Commissioner (Cyprus) - 17.05.23: Difference between revisions
No edit summary |
m (Ar moved page Commissioner (Cyprus) - 17.05.23 (Breikot Management Ltd) to Commissioner (Cyprus) - 17.05.23) |
||
(11 intermediate revisions by 2 users not shown) | |||
Line 3: | Line 3: | ||
|Jurisdiction=Cyprus | |Jurisdiction=Cyprus | ||
|DPA-BG-Color= | |DPA-BG-Color= | ||
|DPAlogo= | |DPAlogo=LogoCY.jpg | ||
|DPA_Abbrevation= | |DPA_Abbrevation=Commissioner | ||
|DPA_With_Country= | |DPA_With_Country=Commissioner (Cyprus) | ||
|Case_Number_Name=XXXXXXXXX | |Case_Number_Name=XXXXXXXXX | ||
Line 58: | Line 58: | ||
|Party_Link_4= | |Party_Link_4= | ||
|Appeal_To_Body= | |Appeal_To_Body= | ||
|Appeal_To_Case_Number_Name= | |Appeal_To_Case_Number_Name= | ||
|Appeal_To_Status=Appealed - Partly Confirmed | |Appeal_To_Status=Appealed - Partly Confirmed | ||
|Appeal_To_Link= | |Appeal_To_Link= | ||
Line 67: | Line 67: | ||
}} | }} | ||
The DPA | The Cypriot DPA upheld a fine of €3,000 imposed against a local newspaper for the violations of [[Article 5 GDPR|Articles 5(1)(c)]] and [[Article 6 GDPR|6 GDPR]] and Article 29(1) of Law 125(I)/2018. In this case, the Cypriot DPA reviewed one of its previous decisions, following an order by the Administrative Court. | ||
== English Summary == | == English Summary == | ||
Line 76: | Line 76: | ||
Following the complaint, the DPA issued an initial decision, in which it found violations of [[Article 5 GDPR|Articles 5(1)(c)]] and [[Article 6 GDPR|6 GDPR]] and Article 29(1) of Law 125(I)/2018. | Following the complaint, the DPA issued an initial decision, in which it found violations of [[Article 5 GDPR|Articles 5(1)(c)]] and [[Article 6 GDPR|6 GDPR]] and Article 29(1) of Law 125(I)/2018. | ||
Concerning the violation of Article 29(1) of Law 125(I)/2018, the DPA took into account the public interest and the principle of data minimisation, and found that for the purposes of public interest the mentioning of the names of the complainants and the conviction of one of them outweighed the interests, fundamental rights and freedoms of the complainants. The publication was excessive in relation to the purpose pursued, in violation of Article 29(1) of Law 125(I)/2018. [[Article 85 GDPR]] | Concerning the violation of Article 29(1) of Law 125(I)/2018, the DPA took into account the public interest and the principle of data minimisation, and found that for the purposes of public interest the mentioning of the names of the complainants and the conviction of one of them outweighed the interests, fundamental rights and freedoms of the complainants. The publication was excessive in relation to the purpose pursued, in violation of Article 29(1) of Law 125(I)/2018. [[Article 85 GDPR]] mandates member states to legislate for the reconciliation of data protection and journalistic freedom. Law 125(I)/2018 does this through Article 29(1), which provides that: | ||
''"29(1) The processing of personal data or special categories of personal data or personal data relating to criminal convictions and offenses, which is carried out for journalistic or academic purposes or for purposes of artistic or literary expression, is permitted, provided that those purposes are proportionate to the aim pursued and respect the essence of the rights as set out in the Charter of Fundamental Rights of the European Union and in the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), which was ratified by the ratifying law on the European Convention for the Protection of Fundamental Rights and in Part II of the Constitution."'' | ''"29(1) The processing of personal data or special categories of personal data or personal data relating to criminal convictions and offenses, which is carried out for journalistic or academic purposes or for purposes of artistic or literary expression, is permitted, provided that those purposes are proportionate to the aim pursued and respect the essence of the rights as set out in the Charter of Fundamental Rights of the European Union and in the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), which was ratified by the ratifying law on the European Convention for the Protection of Fundamental Rights and in Part II of the Constitution."'' | ||
Line 85: | Line 85: | ||
=== Holding === | === Holding === | ||
The DPA upheld the administrative fine of €3,000 for its violation of [[Article 5 GDPR|Articles 5(1)(c]]) and [[Article 6 GDPR|6 GDPR]] and Article 29(1) of Law 125(I)/2018, as there was no differentiation of the burdening and reducing factors compared to the first decision to justify a reduction of the fine. | The DPA upheld the administrative fine of €3,000 for its violation of [[Article 5 GDPR#1c|Articles 5(1)(c]]) and [[Article 6 GDPR|6 GDPR]] and Article 29(1) of Law 125(I)/2018, as there was no differentiation of the burdening and reducing factors compared to the first decision to justify a reduction of the fine. | ||
== Comment == | == Comment == | ||
https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/2B53605103DCE4A4C225826300362211/$file/Law%20125(I)%20of%202018%20ENG%20final.pdf<nowiki/>Link to Law 125(I)/2018. | |||
== Further Resources == | == Further Resources == | ||
''Share blogs or news articles here!'' | ''Share blogs or news articles here!'' | ||
Line 97: | Line 96: | ||
<pre> | <pre> | ||
No. File No: XXXXXXXXXXXXX | |||
BY ELECTRONIC MAIL | |||
XXXXXXXXXXXXX@XXXXXXXXXX | |||
Breikot Management Ltd. | |||
Member of Nikodea Media Group | |||
67 Vassilios Voulgarokctonou Street, | |||
1010, Nicosia | |||
(Attention XXXXXXXXXXXXXXX, | |||
Director of Breikot Management Ltd) | |||
May 17, 2023 | |||
Decision to review in relation to the amount of the fine imposed | |||
On the basis of the duties and powers conferred on me by Article 57(1)(f) of the | |||
Regulation (EU) 2016/679 on the protection of natural persons with regard to the | |||
processing of personal data and on the free movement of personal data | |||
of such data, I have examined five (5) separate complaints (complaints) that | |||
submitted to my Office on October 17, 2018, by the law firm | |||
Athos Demetriou Associates LLC, on behalf of their clients XXXXXXXXXXXXX (at | |||
"Complainants") against Breikot Management Ltd, a member of the | |||
Nikodea Media Group, (hereinafter the Complainant), regarding four (4) | |||
publications, concerning the Complainants in the print newspaper 24h | |||
and were signed XXXXXXXX. | |||
Based on the investigation, I found a violation of the Rules by the Respondent the | |||
Complaint and I issued a decision on April 12, 2019, based on the following | |||
briefly stated facts set forth below. | |||
2. Brief facts of the complaint | |||
2.1 On October 17, 2018 a complaint was submitted by the complainants to the Office | |||
(complaint), concerning the publication of (a) the full name of the complainant | |||
of all the complainants, b) photographs of three of them, and c) a report | |||
(c) a reference to the conviction of one of them in articles published in a publication owned by the | |||
Respondent's complaint. Having considered the facts of the case, I have, as follows | |||
I have proceeded to weigh the right to freedom of expression and | |||
information, with the right to privacy and family life and | |||
the protection of personal data. Taking into account both the | |||
Principle of Data Minimisation, I have adopted a Decision of 14 December 2004. 12 April, | |||
2019. | |||
