Commissioner (Cyprus) - 1.17.001.007.270
From GDPRhub
| Commissioner (Cyprus) - 1.17.001.007.270 | |
|---|---|
 | |
| Authority: | Commissioner (Cyprus) |
| Jurisdiction: | Cyprus |
| Relevant Law: | Article 5(1)(a) GDPR Article 6(1) GDPR Article 9 GDPR Article 31 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | |
| Decided: | 04.03.2021 |
| Published: | 22.09.2021 |
| Fine: | None |
| Parties: | Cyprus Association of Automotive Engineer Assessors |
| National Case Number/Name: | 1.17.001.007.270 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Greek |
| Original Source: | Cypriot DPA (in EL) |
| Initial Contributor: | Florence D'Ath |
The Cypriot DPA imposed a reprimand and a warning on a professional association for having unlawfully processed the personal data of one of its former member, and for failure to cooperate with the DPA in the course of the complaint procedure.
English Summary
Facts
A data subject (X) was working as a professional assessor for the Pancyprian Association for Automotive Engineers Assessors (hereinafter AAEA). Following the rescission of X's membership, AAEA sent a letter to several insurance companies, informing them of the fact that X was no longer one of their members, without however obtaining the prior consent of X.
X decided to file a complaint with the Cypriot DPA (the 'Commissioner') against AAEA, considering that they should not have shared such information with the concerned insurance companies, and had therefore unlawfully processed his personal data.
After hearing X on the subject, the Commissioner required information from AAEA with respect to the processing of X's personal data. AAEA however did not reply to the Commissioner.
Holding
The Commissioner considered that, by sending a letter to insurance companies regarding the rescission of X's membership, AAEA had violated Article 5(1)(a) GDPR, Article 6(1) GDPR and Article 9(1) GDPR. The Commissioner therefore decided to impose a Reprimand on AAEA, as the latter had failed to substantiate and/or prove the lawfulness of the relevant processing act. For reaching this decision, the Commissioner took into account, among others, the fact that compliance by AAEA with its Code of Professional Ethics was not demonstrated, but also the fact that AAEA is not a regulated or institutionalized supervisory authority (cf. there is no Cypriot law specifically regulating the profession of automotive engineer assessors).
The Commissioner also considered that by failing to reply to its requests for information in the course of the procedure, AAEA had not comply with its obligation to cooperate under Article 31 GDPR. The Commissioner stressed that the requested information was not complex, and that AAEA ought to have responded in due time. However, since, in the end, AAEA provided answers to the Commissioner, the Commissioner decided to impose a warning rather than a fine.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
REPUBLIC OF CYPRUS OFFICE OF THE PROTECTION COMMISSIONER
PERSONNEL DATA
character
ΕΠΙΤΡΟΠΟΣ
No. Facsimile: 11.17.001.007.270
DECISION
Complaint / complaint XXXXXX against Pancyprian Association
Motor Appraisers for breach of personal data
I am referring to the complaint lodged at my office on 9 December
2019, by the lawyer Mr. XXXXXX of the law firm L. Papafilippou & Co., from
part of Mr XXXXX (hereinafter the "complainant") against the Pancyprian
Association of Motor Appraisers (hereinafter referred to as "Kath 'ou"), as well as throughout
correspondence on the above subject, which is part of its dossier
case. The complaint / complaint has a date of December 5, 2019.
A. Allegations of the Complainant
2.1. As mentioned in the complaint / complaint, the complainant was a member
of the Defendant from XXXXXX 2015. Attached to the complaint, the certificate
member of the complainant by that date. On XXXXXX 2018, it was sent
letter to the members of the Association, signed by the chairman of the Board. of
Association, Mr. XXXXXX, stating among other things that under Article 8 of the Code
Ethics of the Association, the Board is forced to "expel" from
the Association of people who charge low for their services, noting that:
"He who charges so low gives the right to be doubted
his honesty and integrity, because as they say, he who works in
his damage, he takes them from somewhere else.
This attitude colleagues offends the association and the rest
members and for this we will be forced as a council, based on the article
8 of the code of conduct to remove them from the link.
Therefore, please comply and show the necessary
seriousness if we want to maintain a respectful image of the link
us".
Jason 1, floor, 1082 NICOSIA / PO Box 23378, 1682 NICOSIA. Tel: 22818456, Fax: 22304565
E-mail: commissioner@dataprotection.gov.cy, Website: http: //www.dataprotection.gov.cy2.2. The complainant alleges the above, in conjunction with the letter
of the Board of the Association dated XXXXXX 2019 to the insurance companies, in
which refers to the deletion of the complainant by the Association, violate the
personal data of a personal nature, and in particular his membership in an association and
linking it to alleged illegal activities. The letter
which was attached to the complaint lodged with my Office, states,
among others, that the BoD of the Association would like to emphasize, once again, that it will
Qualified appraisers of the association must be appointed, for proper
professional approach and safe repair of the vehicles involved
in an accident, where fair compensation and protection are ensured
interests of these companies. By the way, I note that, in this letter,
the insurance companies are informed about the deletion of two more members of the Defendant,
while it is also stated that any relationship or connection is strictly forbidden
with the link.
2.3. In the complaint, the complainant's lawyer also states that
his client, up to that time, had not received any letter or any
information about his alleged deletion, but also the reasons for them
which has allegedly been deleted. He also states that, with his instructions
the complainant has addressed a letter to the Defendant. This letter is attached
to the complaint.
