Commissioner (Cyprus) - 11.17.001.010.064
| Commissioner - 11.17.001.010.064. | |
|---|---|
 | |
| Authority: | Commissioner (Cyprus) |
| Jurisdiction: | Cyprus |
| Relevant Law: | Article 5(1)(f) GDPR Article 24(1) GDPR Article 32 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 11.04.2022 |
| Decided: | 21.09.2022 |
| Published: | 16.11.2022 |
| Fine: | 5000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 11.17.001.010.064. |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | dataprotection.gov.cy (in EL) |
| Initial Contributor: | n/a |
The DPA of Cyprus fined the Cyprus electricity authority €5000 for violations of Articles 5(1)(f), 24(1) and 32 GPDR for sending a consent form containing personal data to the data subject's neighbour, resulting in an unauthorized disclosure of personal data.
English Summary
Facts
The Cyprus electricity authority (controller) wanted to place an overhead or underground power line on the data subject's land. The controller sent the data subject a consent form for the placement of this power line. However, an officer of the controller delivered the consent form, which contained personal data, to the neighbour of data subject by accident. The officer was the one who discovered his own error and admitted that this had been a mistake. He had also assured the controller that he would undertake training regarding personal data, which he had not undertaken before, and that he would not commit such a mistake again.
The controller apologised and stated that is the violation was committed out of negligence and not out of malice. It had previously undertaken periodic briefings for Its staff and had also organised GDPR related training sessions. However, the controller also acknowledged the need for further training for its staff and had already planned further training sessions.
The controller admitted that the deliverance of the consent form to the neighbour was legally incorrect looking at Article 31 of the Electricity Law (KEF.170), which states that the consent form can only delivered to the data subject.
Holding
Violation of Article 24(1) GDPR
The DPA determined that the controller violated Article 24(1) GDPR because the controller did not implement appropriate technical and organizational measures in advance to ensure that its processing was GDPR complaint. Nor did the controller implement measures to enable it to detect and/or verify any breach. The DPA stated that the controller would have been able to the determine whether the consent form was served to the owner or not, if it had established a procedure that would allow it to check this. This procedure was missing, which was the main reason the violation had occurred in the first place, according to the DPA. The controller had not taken the appropriate steps in order to ascertain and prove if its processing was GDPR compliant.
Violation of Articles 5(1)(f) and 32 GDPR
The DPA also determined that the controller violated Article 32 GDPR, because the controller did not implement appropriate measures in advance in order to prevent the unautorized disclosure of the consent form. The DPA stated that the controller beared the sole responsibillity for training and informing its staff. The training and periodic briefings that the controller already provided were deemed inadequate by the DPA. The controller had been unable to prevent this unauthorized disclosure of personal data in te consent form.
The DPA aslo determined that the controller violated the principle of of intergrity and confidentiallity (Article 5(1)(f) GDPR) because the personal data of the data subject was processed in such a way that allowed unauthorized and/or unlawful processing.
After condidering several mitigating (8) and aggravating factors (6), the DPA fined the controller €5,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