The conclusion of my decision was as follows: | |||
2 | |||
"...The four (4) publications in the print edition of the newspaper "24h" the | |||
which is owned by the Respondent the Complainant, were made for information purposes | |||
the public and the mention of the name of the complainants and the | |||
of one of them, outweighs the interests, fundamental | |||
rights and freedoms of the complainants. Therefore, I find that, I do not | |||
there has been any violation of the provisions of the Rules by the | |||
Respondent's complaint, for the publication of the name of the | |||
name of the complainants in the publications at issue. | |||
However, the publication of the photographs of three (3) of the five (5) | |||
in three (3) of the four (4) publications, namely the | |||
28-30/9/2018, 5-7/10/2018 and 12-14/10/2018, I consider that it has | |||
exceeded the principle of minimization of data and that in any | |||
in any case, it is excessive in relation to the objective pursued | |||
in breach of Articles 5(1)(c) and 6 of the Regulation and Article | |||
29(1) of Law 125(I)/2018, given that, the news could | |||
published without their photographs, since the subject of interest from | |||
journalistic interest is the fact that the architectural firm of | |||
family of the complainants, continues to undertake public works | |||
while one of them has been convicted of a fatal industrial accident. Η | |||
the publication of the photographs is not in the best interests of the | |||
of informing public opinion and is not considered necessary in the context of | |||
the principle of minimisation, nor does it confer any additional | |||
value to the public's right to information. | |||
2.2 The complaint was submitted to my Office on 17/10/2018, i.e. approximately one month | |||
after the Respondent first published the complaint. The Respondent the Complaint, in no | |||
stage of the process, did not mention the time when she deleted the publications | |||
from her website. All she did mention was in her letter dated. 12/3/2019, | |||
"...that as soon as we were informed of their complaint all articles were "taken down" without the | |||
your suggestion..." | |||
2.3 My Office Officer, on 29/10/2018, informed the Respondent in writing | |||
the grievance, of the grievance submitted. Given that the Respondent's | |||
Complaint, states that all articles were "taken down" once they were updated without the | |||
suggestion of my Office, it appears that the four (4) publications were deleted | |||
from the website on or about 10/29/2018, i.e., approximately one (1) plus month | |||
after the first publication, which was 28-30/9/2018. However, the printed versions of the | |||
24h newspaper, which also published the photos of the three (3) | |||
complainants, were never withdrawn and still exist to this day. | |||
2.4 The number of readers, i.e. the extent cannot be calculated since the | |||
printed newspaper can be read by countless persons. If the circulation of the | |||
of a newspaper is X hundreds/thousands, this does not mean that it is not read by X+1 | |||
hundreds/thousands. Let alone when the newspaper can be found in | |||
cafes and entertainment venues where a lot of people gather every day. | |||
2.5 Nor can the number of people who read the | |||
articles in the electronic version of 24h, the period of one | |||
month or so that they were posted. | |||
3 | |||
2.6 Weighing up all the mitigating and aggravating factors, I imposed | |||
on the person legally responsible for the Respondent's actions the complaint, namely Breikot | |||
Management Ltd, in its capacity as controller of the file, a monetary | |||
penalty of €3,000 (three thousand euros) for breach of his obligation under the | |||
Articles 5(1)(c) and 6 of the Regulation. | |||
2.6 Against the decision dated. 12 April 2009, the Respondent's complaint | |||
filed before the Administrative Court on January 24, 2019 the application no. | |||
No. XXXXXX Complaint. | |||
2.7 On December 16, 2022, the Administrative Tribunal issued a decision on the | |||
Complaint No. 962/2019, upholding the Decision of my Office | |||
Date. April 12, 2019, to the extent of the violation, but | |||
annulling it to the extent that it relates to the amount of the administrative fine | |||
imposed. | |||
The Court inter alia stated the following: | |||
"I find the decision of the defendant reasonable in its finding of | |||
I do not consider it to be justified in relation to the finding of infringement, but I do consider it to be justified in relation to the administrative fine | |||
the administrative fine imposed and, in particular, the amount of that fine. That is because of the same | |||
the text of the decision, while the reasons supporting the extremely | |||
short duration of the infringement, it does not appear that account was taken of the | |||
the amount of the fine without, in fact, adequately recording the degree of damage | |||
which the three persons may have suffered'. | |||
2.8 In the context of the above, partially annulled judgment of the Court of Justice and in | |||
in conjunction with the provisions of Article 57 of the General Principles of Administrative Law | |||
Law of 1999 (158(I)/1999), but also the relevant recommendation received from the Office | |||
the Office of the Attorney General, it has been decided to review the case against | |||
Respondent's complaint, only to the extent that it relates to the amount of the administrative | |||
fine imposed. | |||
3. Legal aspect | |||
3.1 In accordance with Article 57(1)(f) of Regulation (EU) 2016/679, the Office of | |||
Office of the Data Protection Commissioner shall, as a matter of duty, handle | |||
complaints submitted by data subjects, while according to the | |||
Article 57(1)(a) it monitors and enforces the application of the Regulation. | |||
3.1.1 Article 57 of the General Principles of Administrative Law Act 1999 | |||
(158(I)/1999), provides that: | |||
57. 57. | |||
The court shall be obliged to restore the things to the position in which they were before | |||
before the issuance of the annulled act. | |||
3.1.2 Article 47 of the General Principles of Administrative Law Act 1999 | |||
(158(I)/1999), provides that: | |||
4 | |||
47. The elements which the administration must take into account in the exercise of its | |||
The factors to be taken into account by the administration in exercising its discretionary power must be lawful and relevant to the objective pursued. | |||
purpose intended by the law. | |||
3.2 In the cases of Vnukovo Airlines (V.A.) and Others v. v. Vnukovo Airlines (V.A.) et al. Attorney General (2001) A.A.D. | |||
969 and Kyriakides v. Republic (2013) 3 A.A.D. 629, it was held that the administration | |||
the administration is obliged to restore the situation to the state of affairs that existed before | |||
the annulment, to arrange for the procedure for the review of the disputed | |||
administrative matter and decide in a lawful manner and in accordance with | |||
the findings of the administrative court. In the review, the administrative | |||
procedure shall be resumed from the point at which it was found to be unlawful. | |||
3.3 More specifically, in Kyriakidis n. Republic (2013) 3 A.A.D. 629 | |||
it was mentioned in this regard: | |||
"... we consider that in every case of an annulment decision it is a duty | |||
In each case, in all cases, the Administration has the duty to review - or, where grounds are found, to review - the decision of the Court of Appeal. | |||