I also note that this letter, from the complainant's lawyer to
Defendant, dated 02 December 2019, was notified to my Office on 03
December 2019, via fax. In this letter, his lawyer
the complainant states that it considers it completely unacceptable and inadmissible
report on the deletion of the complainant, in the Defendant's letter to
insurance companies, dated XXXXXX 2019, and that this action constitutes
libel, defamation and harmful pseudology.
B. Intermediate Actions
3.1. On January 2, 2020, I emailed him
Chairman of the Board of the Association, at its e-mail address
Liaison Office, with which the Defendant was informed of this complaint and was summoned,
as of 31 January 2020, submit specific documents, data and
information. More specifically in paragraph 4 of the attached file, it was requested
as, until the above date, the Statute of the Association is sent, as well
and Regulations, if any, governing the operation of the Association, be clarified
whether the practice of the profession of motor appraiser presupposes the
registration in the Association, and, if not, indicate the number of members of the Association,
as well as the number, or estimate of, number of motor appraisers who do not
belong to the Association. It was also requested that any others be provided
information or documents are considered necessary to investigate the complaint.
3.2. Despite the fact that the Defendant had to submit the requested information by
on the above date, did not take any action, not even in communication or
update my office.
24. On 04 February 2020, an Office Officer contacted me
by phone with the Chairman of the Board of the Association, and after informing him about
complaint, granted extension of implementation of the requested until 14
February 2020.
5.1. On 07 February 2020, the Defendant's lawyer, Mr XXXXXX, summoned
by phone to my Office, leaving his contact details. The same day
contacted him, by phone, Officer of my Office. When communicating,
Defendant's lawyer informed that it operates on behalf of the Association and that it will
there is an attempt to reconcile with the complainant. At his request,
a new extension was granted until 25 February 2020.
5.2. This deadline expired without action, without the submission of the requested
information or contact or update my Office.
6.1. On February 27, 2020, an Officer of my Office tried to
contact the Defender's lawyer by telephone, without success.
6.2. The same Officer contacted the Defendant's lawyer again
by telephone on 28 February 2020. And the lawyer informed again about
attempt to reconcile with the complainant. The Officer stated that
The complainant's lawyer asked, a few days before, to be informed of the
actions and investigations carried out until then by my Office, without leaving
no suspicion of the existence or knowledge of an attempt at reconciliation. Then, the
Defendant's lawyer stated that the Association had met the previous day
evening, and that the reconciliation effort would take place next week and as a result
an extension was requested for another week. Based on the above, was given cm
exclusive time limit for replying and submitting the requested information
until 08 March 2020.
6.3. Despite the fact that the submission deadline had passed, the Defendant did not submit
the requested information, nor contacted or informed my Office.
7.1 On 25 February 2020, the complainant 's lawyer requested through
to be informed of the actions and / or investigations I have carried out
on the complaint.
7.2 On March 3, 2020, I sent an email to his lawyer
complainant, by which I informed him that, after the initial investigation that
conducted by my Office, I have requested specific information and information from
Defendant, who has a deadline for their submission, March 08, 2020.
8. On May 6, 2020, an Office Officer contacted me by telephone
the vice president and the secretary of the Board of the Association, Mr. XXXXXX and Mr. XXXXXX
respectively, to find out who are legally responsible for receipt
correspondence of the Association.
9.1. On the same day, May 6, 2020, the Defendant's lawyer contacted
by phone with my Office. When communicating with an Office Officer, his
was requested to send an appointment document under the Pancyprian Association
3Value Engineers and indicate who are on behalf of the Association against
legally responsible for receiving mail.
9.2 On May 12, 2020, an Office Officer contacted me at
Defendant's lawyer, following a voice message the latter left in the Office
on May 6, 2020. During the conversation, the lawyer stated that he would send the
appointment document the same or the next day, and that, as informed by
Defendant, legally responsible for receiving correspondence of the Association is the
president, vice president and secretary of the Association. Also after relevant
question, he was given general procedural information concerning the first
face decisions.
9.3 On the same day, 12 May 2020, the Defendant's lawyer sent
the document of appointment of a lawyer under the Pancyprian Association
Motor Appraisers. He also informed in his email that like
informed, competent persons to receive correspondence, is the president, the
vice-president and the secretary of the Defendant.
9.4 Due to the fact that the above-mentioned appointment did not have the stamp of the Association,
nor was the name and status of the person signing ex
part of the Association, by e-mail of the Office dated 25 May
2020, was requested by the Defendant's lawyer to resubmit an appointment
document, which includes the above.
9.5 On 05 June 2020, an e-mail was sent to the lawyer of Prof.
by which an exclusive deadline was granted until 10 June 2020 for
satisfaction of the above.
9.6 On 09 June 2020, the Defendant's lawyer resubmitted the appointment
document bearing the seal of the Association. Also on his electronic
There was a message stating that the appointment was signed by Mr XXXXXX
and Mr. XXXXXX, Vice President and Secretary, respectively, of the Defendant.
10. On 22 June 2020, he was handed over to the defendant's lawyer at first sight
decision of 18 June 2020, after I found that it exists at first sight
infringement of Articles 5, 6 (1), 9 (1) and 31 of Regulation (EU) 2016/679 and
Article 33 (1) (b), (l), (m) of Law 125 (I) / 2018. My ex-appraisal
(reasoning) is set out in paragraph 35 hereof.
