categories of personal data or personal data relating to criminal convictions and offenses, which is carried out for journalistic or academic purposes or for purposes of artistic or literary expression, is permitted, provided that those purposes are proportionate to the aim pursued and respect the essence of the rights as set out in the Charter of Fundamental Rights of the European Union and in the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), which was ratified by the ratifying law on the European Convention for the Protection of Fundamental Rights and in Part II of the Constitution."''
+Moreover, the Cypriot DPA found that the publication of the photographs of three (3) of the five (5) complainants in three (3) of the four (4) publications exceeded the principle of data minimisation in violation of [[Article 5 GDPR|Article 5(1)(c) GDPR]], and the controller had no legal basis for the processing as required by [[Article 6 GDPR]].
+As a result of the violations, The DPA imposed a fine of €3,000 on the controller. This decision was appealed by the controller before the Administrative Court on 24 January 2019. The Administrative Court upheld the DPA's Decision in regard to the infringements found, but annulled the administrative fine imposed. The Administrative Court requested that the DPA review the amount of the fine.
 === Holding ===
-The DPA took into account the above factors, as well as the purposes of public information and the principle of data minimisation, and found that the purposes of public information and the mentioning of the names of the complainants and the conviction of one of them outweighed the interests, fundamental rights and freedoms of the complainants, but that the publication of the photographs of three (3) of the five (5) complainants in three (3) of the four (4) publications exceeded the principle of data minimisation and that, in any case, it was excessive in relation to the purpose pursued, in violation of Articles 5(1)(c) and 6 of the Regulations and Article 29(1) of Law 125(I)/2018.
+The DPA upheld the administrative fine of €3,000 for its violation of [[Article 5 GDPR|Articles 5(1)(c]]) and [[Article 6 GDPR|6 GDPR]] and Article&nbsp;29(1) of Law 125(I)/2018, as there was no differentiation of the burdening and reducing factors compared to the first decision to justify a reduction of the fine.
-Accordingly, the DPA imposed a fine of €3,000 (three thousand euros) on the data controller, namely Breikot Management Ltd, in its capacity as controller of the file, for breach of its obligation under Articles 5(1)(c) and 6 GDPR.
-the Administrative Court to which the data controller appealed upheld the Decision to the extent that it concerned the infringement, but annulled it to the extent that it concerned the amount of the administrative fine imposed.
-The DPA was asked to review the case to the extent that it concerns the amount of the administrative fine. Referring to the reasoning of two cases with similar facts and taking again into account the burdening and reducing factors taken into account in its first decision, the DPA upheld the administrative fine of €3,000 for its violation of Articles 5(1)(c) and 6 GDPR, since there was no differentiation of the burdening and reducing factors compared to the first decision to justify a reduction of the fine.
 == Comment ==