(see, in any case, where there is reason to do so, a review or, where there is reason to do so, a re-investigation (cf. Naziris v. Naziris, n. 1. R.I.K. (2007) 3 A.A.D. 38) - for | |||
to restore the damaged legality, as established in the | |||
the reviewing annulment decision. This is, in our view, a duty | |||
which is emphasized by consistent and clear case law over time (see Englezaki et al. | |||
Attorney General (1992) 1(A) A.A.D. 697, which refers to | |||
earlier case law on the subject, as well as Attorney General's v. | |||
Holy Archdiocese of Cyprus (1999) 1(A) A.A.D. 342), which case law | |||
does not seem to recognise that it gives way even in cases where it does not | |||
(in natura) restoration of things to their former state can be made | |||
their original state..." | |||
3.4 It should also be noted that under Article 58(2), the Commissioner has the | |||
following remedial powers: | |||
"(a) to issue warnings to the controller or processor | |||
processor that intended processing operations are likely to | |||
the controller or the data controller or the processor may be likely to infringe provisions of this Regulation, | |||
(b) to admonish the controller or the processor | |||
the controller or the processor where processing operations have infringed provisions of this Regulation | |||
Regulation, | |||
(c) to instruct the controller or the processor | |||
to comply with requests by the data subject to the data controller or processor to comply with the data subject's requests for the processing of data | |||
exercise his or her rights in accordance with this Regulation, | |||
(d) to instruct the controller or the processor to comply with the rights of the data subject in accordance with the data subject's rights | |||
to make the processing operations comply with the provisions of this Regulation | |||
the processing operations in accordance with the provisions of this Regulation, if necessary, in a specified manner and within a specified time limit | |||
time limit, | |||
(e) instruct the controller to notify the breach | |||
personal data to the data subject, | |||
(f) to impose a temporary or definitive restriction, including the imposition of a temporary or definitive restriction | |||
impose a temporary or temporary restriction, including prohibition of processing, | |||
(g) to order the rectification or erasure of personal data; or | |||
order the erasure or deletion of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and order the restriction of processing pursuant to Articles 16, 17 and 18 | |||
the notification of such actions to recipients to whom the data are disclosed | |||
personal data have been disclosed pursuant to Article 17(2) | |||
and Article 19, | |||
5 | |||
(h) withdraw certification or order the certification body to | |||
withdraw a certificate issued in accordance with Articles 42 and 43 or order the certification body to withdraw a certificate issued in accordance with Articles 42 and 43 | |||
the certification body not to issue a certification where the requirements | |||
certification requirements are not or are no longer fulfilled, | |||
(i) impose an administrative fine pursuant to Article 83, in addition to or instead of | |||
the measures referred to in this paragraph, depending on the | |||
in addition to or in addition to the measures referred to in or in addition to the above measures, depending on the circumstances of each individual case, | |||
(j) to order the suspension of the release of data to a recipient in a third country | |||
a third country or an international organisation. | |||
3.5 Article 83 of the Regulation, which concerns the general conditions of enforcement | |||
administrative fines, inter alia, provides for the following: | |||
"1. Each supervisory authority shall ensure that the imposition of administrative fines | |||
in accordance with this Article in respect of infringements of this Regulation | |||
referred to in paragraphs 4, 5 and 6 are, for each individual | |||
effective, proportionate and dissuasive for each individual case. | |||
2. Administrative fines shall, depending on the circumstances of each individual case, be | |||
circumstances of each individual case, shall be imposed in addition to or instead of the measures referred to | |||
points (a) to (h) of Article 58(2) and Article 58(2)(a) to (h) | |||
paragraph 2(j). When deciding on the imposition of | |||
administrative fine, as well as on the amount of the administrative | |||
fine for each individual case, due account shall be taken of | |||
the following: | |||
(a) the nature, gravity and duration of the infringement, taking into account the | |||
the nature, extent or purpose of the processing in question, and the number of processing operations, the gravity and duration of the infringement | |||
data subjects affected by the breach and the degree of damage | |||
they have suffered, | |||
(b) the fraudulent or negligent nature of the breach, | |||
(c) any actions taken by the controller | |||
or the processor to mitigate the damage suffered by the data subjects | |||
data subjects, | |||
(d) the degree of liability of the controller or processor | |||
the degree of responsibility of the controller or processor, taking into account the technical and organisational measures taken | |||
the technical and technical measures they apply pursuant to Articles 25 and 32, | |||
(e) any relevant previous infringements by the controller or the data controller; or | |||
the processor, | |||
(f) the degree of cooperation with the supervisory authority in remedying the infringement | |||
the degree of cooperation with the supervisory authority to remedy the infringement and mitigate its possible adverse effects, | |||
(g) the categories of personal data affected by the | |||
the infringement, | |||
(h) the manner in which the supervisory authority became aware of the breach, | |||
in particular whether and to what extent the controller or processor | |||
the controller or processor notified the breach, | |||
(i) where the measures were ordered beforehand, where the measures were | |||
referred to in Article 58(2) against the controller involved | |||
the controller or processor in relation to the same subject matter, | |||
compliance with those measures, | |||
(j) compliance with approved codes of conduct in accordance with Article 40; or | |||
approved certification mechanisms in accordance with Article 42; and | |||
6 | |||
(k) any other aggravating or mitigating circumstance arising from | |||
circumstances of the particular case, such as financial benefits | |||
gained or losses avoided, directly or indirectly, by the | |||
infringement. | |||
3. Where the controller or processor, for the purpose of the processing, directly or indirectly. | |||
the same or related processing operations, infringes several provisions | |||
of this Regulation, the total amount of the administrative fine shall not | |||
exceed the amount specified for the most serious infringement. | |||
4. Infringements of the following provisions shall, in accordance with the | |||
paragraph 2, administrative fines of up to EUR 10 000 000 or, in the case of | |||
in the case of undertakings, up to 2 % of the total worldwide annual turnover | |||
of the preceding financial year, whichever is the higher: | |||
(a) the obligations of the controller and the processor | |||