10.1. Also, before making a decision on possible enforcement
of the administrative fine, the lawyer of the Defendant was summoned as he submits, within six
weeks after the final decision, their comments and positions
its clients in relation to the above-mentioned infringements mentioned above
Regulation and Law 125 (I) / 2018, as well as any other comments or positions
of his clients on the case.
11.1 The complainant's lawyer requested, by email, a date
06 May 2020, as informed of my position on the complaint.
411.2 On 03 July 2020, the complainant's lawyer was informed that he has
a preliminary ruling is given against the Defendant for breach of the Rules of Procedure
(EU) 2016/679 and Law 125 (I) / 2018.
11.3 On 06 July 2020, the complainant's lawyer called
in my Office leaving his details. On the same day, Office Officer
, called the aforementioned, who asked to be informed of what it means
decision at first sight, and he was given the appropriate clarifications.
12. On 02 July 2020, the Defendant's lawyer sent an e-mail
requesting that full copies of the case file be provided,
in order, as he mentioned, on the one hand to be able to advise his clients
accordingly and on the other hand to submit the comments and positions of its customers.
12.1. The defendant's lawyer, on July 9, 2020, informed that the copies
of the case file would be received by Mrs XXXXX, a lawyer at the
his office.
12.2. Indeed, on the same day, the aforementioned received those documents at
inspection framework of the administrative file of the case.
13.1. On 24 July 2020, the Defender's lawyer submitted, by e-mail,
questions to my Office. In particular, he asked how
of the complainant, as well as whether the positions of his clients should
to be submitted in writing or orally. If the written citation of the positions was required
and comments of the Defendant, due to workload and for personal reasons, was requested
an extension of six weeks for the submission of applications, and as he stated, at least
until mid-September.
13.2. On July 28, 2020, I sent a letter to the Defendant's lawyer, to
answer to the questions he submitted on 24 July 2020. I informed him that as
Administrative Body I exercise my duties by issuing executive administrative acts
through a written procedure, and therefore there is no right of reconsideration
of the complainant under this procedure. I also informed him that
reserves the right to rebut allegations in writing if
something like this was asked of him.
In addition to the above, I quoted his article 43 (4) on his General Principles
Administrative Law of 1999, Law 158 (I) / 1999, based on which, the comments and
His clients' positions on the case could be submitted either
orally or in writing. I pointed out, however, that it is preferable for them to be submitted
in writing, taking into account the particular circumstances of the COVID-19 pandemic. As long as
concerns the extension requested for reply, in case the
written citation of his comments, he was granted an extension of two weeks, ie
until 17 August 2020, after taking into account the large time frame given to him
had already been given.
14.1. On August 17, 2020, the last date on which it was due
Defendant's lawyer to submit his views and comments at first sight
my decision, the aforementioned visited my Office. He called
5 by telephone the complainant's lawyer, and a call was made to
open hearing, ie with the simultaneous participation of both lawyers. During the
In this call, the complainant's lawyer did not object to its extension
during the reply period by the Defendant's lawyer, which
I accepted. It was requested by the defendant's lawyer, as he also sent in writing
the request for extension.
14.2. On the same day, the Defendant's lawyer sent an e-mail to
my Office, by notifying the complainant's lawyer, to which
stated that discussions were taking place on the substance of the matter between the parties and
there is a high probability of an "out-of-court" settlement of the case. It was requested
extension of its reply deadline until 21 September 2020.
14.3. The same day, I sent an e-mail to the Defender's lawyer, with
notification to the complainant's lawyer, which I granted to
first the requested extension, ie extension until 21 September 2020.
C. Defendant's allegations
15. On September 21, 2020, the Chairman of the Board of the Defendant presented to
My office, the answer of the Defendant's lawyer.
15.1. In his letter, the defendant's lawyer stated that:
15.1.1. Unable to grasp the legal meaning and interpretation of the term “seems to
there was ... »violation of the provisions of the Rules of Procedure. He wondered if he could
and that there was no infringement, and why his clients are then called upon to submit them
posts and their comments. I note that the Defender's lawyer refers to
my letter to him, dated 18 June 2020, in which I stated that “with
Based on the evidence before me, it appears that there was, at first sight,
infringement of the provisions of Regulation (EU) 2016/679 (...) ".
15.1.2. In his view, three important questions arise:
- Why it was needed XXXXXX from the letter of the President of the Defendant,
date XXXXXX 2018, in order to "offend" the complainant and proceed to
his complaint?
- Because it took XXXXXX months from the letter of the Association to
insurance companies, dated XXXXXX 2019, in order to "affect" the complainant and
to make the complaint?
- Because my office took almost a month to
inform its customers about the complainant's complaint?
15.1.3. The letter of the president of the Defendant to the members of the Association,
dated XXXXXX 2018, bears the form of informing the members of the Association about
the General Assembly that preceded, in XXXXXX 2018, refers to a plethora
issues, consumes a few lines towards the end on the issue in question and finally
is signed only by the president of the Association.
615.1.4. The time frame I set in my letter dated 02
January 2020, to the Defendant, for reply by 31 January 2020, and
in fact, as he mentions, during the holiday season for Christmas and
New Year's Eve is an "objectively impossible" thing. Also, that the above is
incompatible with the not-so-immediate response, as he states, of my Office,
since, for example, it took 13 days for him to be asked to send
re-appointment document with specific details.
15.1.5. Through the calendar data quoted in my letter
dated 18 June 2020, is attributed to its customers, as it states, a
form of inconsistency and / or obstruction. He points out that from these same calendars
evidence, it turns out the exact opposite, that is, that his customers and himself,
given the given conditions and circumstances, were completely consistent and
formal in relation to anything they should do about the case.
Except, as he mentions, if one would expect that in the middle of the New Year holidays
initially and most importantly "in the middle of the Coronavirus pandemic" afterwards, will
set the complainant's complaint and submission as the highest priority
of the requested information in my Office. He also wonders if my Office
it worked, and if so, if it performed such work, from the moment they
Courts suspended their work. For this reason, please be informed
about the manner and the days and hours of operation of my Office for the time
period January - May 2020.
15.1.6. It is my position that my conclusion about existence at first sight
violation of the Regulation and Law 125 (I) / 2018, is based mainly on
erroneous, as he states with all due respect, a finding of 'non-performance
of due importance and non-cooperation "on the part of its customers. For the reason
this, submits that the above is not correct and should be revoked and / or
revoked.
15.1.7. The question arises, as he states, about how his provisions
Regulation and Law 125 (I) / 2018, which I quoted in my letter to
on the same date 18 June 2020, were applied in the case, and also sets the
question about what the relevant findings are legal and real. Submits,
yet, the position that neither findings are legally and factually cited nor
how to apply and evaluate them in relation to the case.
15.1.8. The right to be heard by the "accused", the citation of the evaluation
and its justification in relation to any findings of the defendant, the information
(caution) of the "accused" about the existence of proceedings against him and the
informing (caution) of the "accused" about the possibility of her trial
in his absence, are, as he states, its cornerstones
administration of justice. It has also been emphasized that the above is well-established
underlined in without exaggeration thousands of decisions over time.
He is of the opinion that the above did not happen in any way or in any way
implementation. In addition, it states that its importance and criticality are understood
proper application of the above principles, given that cases of this nature
treated as "quasi-criminal cases".
715.1.9. It raises the question, whether what the complainant attributes to them
his clients, constitute a violation of the Regulation and Law 125 (I) / 2018,
meeting first the conditions required and secondly the
components of any alleged breach. It also states that having
Deep down the case, he undoubtedly answers "no" to the above questions.
I quote the data as it is, as he states, on which he bases his opinion:
"A) No form of intention appears from the facts to have existed in the en
generates actions of either the Association or the President personally.
B) There is no connection or connection between the two letters
namely the President of the Association day XXXXXX 2018 and the Association day.
XXXXXX 2019.
C) Between the above two letters, there is a time difference XXXXXX
months, so that the complainant's claim that the
combination of these two letters, violates in any way "the
personal data and in particular his participation in
association and its connection with illegal actions ".
D) None in the letter of the Association dated. XXXXXX 2019 reference is made
in the letter of the President dated XXXXXX 2018 nor is it related to it,
moreover, these two letters are completely different from each other
content.
E) The Complainant received official knowledge of his expulsion (and no
deletion) by relevant letter dated XXXXXX 2019 after it preceded
meeting with the Board of Directors of the Association.
F) The conclusion that the Complainant himself comes to through
combination of the two letters in question is unfounded and arbitrary,
and lacks any legal or factual basis.
G) In the same complaint of the Complainant dated. XXXXXX 2019, which
took place by letter of his lawyer it is clear that the
The complainant is possessed by a sense of revenge against the Association.
Specifically, the Complainant refers to paragraph 6 thereof
letter / complaint:
"With the above and in combination with the letter dated. XXXXXX 2019
essentially our client is photographed as the person making it
in illegal and / or dishonest acts. Note that it is known to members
of the Board of Directors of that Association that our client
mostly cooperates with a specific insurance company, the
General Insurance of Cyprus, providing appraiser services after
award to him which he submitted to the group
of the Bank of Cyprus. The members of the Board of the Association and in particular o
President of this cooperate themselves with this insurance company
company."
In other words, the Complainant points out that the Board of Directors hastened
of the Association deleted him for vested interests. From her and
only the thought of the Complainant I respectfully submit that they appear
his other motives and aspirations ".
815.1.10. Takes the position that all the data that make up the present case,
lead effortlessly to the conclusion that no infringement was committed by his customers
and that, in any event, the present case does not ultimately fall with the whole
respect, as it states, for my responsibilities and powers as defined
and are delimited in the Regulation and in Law 125 (I) / 2018.
15.1.11. It conveys the assurance of its customers about the sense of legitimacy that
distinguished them and distinguishes them, their unwillingness to hurt in any way
the prestige, reputation and character of anyone and their disposition and intention,
in order to avoid such issues.
15.2. The Defendant's lawyer's letter contained his Statute
Association, the Code of Professional Ethics, the application for membership
of the complainant dated XXXXXXX 2015, the letter of approval of the complainant
for admission to the Association dated ΧΧΧΧΧ 2015, his expulsion letter
complained by the Association date XXXXXX 2019, as well as receipt
registered mail to the complainant dated XXXXXX 2019.