(a) the obligations of the controller and the processor in accordance with Articles 8, 11, 25 to 39, 42 and 43, | |||
(b) the obligations of the certification body in accordance with Articles 42 and 43, | |||
(c) the obligations of the monitoring body in accordance with Article 41 | |||
paragraph 4. | |||
5. Infringements of the following provisions shall, in accordance with | |||
paragraph 2, administrative fines of up to EUR 20 000 000 or, in the case of | |||
in the case of undertakings, up to 4 % of the total worldwide annual turnover | |||
turnover in the preceding financial year, whichever is the greater | |||
whichever is the higher: | |||
(a) the basic principles for processing, including the conditions that | |||
the basic principles for processing, including the conditions applicable to authorisation, in accordance with Articles 5, 6, 7 and 9, | |||
(b) the rights of data subjects in accordance with Articles 12 to 12 | |||
22, | |||
(c) the transfer of personal data to a recipient in a third country; or | |||
an international organisation in accordance with Articles 44 to 49; (d) any | |||
obligations under the law of the Member State which are established | |||
(e) failure to comply with an order or interim measure | |||
failure to comply with a temporary or definitive restriction of processing or suspension of movement | |||
data suspension or restriction of processing or suspension of the processing of data imposed by the supervisory authority pursuant to Article 58 | |||
(2) or failure to provide access in breach of Article 58(2) | |||
paragraph 1." | |||
3.5.1 Recital (148) of the Regulation further clarifies that: | |||
"(148) In order to strengthen the enforcement of the rules of this | |||
Regulation, sanctions, including administrative fines, shall | |||
should be imposed for any infringement of this Regulation, | |||
In addition to or instead of appropriate measures imposed by the supervisory authority | |||
authority in accordance with this Regulation. In the case of a minor infringement | |||
infringement of minor importance or where the fine likely to be imposed would be disproportionate to the | |||
a disproportionate burden on a natural person, a reprimand could be imposed instead of | |||
instead of a fine. Due account should, however, be taken of the nature, the | |||
seriousness and duration of the infringement, the intentional nature of the infringement | |||
infringement, the actions taken to mitigate the damage, the degree of | |||
of liability or any other relevant previous infringements, the manner in which | |||
7 | |||
the manner in which the supervisory authority became aware of the breach, compliance with the | |||
compliance with measures against the controller or processor, the | |||
compliance with a code of conduct and any other aggravating or mitigating circumstances. Η | |||
the imposition of sanctions, including administrative fines, should | |||
be subject to appropriate procedural safeguards in accordance with the general principles | |||
of Union law and the Charter, including the effective | |||
judicial protection and due process." | |||
3.5.2 In the introductory note to Guideline 4/2022 on the | |||
calculation of administrative sanctions on the basis of the GDPR 2016/679, which it issued | |||
the European Data Protection Board (EDPS) on 12 May, 2022 (the | |||
which are currently under public consultation), the following are noted: | |||
"The calculation of the amount of the fine is at the discretion of the | |||
the supervisory authority, subject to the rules provided for in the GDPR. In that | |||
context, the GDPR requires that the amount of the fine shall in each individual | |||
case be effective, proportionate and dissuasive (Article 83(1) GDPR). Moreover, | |||
when setting the amount of the fine, supervisory authorities shall give due regard | |||
to a list of circumstances that refer to features of the infringement (its seriousness) | |||
or of the character of the perpetrator (Article 83(2) GDPR). Lastly, the amount of | |||
the fine shall not exceed the maximum amounts provided for in Articles 83(4) (5) | |||
and (6) GDPR. The quantification of the amount of the fine is therefore based on a | |||
specific evaluation carried out in each case, within the parameters provided for by | |||
the GDPR." | |||
4. Screenshot | |||
4.1 Complying, in accordance with the provisions of Law 158(I)/1999, the directions of the Court, | |||
the relevant case law (see e.g. Kyriakidis v. Republic, above) and recommendation | |||
of the Legal Service, my Office had a duty to review the present | |||
complaint from the point raised by the Court in its annulment judgment and | |||
namely to the extent that it relates to the amount of the administrative fine which | |||
imposed. | |||
4.2 The facts of the complaint do not differ from the original decision | |||
date. 12 April 2009 and are adopted in their entirety as stated, and in any event, they are adopted in full. | |||
in any event, they were upheld by the decision of the Administrative Court, dated | |||
16/12/2022, in Appeal No. 962/2019. | |||
4.3 To note that, the Supreme Court, upheld the decision of my Office, | |||
In Appeal No. 32/2013, dated 16 December 2013. 1/3/2019, between the Cyprus Republic of Cyprus and the Republic of Cyprus. | |||
Republic of Cyprus, through the Commissioner for Personal Data Protection and | |||
Publishing House Dias Ltd, which also concerned a breach of the Principle of | |||
Proportionality Principle and I had imposed a fine of €3.000. This amount had been fixed, by | |||
maximum amount imposed at that time was €30,000. After the | |||
implementation of the GDPR 2016/679 on May 25, 2018, for the same violation (principle of | |||
minimisation principle, as in the present case) a maximum administrative | |||
sanction of €20,000,000. | |||
4.5 In addition, on 16/1/2023, I issued a decision, following a review | |||
complaint, against Arktinos Publications Ltd and imposed an administrative penalty of | |||
8 | |||
fine of €7,000, for its violation of Articles 5(1)(c) and | |||
6(1)(f) of the GDPR, by publishing more personal data | |||
publication of more personal data than was necessary in order to serve its right | |||
right to information of the public. | |||
5. Ending | |||
5.1 Taking into account all of the above elements as set out above, and based on the | |||
the powers conferred on me by Articles 58 and 83 of Regulation (EU) | |||
2016/679, Article 24(b) of Law 125(I)/2018, and given that there was a breach | |||
of the provisions of the Regulation, as upheld by the Administrative Court, | |||
I will proceed to impose a penalty. | |||
5.2 Under the provisions of Article 83 of the Rules, to the extent that | |||
applicable in this case, I take into account the following | |||
mitigating (a)-(d) and aggravating (e)-(i) factors, on the basis of the facts | |||
as they are before me today: | |||
(a) the Respondent's position that through negligence and not on purpose, it published | |||
in the newspaper the photographs of the three (3) complainants, | |||
(b) the fact that the Respondent the Complainant, proceeded to delete the said | |||
four (4) articles from the electronic version of the 24h newspaper, as soon as | |||
became aware of the complaint, i.e. by the letter sent by the | |||
my Office on 29/10/2018, and before receiving any written objection from my Office, | |||
(c) the fact that the Respondent, in the course of the investigation, cooperated | |||
with my Office to remedy the violation and mitigate the | |||
its potential adverse effects; and | |||
(d) the fact that this is the first complaint submitted to my Office against | |||
the Respondent the complaint, | |||
(e) the nature of the violation, which affects the professional life of | |||
complainant, although the European Court of Human Rights has | |||
held in relation to the provision of Article 8 ECHR that the protection of "private | |||
life', which is founded on that article, does not exclude the professional life of | |||
and is not limited to life within the place of residence, | |||
(f) the extent of the infringement: the four (4) publications were | |||
(4) four of the four articles were posted on the Internet for at least one (1) month prior to their deletion, with | |||
an unspecified number of readers, the print editions of the 24h newspaper did not | |||
have not been withdrawn to date and the number of readers remains unknown, | |||
(h) the number of data subjects affected by the breach, directly | |||
the three (3) complainants whose photographs were published are directly affected, | |||
indirectly the family environment of all five (5) complainants, | |||
(i) the categories of personal data affected by the breach: it concerns simply | |||
data, namely the photographs of three (3) of the five (5) complainants. | |||
5.3 In my previous Decision dated April 12, 2019, I imposed on | |||
Respondent the Complainant an administrative fine of €3,000, for on her behalf violation | |||
of her obligations under Articles 5(1)(c) and 6 of the GDPR, having taken into account | |||
various aggravating and mitigating factors, both positive and negative | |||
respectively and with varying degrees of severity, depending on the gravity of the | |||
of the severity of the mitigating or aggravating factor in each case. | |||
9 | |||
5.4 I also note that in Revision Appeal No. 32/2013, in which | |||
upheld a Decision of my Office, also upheld the administrative sanction | |||
imposed on the appellant in the amount of €3,000. This amount had been fixed, by | |||
maximum amount imposed at that time was €30,000. Following the | |||
application of the GDPR 2016/679 on 25 May 2018, for the same violation (principle of | |||
minimisation principle, as in the present case) a maximum administrative | |||
sanction of €20,000,000. | |||
5.5 Taking into account the aggravating and mitigating factors that | |||
set out in paragraph 5.2 of this Decision, as they have developed during the | |||
the review of the case, as well as the fact that photographs were posted | |||
of three (3) of the five (5) Complainants, I hereby impose the Complaint on the Respondent, | |||
an administrative fine of €3,000, for her violation of Articles | |||
5(1)(c) and 6 of the GDPR. | |||
5.6 There has not been any reduction of the administrative fine and no variation of the | |||
from the first Decision of my Office, since there was no | |||
variation of the aggravating and mitigating factors which were taken | |||
taken into account during the review. The infringement found and confirmed by the | |||
Administrative Court, related specifically to the publication of the photographs, | |||
of three (3) of the five (5) complainants. The report of the two cases, with | |||
similar incidents, in which fines were imposed and in particular this | |||
of the Review Appeal, I consider that it strengthens and justifies the amount of the fine | |||
penalty. | |||
Irene Loizidou Nicolaidou | |||
Data Protection Commissioner | |||
Personal Data Protection Commissioner | |||
</pre> | </pre> |
Latest revision as of 16:50, 6 December 2023
Commissioner - XXXXXXXXX | |
---|---|
Authority: | Commissioner (Cyprus) |
Jurisdiction: | Cyprus |
Relevant Law: | Article 5(1)(c) GDPR Article 6 GDPR Article 29(1) of Law 125(I)/2018 |
Type: | Complaint |
Outcome: | Upheld |
Started: | 17.10.2018 |
Decided: | |
Published: | 17.05.2023 |
Fine: | 3000 EUR |
Parties: | Breikot Management Ltd 5 anonymous complainants |
National Case Number/Name: | XXXXXXXXX |
European Case Law Identifier: | XXXXXXXXX |
Appeal: | Appealed - Partly Confirmed |
Original Language(s): | Greek |
Original Source: | Commissioner (Cyprus) (in EL) (in EL) |
Initial Contributor: | Evangelia Tsimpida |
The Cypriot DPA upheld a fine of €3,000 imposed against a local newspaper for the violations of Articles 5(1)(c) and 6 GDPR and Article 29(1) of Law 125(I)/2018. In this case, the Cypriot DPA reviewed one of its previous decisions, following an order by the Administrative Court.
English Summary
Facts
In September and October 2018, four articles were published in the print edition of the newspaper "24h", owned by Breikot Management Ltd., (the controller). In these articles, the names and photographs of five persons, and a reference to the conviction of one of them were published. A complaint was made to the DPA by the persons concerned on 17 October 2018.
Following the complaint, the DPA issued an initial decision, in which it found violations of Articles 5(1)(c) and 6 GDPR and Article 29(1) of Law 125(I)/2018.
Concerning the violation of Article 29(1) of Law 125(I)/2018, the DPA took into account the public interest and the principle of data minimisation, and found that for the purposes of public interest the mentioning of the names of the complainants and the conviction of one of them outweighed the interests, fundamental rights and freedoms of the complainants. The publication was excessive in relation to the purpose pursued, in violation of Article 29(1) of Law 125(I)/2018. Article 85 GDPR mandates member states to legislate for the reconciliation of data protection and journalistic freedom. Law 125(I)/2018 does this through Article 29(1), which provides that:
"29(1) The processing of personal data or special categories of personal data or personal data relating to criminal convictions and offenses, which is carried out for journalistic or academic purposes or for purposes of artistic or literary expression, is permitted, provided that those purposes are proportionate to the aim pursued and respect the essence of the rights as set out in the Charter of Fundamental Rights of the European Union and in the European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), which was ratified by the ratifying law on the European Convention for the Protection of Fundamental Rights and in Part II of the Constitution."
Moreover, the Cypriot DPA found that the publication of the photographs of three (3) of the five (5) complainants in three (3) of the four (4) publications exceeded the principle of data minimisation in violation of Article 5(1)(c) GDPR, and the controller had no legal basis for the processing as required by Article 6 GDPR.
As a result of the violations, The DPA imposed a fine of €3,000 on the controller. This decision was appealed by the controller before the Administrative Court on 24 January 2019. The Administrative Court upheld the DPA's Decision in regard to the infringements found, but annulled the administrative fine imposed. The Administrative Court requested that the DPA review the amount of the fine.
Holding
The DPA upheld the administrative fine of €3,000 for its violation of Articles 5(1)(c) and 6 GDPR and Article 29(1) of Law 125(I)/2018, as there was no differentiation of the burdening and reducing factors compared to the first decision to justify a reduction of the fine.