15.2.1. According to the Statute of the Defendant, article 2 - Aims, point 5, its purpose
Association is "As it takes any measure and proceeds to anyone
The link to be promoted, promoted and protected was deemed appropriate
the scientific and professional interests of its members ".
Pursuant to Article 8 of the Articles of Association - Obligations of members and discipline:
"A. The members of the Association are expected to behave with decency and
generally with their action and participation in the events of the Association to
serve and promote its purposes. They also have to
comply with the Code of Conduct to be adopted by the General
Meeting.
B. A member may be expelled if repeatedly and in spite of
warnings of the Executive Committee behave improperly or
violates the purposes of the Association or the Code of Conduct or
of the provisions of these Articles of Association.
(...) ».
15.2.2. The Code of Professional Ethics, which states that “The following
terms bind, oblige and govern the professional conduct of members
of motor appraisers ", including, inter alia, the following provisions:
"8) The member must always behave in a way that does not expose or
offends the association, the other members or its position as a member ".
"10) The board of directors of the association will be the competent body that will
determine whether the professional code has not been complied with by a member or members and
will have the power to decide as the case may be until
expulsion of the member or members ".
915.2.3. In the letter of approval of the complainant for admission to the Association
dated XXXXXX 2015, includes the following: “We consider it necessary to you
we mention and draw your attention that our link is bound by
code of professional conduct and you will be asked to subscribe to it
relevant form ".
15.2.4. In the letter of expulsion of the date complained by the Association
XXXXXX 2019, the following excerpt is included:
"It is with great sadness that we contact you today to express ourselves to you
our frustration regarding your obligations to the Association.
Despite repeated efforts and after personal contact and
meeting with the board however you have not proceeded to
necessary actions resulting in a conflict of conditions
the statute and the code of professional conduct.
We are obliged, based on the statute, to expel you
from the link.
"Membership obligations and discipline" »Article 8»
We kindly ask you to remove from the reports from now on
expertise that you deliver and / or carry out on behalf of
any insurance company and / or elsewhere, any item or and
logo that connects you with the Pancyprian Association of Appraisers
Motorized ".
D. Legal framework
16. Pursuant to Rule 5 (1) of the Rules of Procedure concerning the Authorities
governing the processing of personal data, such data,
inter alia, be processed lawfully and in a transparent manner in
relation to the data subject ("legality, objectivity and transparency").
17. Under the same article, paragraph 2 clarifies that the person responsible
is responsible and able to demonstrate compliance with
paragraph 1 ("accountability").
18. In accordance with Article 6 1 1 of the Rules of Procedure, the processing
is lawful only if and when at least one of the following applies
conditions:
(a) the data subject has consented to their processing
personal data for one or more specific
aims,
(b) processing is necessary for the performance of a contract for which
the data subject is a Contracting Party or to take action against
request of the data subject before concluding a contract,
c) processing is necessary to comply with a legal obligation
the controller,
D) processing is necessary to safeguard its vital interest
data subject or other natural person,
(e) the processing is necessary for the performance of a task which
is carried out in the public interest or in the exercise of public authority
assigned to the controller,
f) the processing is necessary for the purposes of the law
interests pursued by the controller or a third party, unless against
their interests prevail over the interests or fundamental rights and
freedoms of the data subject enforcing their protection
personal data, especially if the data subject is a child.
19. Pursuant to Article 9 (1) of the Rules of Procedure,
processing of personal data disclosing racial or
ethnic origin, political views, religious or philosophical beliefs
or participation in a trade union, as well as genetic processing
data, biometric data for the purpose of unmistakable identification
data relating to health or data relating to
natural sex life or sexual orientation.
20. In the same Article, namely Article 9, paragraph 2 states that
previous paragraph does not apply in the following cases:
(a) the data subject has given explicit consent to
processing of this personal data for one or more
for specific purposes, unless the law of the Union or of a Member State so provides
. Whereas the prohibition referred to in paragraph 1 may not be lifted by
data subject,
(b) the processing is necessary for the performance of the obligations and
exercise of specific rights of the controller or the subject
data in the field of labor law and social security law
and social protection, if permitted by Union or State law
by collective agreement in accordance with national law providing appropriate
guarantees for the fundamental rights and interests of their subject
data,
c) treatment is necessary to protect the animals
interests of the data subject or other natural person, if the
data subject is physically or legally incapable of consent,
(d) the processing is carried out, with appropriate guarantees, within the framework of
legal activities of an institution, organization or other non-profit organization with
political, philosophical, religious or trade union goal and provided that the
processing concerns only the members or former members of the body or persons
who have regular communication with him in relation to his purposes and that the
personal data are not disclosed outside this body
without the consent of the data subjects,
(e) the processing concerns personal data which they hold
explicitly disclosed by the data subject,
f) processing is necessary for the foundation, exercise or support
legal claims or when the courts act in their jurisdiction,
g) the processing is necessary for reasons of substantial publicity
under the law of the Union or a Member State which is proportionate
Towards the intended purpose, it respects the essence of the right to protection
and provides appropriate and specific measures to ensure
fundamental rights and interests of the data subject,
(h) the treatment is necessary for preventive purposes; or
occupational medicine, assessment of the employee's ability to work,
medical diagnosis, provision of health or social care or treatment or
management of health and social systems and services based on it
Union law or the law of a Member State or under a contract with a professional
in the field of health and without prejudice to the conditions and guarantees provided
referred to in paragraph 3,
(i) the processing is necessary for reasons of public interest in
in the field of public health, such as protection against serious cross-border threats
against health or ensuring high standards of quality and safety
healthcare and medicines or medical devices, on the basis of
the law of the Union or the law of a Member State, as appropriate
and specific measures to protect his rights and freedoms
subject to the data, in particular professional secrecy, or
(j) the processing is necessary for archiving purposes
public interest, for the purposes of scientific or historical research or for statistics
for the purposes of Article 89 (1) under Union law or
Member State which are proportionate to the objective pursued shall respect the
substance of the right to data protection and provide for appropriate and
specific measures to safeguard fundamental rights and freedoms
interests of the data subject.