Comment
https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/2B53605103DCE4A4C225826300362211/$file/Law%20125(I)%20of%202018%20ENG%20final.pdfLink to Law 125(I)/2018.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
No. File No: XXXXXXXXXXXXX BY ELECTRONIC MAIL XXXXXXXXXXXXX@XXXXXXXXXX Breikot Management Ltd. Member of Nikodea Media Group 67 Vassilios Voulgarokctonou Street, 1010, Nicosia (Attention XXXXXXXXXXXXXXX, Director of Breikot Management Ltd) May 17, 2023 Decision to review in relation to the amount of the fine imposed On the basis of the duties and powers conferred on me by Article 57(1)(f) of the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of personal data of such data, I have examined five (5) separate complaints (complaints) that submitted to my Office on October 17, 2018, by the law firm Athos Demetriou Associates LLC, on behalf of their clients XXXXXXXXXXXXX (at "Complainants") against Breikot Management Ltd, a member of the Nikodea Media Group, (hereinafter the Complainant), regarding four (4) publications, concerning the Complainants in the print newspaper 24h and were signed XXXXXXXX. Based on the investigation, I found a violation of the Rules by the Respondent the Complaint and I issued a decision on April 12, 2019, based on the following briefly stated facts set forth below. 2. Brief facts of the complaint 2.1 On October 17, 2018 a complaint was submitted by the complainants to the Office (complaint), concerning the publication of (a) the full name of the complainant of all the complainants, b) photographs of three of them, and c) a report (c) a reference to the conviction of one of them in articles published in a publication owned by the Respondent's complaint. Having considered the facts of the case, I have, as follows I have proceeded to weigh the right to freedom of expression and information, with the right to privacy and family life and the protection of personal data. Taking into account both the Principle of Data Minimisation, I have adopted a Decision of 14 December 2004. 12 April, 2019. The conclusion of my decision was as follows: 2 "...The four (4) publications in the print edition of the newspaper "24h" the which is owned by the Respondent the Complainant, were made for information purposes the public and the mention of the name of the complainants and the of one of them, outweighs the interests, fundamental rights and freedoms of the complainants. Therefore, I find that, I do not there has been any violation of the provisions of the Rules by the Respondent's complaint, for the publication of the name of the name of the complainants in the publications at issue. However, the publication of the photographs of three (3) of the five (5) in three (3) of the four (4) publications, namely the 28-30/9/2018, 5-7/10/2018 and 12-14/10/2018, I consider that it has exceeded the principle of minimization of data and that in any in any case, it is excessive in relation to the objective pursued in breach of Articles 5(1)(c) and 6 of the Regulation and Article 29(1) of Law 125(I)/2018, given that, the news could published without their photographs, since the subject of interest from journalistic interest is the fact that the architectural firm of family of the complainants, continues to undertake public works while one of them has been convicted of a fatal industrial accident. Η the publication of the photographs is not in the best interests of the of informing public opinion and is not considered necessary in the context of the principle of minimisation, nor does it confer any additional value to the public's right to information. 2.2 The complaint was submitted to my Office on 17/10/2018, i.e. approximately one month after the Respondent first published the complaint. The Respondent the Complaint, in no stage of the process, did not mention the time when she deleted the publications from her website. All she did mention was in her letter dated. 12/3/2019, "...that as soon as we were informed of their complaint all articles were "taken down" without the your suggestion..." 2.3 My Office Officer, on 29/10/2018, informed the Respondent in writing the grievance, of the grievance submitted. Given that the Respondent's Complaint, states that all articles were "taken down" once they were updated without the suggestion of my Office, it appears that the four (4) publications were deleted from the website on or about 10/29/2018, i.e., approximately one (1) plus month after the first publication, which was 28-30/9/2018. However, the printed versions of the 24h newspaper, which also published the photos of the three (3) complainants, were never withdrawn and still exist to this day. 2.4 The number of readers, i.e. the extent cannot be calculated since the printed newspaper can be read by countless persons. If the circulation of the of a newspaper is X hundreds/thousands, this does not mean that it is not read by X+1 hundreds/thousands. Let alone when the newspaper can be found in cafes and entertainment venues where a lot of people gather every day. 2.5 Nor can the number of people who read the articles in the electronic version of 24h, the period of one month or so that they were posted. 3 2.6 Weighing up all the mitigating and aggravating factors, I imposed on the person legally responsible for the Respondent's actions the complaint, namely Breikot Management Ltd, in its capacity as controller of the file, a monetary penalty of €3,000 (three thousand euros) for breach of his obligation under the Articles 5(1)(c) and 6 of the Regulation. 2.6 Against the decision dated. 12 April 2009, the Respondent's complaint filed before the Administrative Court on January 24, 2019 the application no. No. XXXXXX Complaint. 2.7 On December 16, 2022, the Administrative Tribunal issued a decision on the Complaint No. 962/2019, upholding the Decision of my Office Date. April 12, 2019, to the extent of the violation, but annulling it to the extent that it relates to the amount of the administrative fine imposed. The Court inter alia stated the following: "I find the decision of the defendant reasonable in its finding of I do not consider it to be justified in relation to the finding of infringement, but I do consider it to be justified in relation to the administrative fine the administrative fine imposed and, in particular, the amount of that fine. That is because of the same the text of the decision, while the reasons supporting the extremely short duration of the infringement, it does not appear that account was taken of the the amount of the fine without, in fact, adequately recording the degree of damage which the three persons may have suffered'. 2.8 In the context of the above, partially annulled judgment of the Court of Justice and in in conjunction with the provisions of Article 57 of the General Principles of Administrative Law Law of 1999 (158(I)/1999), but also the relevant recommendation received from the Office the Office of the Attorney General, it has been decided to review the case against Respondent's complaint, only to the extent that it relates to the amount of the administrative fine imposed. 3. Legal aspect 3.1 In accordance with Article 57(1)(f) of Regulation (EU) 2016/679, the Office of Office of the Data Protection Commissioner shall, as a matter of duty, handle complaints submitted by data subjects, while according to the Article 57(1)(a) it monitors and enforces the application of the Regulation. 3.1.1 Article 57 of the General Principles of Administrative Law Act 1999 (158(I)/1999), provides that: 57. 57. The court shall be obliged to restore the things to the position in which they were before before the issuance of the annulled act. 3.1.2 Article 47 of the General Principles of Administrative Law Act 1999 (158(I)/1999), provides that: 4 47. The elements which the administration must take into account in the exercise of its The factors to be taken into account by the administration in exercising its discretionary power must be lawful and relevant to the objective pursued. purpose intended by the law. 3.2 In the cases of Vnukovo Airlines (V.A.) and Others v. v. Vnukovo Airlines (V.A.) et al. Attorney General (2001) A.A.D. 969 and Kyriakides v. Republic (2013) 3 A.A.D. 629, it was held that the administration the administration is obliged to restore the situation to the state of affairs that existed before the annulment, to arrange for the procedure for the review of the disputed administrative matter and decide in a lawful manner and in accordance with the findings of the administrative court. In the review, the administrative procedure shall be resumed from the point at which it was found to be unlawful. 3.3 More specifically, in Kyriakidis n. Republic (2013) 3 A.A.D. 629 it was mentioned in this regard: "... we consider that in every case of an annulment decision it is a duty In each case, in all cases, the Administration has the duty to review - or, where grounds are found, to review - the decision of the Court of Appeal. (see, in any case, where there is reason to do so, a review or, where there is reason to do so, a re-investigation (cf. Naziris v. Naziris, n. 1. R.I.K. (2007) 3 A.A.D. 38) - for to restore the damaged legality, as established in the the reviewing annulment decision. This is, in our view, a duty which is emphasized by consistent and clear case law over time (see Englezaki et al. Attorney General (1992) 1(A) A.A.D. 697, which refers to earlier case law on the subject, as well as Attorney General's v. Holy Archdiocese of Cyprus (1999) 1(A) A.A.D. 342), which case law does not seem to recognise that it gives way even in cases where it does not (in natura) restoration of things to their former state can be made their original state..." 3.4 It should also be noted that under Article 58(2), the Commissioner has the following remedial powers: "(a) to issue warnings to the controller or processor processor that intended processing operations are likely to the controller or the data controller or the processor may be likely to infringe provisions of this Regulation, (b) to admonish the controller or the processor the controller or the processor where processing operations have infringed provisions of this Regulation Regulation, (c) to instruct the controller or the processor to comply with requests by the data subject to the data controller or processor to comply with the data subject's requests for the processing of data exercise his or her rights in accordance with this Regulation, (d) to instruct the controller or the processor to comply with the rights of the data subject in accordance with the data subject's rights to make the processing operations comply with the provisions of this Regulation the processing operations in accordance with the provisions of this Regulation, if necessary, in a specified manner and within a specified time limit time limit, (e) instruct the controller to notify the breach personal data to the data subject, (f) to impose a temporary or definitive restriction, including the imposition of a temporary or definitive restriction impose a temporary or temporary restriction, including prohibition of processing, (g) to order the rectification or erasure of personal data; or order the erasure or deletion of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and order the restriction of processing pursuant to Articles 16, 17 and 18 the notification of such actions to recipients to whom the data are disclosed personal data have been disclosed pursuant to Article 17(2) and Article 19, 5 (h) withdraw certification or order the certification body to withdraw a certificate issued in accordance with Articles 42 and 43 or order the certification body to withdraw a certificate issued in accordance with Articles 42 and 43 the certification body not to issue a certification where the requirements certification requirements are not or are no longer fulfilled, (i) impose an administrative fine pursuant to Article 83, in addition to or instead of the measures referred to in this paragraph, depending on the in addition to or in addition to the measures referred to in or in addition to the above measures, depending on the circumstances of each individual case, (j) to order the suspension of the release of data to a recipient in a third country a third country or an international organisation. 3.5 Article 83 of the Regulation, which concerns the general conditions of enforcement administrative fines, inter alia, provides for the following: "1. Each supervisory authority shall ensure that the imposition of administrative fines in accordance with this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 are, for each individual effective, proportionate and dissuasive for each individual case. 2. Administrative fines shall, depending on the circumstances of each individual case, be circumstances of each individual case, shall be imposed in addition to or instead of the measures referred to points (a) to (h) of Article 58(2) and Article 58(2)(a) to (h) paragraph 2(j). When deciding on the imposition of administrative fine, as well as on the amount of the administrative fine for each individual case, due account shall be taken of the following: (a) the nature, gravity and duration of the infringement, taking into account the the nature, extent or purpose of the processing in question, and the number of processing operations, the gravity and duration of the infringement data subjects affected by the breach and the degree of damage they have suffered, (b) the fraudulent or negligent nature of the breach, (c) any actions taken by the controller or the processor to mitigate the damage suffered by the data subjects data subjects, (d) the degree of liability of the controller or processor the degree of responsibility of the controller or processor, taking into account the technical and organisational measures taken the technical and technical measures they apply pursuant to Articles 25 and 32, (e) any relevant previous infringements by the controller or the data controller; or the processor, (f) the degree of cooperation with the supervisory authority in remedying the infringement the degree of cooperation with the supervisory authority to remedy the infringement and mitigate its possible adverse effects, (g) the categories of personal data affected by the the infringement, (h) the manner in which the supervisory authority became aware of the breach, in particular whether and to what extent the controller or processor the controller or processor notified the breach, (i) where the measures were ordered beforehand, where the measures were referred to in Article 58(2) against the controller involved the controller or processor in relation to the same subject matter, compliance with those measures, (j) compliance with approved codes of conduct in accordance with Article 40; or approved certification mechanisms in accordance with Article 42; and 6 (k) any other aggravating or mitigating circumstance arising from circumstances of the particular case, such as financial benefits gained or losses avoided, directly or indirectly, by the infringement. 3. Where the controller or processor, for the purpose of the processing, directly or indirectly. the same or related processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the most serious infringement. 4. Infringements of the following provisions shall, in accordance with the paragraph 2, administrative fines of up to EUR 10 000 000 or, in the case of in the case of undertakings, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is the higher: (a) the obligations of the controller and the processor (a) the obligations of the controller and the processor in accordance with Articles 8, 11, 25 to 39, 42 and 43, (b) the obligations of the certification body in accordance with Articles 42 and 43, (c) the obligations of the monitoring body in accordance with Article 41 paragraph 4. 5. Infringements of the following provisions shall, in accordance with paragraph 2, administrative fines of up to EUR 20 000 000 or, in the case of in the case of undertakings, up to 4 % of the total worldwide annual turnover turnover in the preceding financial year, whichever is the greater whichever is the higher: (a) the basic principles for processing, including the conditions that the basic principles for processing, including the conditions applicable to authorisation, in accordance with Articles 5, 6, 7 and 9, (b) the rights of data subjects in accordance with Articles 12 to 12 22, (c) the transfer of personal data to a recipient in a third country; or an international organisation in accordance with Articles 44 to 49; (d) any obligations under the law of the Member State which are established (e) failure to comply with an order or interim measure failure to comply with a temporary or definitive restriction of processing or suspension of movement data suspension or restriction of processing or suspension of the processing of data imposed by the supervisory authority pursuant to Article 58 (2) or failure to provide access in breach of Article 58(2) paragraph 1." 