21. Pursuant to Rule 31 of the Rules of Procedure, the controller and
processors and, where appropriate, their representatives shall cooperate,
upon request, with the supervisory authority for the performance of its duties.
22. Pursuant to Rule 57 (1) (f) of the Rules of Procedure, the Commissioner, inter alia,
handles complaints submitted by the data subject or by
body or organization or association in accordance with Article 80 and investigates, in so far as
the subject of the complaint is appropriate.
23. Pursuant to Article 58 (2) of the Rules of Procedure, the Commissioner
has all the following corrective powers:
(a) issue warnings to the controller or
processing that intended processing operations are likely to
infringe the provisions of this Regulation,
b) reprimand the controller or executor
processing when processing operations have violated provisions of this
Regulation,
(c) instruct the controller or executor
processing to comply with the data subject 's requests for
the exercise of his rights in accordance with this Regulation,
(d) instruct the controller or executor
make the processing operations in accordance with its provisions
of this Regulation, if necessary, in a specific way and within a certain
deadline,
(E) instruct the controller to announce the
breach of personal data to the data subject,
(f) impose a temporary or permanent restriction, including
ban on processing,
g) order the correction or deletion of personnel data
nature or restriction of processing under Articles 16, 17 and 18 and
order to notify these actions to recipients to whom the data
disclosed under Article 17 (2) and
Article 19,
(h) withdraw the certification or order the certification body to
withdraw a certificate issued in accordance with Articles 42 and 43 or order the
certification body not to issue certification if the requirements
certification are not met or are no longer met,
(i) impose an administrative fine pursuant to Article 83, in addition to or in lieu of
of the measures referred to in this paragraph, as the case may be
in each individual case,
(j) order the suspension of data traffic to a recipient at
third country or to an international organization.
24. In accordance with Rule 83 (2) of the Rules of Procedure
fines, depending on the circumstances of each individual case, are imposed
in addition to or instead of the measures referred to in Article 58 (2)
(a) to (h) and in Article 58 (2) (j). When deciding on
with the imposition of an administrative fine, as well as on the amount of the administrative
for each individual case, due account shall be taken of the following:
(a) the nature, gravity and duration of the infringement, taking into account
the nature, extent or purpose of the treatment concerned and the number of
subjects of the data affected by the infringement and the degree of damage suffered
suffered,
b) the deceit or negligence which caused the infringement;
(c) any action taken by the controller or
perform the treatment to mitigate the damage suffered by their subjects
data,
(d) the degree of responsibility of the controller or its executor
taking into account the technical and organizational measures they apply
pursuant to Articles 25 and 32,
(e) any relevant previous infringements by the controller; or
of the processor,
(f) the degree of cooperation with the supervisory authority to remedy it
infringement and the reduction of its possible adverse effects,
(g) the categories of personal data affected by
violation,
(h) the manner in which the supervisory authority was informed of the infringement;
in particular if and to what extent the controller or processor
notified the infringement,
(i) where measures have been previously ordered
referred to in Article 58 (2) against the person responsible
the processor or the processor in relation to the same object, h
compliance with these measures,
(J) compliance with approved codes of conduct in accordance with Article 40; or
approved certification mechanisms in accordance with Article 42 and
(k) any other aggravating or mitigating factor arising out of
circumstances of the case.
25. In accordance with Article 83 (3), in the event that the person responsible
the processor or the processor, for the same or for related operations
violates several provisions of this Regulation, the total amount
of the administrative fine does not exceed the amount set for the heaviest
violation.
26. Infringement of the provisions of Article 83 (4)
concern, inter alia, the obligations of the controller and his
processing in accordance with Articles 8, 11, 25 to 39 and 42 and 43,
impose, in accordance with paragraph 2, administrative fines of up to EUR 10 000 000 or,
in the case of businesses, up to 2% of the total global annual cycle
of the previous financial year, whichever is higher.
27. In accordance with paragraph 5 of that article, namely Article 83,
infringements of the basic principles for processing, including the conditions set out in
apply for approval in accordance with Articles 5, 6, 7 and 9 draw, in accordance with
paragraph 2, administrative fines of up to EUR 20 000 000 or, in the case of undertakings,
up to 4% of the previous global turnover
financial year, depending on which is higher.
E. Rationale
28. Although I take it for granted, I make it clear that I did not consider it
actions, facts, evidence and / or allegations which do not relate to
responsibilities provided to me under the Regulation and Law 125 (1) / 2018.
28.1. Therefore, I did not consider issues relating, inter alia, to correctness or
of the Defendant's decision to expel / delete the complainant from
Link, to the connection / identification or not of the complainant with alleged illegal
actions, in the existence or non-existence of libel, defamation and harmful falsehood against
of the complainant, whether or not there is an intention in the actions of either the Defendant or
of the president of the Association personally, in the existence or not of relevance or connection
between the letter of the president of the defendant dated XXXXXX 2018 and
letter of the Defendant dated XXXXXX 2019, on whether the complainant
possessed by a sense of revenge, as well as whether in deeds and / or
allegations made to me, there is a discrepancy between the two parties or
skip my update, as I quote for example in the next one
paragraph, but in no way affect its substance or nature
processing of personal data relating to
my responsibilities.
For example and in continuation of the above, I quote the following: despite
fact that the Defendant's lawyer in his letter dated 21 September
2020, attached the letter of dismissal of the complainant from the Association
14-day XXXXXX 2019, as well as receipt of registered mail to the
complainant dated XXXXXX 2019, the complainant's lawyer in
letter in which the complaint was submitted on 09 December 2019, stated that the
the complainant, up to that time, had not received any letter or
any information about his alleged deletion, but neither the reasons
for which it has allegedly been deleted, and that, on the complainant's instructions
has written a letter to the Defendant. I note, further, that the aforementioned
The complainant's letter to the Defendant is dated 02
December 2019, for which, however, the Defendant's lawyer has not done anything
report. The validity or otherwise of the information in this paragraph does not affect
substance of the complaint concerning the data processing act in question
therefore I have not, nor will I, proceed to
an attempt to clarify or clarify them.
28.2. From the above, I explicitly point out that the competence given to me by
Regulation and Law 125 (I) / 2018 is to examine whether the disclosure
the expulsion / deletion of the complainant to the insurance companies, as
act of processing personal data, was lawful and in accordance with
the legal framework I mentioned above.
29. I note that, in this Decision, as well as in previous letters
I use the terms expulsion and deletion, without any discrimination
between them, since while in the Articles of Association of the Association, article 8, in his letter
of the President of the Defendant to the members of the Association dated XXXXXXX 2018 and in
Defendant's letter to the complainant dated XXXXXX 2019 appears on
word expulsion, or its equivalent, in the Defendant's letter to the insurance companies
companies dated XXXXXX 2019 the word deletion appears.
30. I quote my ex-officio evaluation (reasoning) as it stands
This is contained in my letter to the Defendant, dated 18 June 2020:
«26. I have not been presented with any evidence to defend him
Association that refutes the allegations of the complainant about her
breach of his personal data after, despite the fact that they have
grant your customers three extensions of submission
requested in my Office letter dated 02 January 2020,
did not take any action, contact or even inform him
Office.
27. The non-sending to my Office of the Statute of the Association, as well
and Regulations, if any, governing the operation of the Association, as
was requested in my Office letter dated 02 January 2020,
does not prove that personal data are submitted to
lawful and lawful processing in a transparent manner in relation to the subject.
28. Despite the fact that the Association, as the person in charge of processing, has the
responsibility and must be able to demonstrate compliance with
paragraph 1 of Rule 5, your customers did not
any action to my Office.
15 29. No evidence or argument has been provided for the documentation
the legality of the processing carried out by your customers.
30. Your customers have not taken any action to prove it
non-prohibition of the processing of personal data which
reveal participation in a trade union organization and in general the
processing of specific categories of personal data.
31. The three deadlines for submitting the requested letter of the Office
dated 02 January 2020, which had been granted to them
your customers, expired without submitting any item, and without
be informed or contact my Office for non
their submission. Moreover, not even after the expiry of the deadline
your customers did not submit any information, nor did they update or
contacted my Office. The above data prove the non
their collaboration with my Office.
32. In a letter from my Office dated 02 January 2020,
the Articles of Association and any Regulations governing its operation were requested
Link. I consider that their submission required minimal or no burden.
Your customers were also asked to specify whether the
Practicing the profession of motor appraiser presupposes the
registration in the Association, and, if not, indicate the number of its members
Link, as well as the number, or estimate number, of appraisers
motor vehicles not owned by the Association, as well as to provide
any other information or documents they deem necessary for
investigation of the complaint. I consider the above data or information
was aware of your customers, and therefore easily accessible and
available for submission.
33. Based on the above, and taking into account that time has elapsed
more than five months after sending my letter to my Office
without submitting the above or any other information,
the choice of improper performance is clearly demonstrated and
of non-cooperation with my Office in which your clients were
obliged to proceed, in the exercise of my duties.
34. After evaluating the information I have before me I find out
that there is a prima facie violation of Articles 5, 6 (1), 9 (1) and 31 thereof
Regulation (EU) 2016/679 and Article 33 (1) (b), (l), (m) of the Law
125 (Ι) / 2018. »
31. Regarding the reference of the Defendant's lawyer in his letter
dated 21 September 2020, as referred to in paragraph 15.1.1. of
present, that he is unable to grasp the legal meaning and interpretation of the term “it seems
that there was ... »a violation of the provisions of the Rules of Procedure, as well as in his question, whether
that is, there may not have been an infringement, and why its customers are called, then
submit their posts and comments, I have to remind him that with the
This letter is updated on the basis of the information previously provided
before me, that there is a violation of specific provisions of the Rules of Procedure and
16 of Law 125 (I) / 2018, and before my final decision is made, it is given an opportunity
as heard, since its customers may be affected by the issue
administrative act, submitting comments and positions to mitigate any
ratification. In addition to the above, by evaluating the positions and answers, the
which he was called upon to give, it would eventually be deemed a possible breach of its provisions
Regulation and Law 125 (I) / 2018, as well as the enforcement of the corresponding, under
circumstances, administrative sanction.