3.5.1 Recital (148) of the Regulation further clarifies that: "(148) In order to strengthen the enforcement of the rules of this Regulation, sanctions, including administrative fines, shall should be imposed for any infringement of this Regulation, In addition to or instead of appropriate measures imposed by the supervisory authority authority in accordance with this Regulation. In the case of a minor infringement infringement of minor importance or where the fine likely to be imposed would be disproportionate to the a disproportionate burden on a natural person, a reprimand could be imposed instead of instead of a fine. Due account should, however, be taken of the nature, the seriousness and duration of the infringement, the intentional nature of the infringement infringement, the actions taken to mitigate the damage, the degree of of liability or any other relevant previous infringements, the manner in which 7 the manner in which the supervisory authority became aware of the breach, compliance with the compliance with measures against the controller or processor, the compliance with a code of conduct and any other aggravating or mitigating circumstances. Η the imposition of sanctions, including administrative fines, should be subject to appropriate procedural safeguards in accordance with the general principles of Union law and the Charter, including the effective judicial protection and due process." 3.5.2 In the introductory note to Guideline 4/2022 on the calculation of administrative sanctions on the basis of the GDPR 2016/679, which it issued the European Data Protection Board (EDPS) on 12 May, 2022 (the which are currently under public consultation), the following are noted: "The calculation of the amount of the fine is at the discretion of the the supervisory authority, subject to the rules provided for in the GDPR. In that context, the GDPR requires that the amount of the fine shall in each individual case be effective, proportionate and dissuasive (Article 83(1) GDPR). Moreover, when setting the amount of the fine, supervisory authorities shall give due regard to a list of circumstances that refer to features of the infringement (its seriousness) or of the character of the perpetrator (Article 83(2) GDPR). Lastly, the amount of the fine shall not exceed the maximum amounts provided for in Articles 83(4) (5) and (6) GDPR. The quantification of the amount of the fine is therefore based on a specific evaluation carried out in each case, within the parameters provided for by the GDPR." 4. Screenshot 4.1 Complying, in accordance with the provisions of Law 158(I)/1999, the directions of the Court, the relevant case law (see e.g. Kyriakidis v. Republic, above) and recommendation of the Legal Service, my Office had a duty to review the present complaint from the point raised by the Court in its annulment judgment and namely to the extent that it relates to the amount of the administrative fine which imposed. 4.2 The facts of the complaint do not differ from the original decision date. 12 April 2009 and are adopted in their entirety as stated, and in any event, they are adopted in full. in any event, they were upheld by the decision of the Administrative Court, dated 16/12/2022, in Appeal No. 962/2019. 4.3 To note that, the Supreme Court, upheld the decision of my Office, In Appeal No. 32/2013, dated 16 December 2013. 1/3/2019, between the Cyprus Republic of Cyprus and the Republic of Cyprus. Republic of Cyprus, through the Commissioner for Personal Data Protection and Publishing House Dias Ltd, which also concerned a breach of the Principle of Proportionality Principle and I had imposed a fine of €3.000. This amount had been fixed, by maximum amount imposed at that time was €30,000. After the implementation of the GDPR 2016/679 on May 25, 2018, for the same violation (principle of minimisation principle, as in the present case) a maximum administrative sanction of €20,000,000. 4.5 In addition, on 16/1/2023, I issued a decision, following a review complaint, against Arktinos Publications Ltd and imposed an administrative penalty of 8 fine of €7,000, for its violation of Articles 5(1)(c) and 6(1)(f) of the GDPR, by publishing more personal data publication of more personal data than was necessary in order to serve its right right to information of the public. 5. Ending 5.1 Taking into account all of the above elements as set out above, and based on the the powers conferred on me by Articles 58 and 83 of Regulation (EU) 2016/679, Article 24(b) of Law 125(I)/2018, and given that there was a breach of the provisions of the Regulation, as upheld by the Administrative Court, I will proceed to impose a penalty. 5.2 Under the provisions of Article 83 of the Rules, to the extent that applicable in this case, I take into account the following mitigating (a)-(d) and aggravating (e)-(i) factors, on the basis of the facts as they are before me today: (a) the Respondent's position that through negligence and not on purpose, it published in the newspaper the photographs of the three (3) complainants, (b) the fact that the Respondent the Complainant, proceeded to delete the said four (4) articles from the electronic version of the 24h newspaper, as soon as became aware of the complaint, i.e. by the letter sent by the my Office on 29/10/2018, and before receiving any written objection from my Office, (c) the fact that the Respondent, in the course of the investigation, cooperated with my Office to remedy the violation and mitigate the its potential adverse effects; and (d) the fact that this is the first complaint submitted to my Office against the Respondent the complaint, (e) the nature of the violation, which affects the professional life of complainant, although the European Court of Human Rights has held in relation to the provision of Article 8 ECHR that the protection of "private life', which is founded on that article, does not exclude the professional life of and is not limited to life within the place of residence, (f) the extent of the infringement: the four (4) publications were (4) four of the four articles were posted on the Internet for at least one (1) month prior to their deletion, with an unspecified number of readers, the print editions of the 24h newspaper did not have not been withdrawn to date and the number of readers remains unknown, (h) the number of data subjects affected by the breach, directly the three (3) complainants whose photographs were published are directly affected, indirectly the family environment of all five (5) complainants, (i) the categories of personal data affected by the breach: it concerns simply data, namely the photographs of three (3) of the five (5) complainants. 5.3 In my previous Decision dated April 12, 2019, I imposed on Respondent the Complainant an administrative fine of €3,000, for on her behalf violation of her obligations under Articles 5(1)(c) and 6 of the GDPR, having taken into account various aggravating and mitigating factors, both positive and negative respectively and with varying degrees of severity, depending on the gravity of the of the severity of the mitigating or aggravating factor in each case. 9 5.4 I also note that in Revision Appeal No. 32/2013, in which upheld a Decision of my Office, also upheld the administrative sanction imposed on the appellant in the amount of €3,000. This amount had been fixed, by maximum amount imposed at that time was €30,000. Following the application of the GDPR 2016/679 on 25 May 2018, for the same violation (principle of minimisation principle, as in the present case) a maximum administrative sanction of €20,000,000. 5.5 Taking into account the aggravating and mitigating factors that set out in paragraph 5.2 of this Decision, as they have developed during the the review of the case, as well as the fact that photographs were posted of three (3) of the five (5) Complainants, I hereby impose the Complaint on the Respondent, an administrative fine of €3,000, for her violation of Articles 5(1)(c) and 6 of the GDPR. 5.6 There has not been any reduction of the administrative fine and no variation of the from the first Decision of my Office, since there was no variation of the aggravating and mitigating factors which were taken taken into account during the review. The infringement found and confirmed by the Administrative Court, related specifically to the publication of the photographs, of three (3) of the five (5) complainants. The report of the two cases, with similar incidents, in which fines were imposed and in particular this of the Review Appeal, I consider that it strengthens and justifies the amount of the fine penalty. Irene Loizidou Nicolaidou Data Protection Commissioner Personal Data Protection Commissioner