32. Defendant's lawyer comments on specific points, such as these
are presented in paragraphs 15.1.2. and 15.1.4. of this, delay
actions of my Office. I must, however, point out to him that even if there was
any delay, in no case did it adversely affect him and
its customers. Especially for the appointment document that he was asked to send from
new and in which there is clearly the seal of the Association it represents
and indicate the name and capacity of the person signing it,
it was something he had to take care of from the beginning and dutifully
write correctly.
33. I must point out that during the restrictive measures due
of the COVID-19 pandemic, my Office was in continuous and uninterrupted operation.
34. Regarding the reference of the Defendant's lawyer in his letter
dated 21 September 2020, as presented in paragraph 15.1.7.,
that neither findings are legally and factually presented nor the manner
implementation and evaluation in relation to the case, I emphasize that the analysis and
documentation contained in my letter dated 18 June 2020, emerged
based on all that data I had at my disposal up to that point. Or not
his response and the non-submission of the Defendant's positions resulted in the
specific analysis and documentation. Moreover, pursuant to Article 5 (2) thereof
Regulation, “The controller is responsible and is able to prove
compliance with paragraph 1 ("accountability") ".
35. In the letter of the Defendant's lawyer, dated 21 September 2020,
he states that they were not implemented in any way or in any way
following:
"The right to be heard by the 'accused'"
Both with my letter dated 02 January 2020 and with the letter
dated 18 June 2020, the Defendant was granted the right to be heard.
After all, the defendant's lawyer himself admitted in his letter dated
September 21, 2020, that its customers are invited to submit positions and
their comments.
"The citation of the evaluation and its justification in relation to any
Findings of the Judge »
The evaluation and the justification are included in Part C. At first sight
Commissioner's assessment (reasoning) of my letter of 18 June 2020
to the Defendant. I repeat, as above, that analysis and documentation
presented, arose on the basis of all that information to me
were listed and I had, until that moment, at my disposal.
17 "The caution of the" accused "about the existence of a procedure
against him"
This information is evidenced by my letter dated 02 January
2020. The Defendant's no or no timely response, in no case
annuls his act of briefing, which I have duly proceeded with.
"The caution of the" accused "about the possibility of a trial
of the case in his absence "
My letter dated 02 January 2020, but mainly my letter
dated 18 June 2020, requesting the positions and comments of the Defendant
before taking a decision on the possible imposition of an administrative sanction,
prove that there is no possibility of a trial in his absence
"Accused", since the Defendant was properly informed about the case and
was invited to submit his positions. The option of not submitting the positions of Prof.
which, in any case, is not meant as a "trial of the case in his absence".
On the basis of my explanations, as set out above, it follows that
none of the specific positions of the Defendant are substantiated.
36. In my Office letter dated 02 January 2020, the
Articles of Association and any Regulations governing the operation of the Association. Also,
Defendant was asked to clarify whether the practice of his profession
motor appraiser presupposes registration in the Association, and, if not, to
indicates the number of members of the Association, as well as its number, or estimate
number of appraisers of motor vehicles that do not belong to the Association, as well as
provide any other information or documents it deems necessary for
investigation of the complaint. I consider that the submission of the requested documents required
minimal or insignificant burden, while I consider, at the same time, that the above elements or
information was known to the Defendant, and therefore easily accessible and
available for submission, therefore in no case is it substantiated that it was
which is "objectively impossible", as the defendant's lawyer claims in
letter dated 21 September 2020, if we also take into account that in
This period included 19 working days after the Epiphany holiday.
37. The initial deadline as well as the three extensions of submission of the requested
of my Office letter dated 02 January 2020, ie the
Dates 31 January 2020, 14 February 2020, 25 February 2020 and 08
March 2020, which had been granted to the Defendant and his lawyer,
expired without any evidence being submitted, and without taking place
information or contact my Office for non-submission. Therefore,
it appears that the above, given the given conditions and circumstances, were
inconsistent and atypical with regard to anything they should do about
the case. I can not understand the reason or reasons that his lawyer
As he considers the opposite, in his letter dated 21 September 2020.
In addition, the report of the Defendant's lawyer "in the midst of his pandemic
Koronoviou "is considered, if nothing else, very unfortunate, since the first case in Cyprus
was announced on 09 March 2020, ie after the expiration of the third
extension granted to Defendant.
1837.1. As above, as I mentioned in my letter to his lawyer
Defendant, dated June 18, 2020, proves the choice of non-return
and non-cooperation with my Office in which clients
they were obliged to carry out, in the exercise of my duties.
38. Regarding the reference of the Defendant's lawyer in his letter
dated 21 September 2020, that “cases of this nature are dealt with
as "quasi-criminal cases", I would like to emphasize that the Commissioner for Protection
Personal Data is an independent administrative authority and the
procedure followed in the investigation and handling of complaints
submitted by the data subject or by a body or organization or association
in accordance with Article 80 of the Rules of Procedure, obeys the General Administrative Principles
Law.
39. In fact, by the letter of the Defendant's lawyer dated 21
September 2020, Defendant has not exhausted or responded to all of them
questions I asked in my letter dated 02 January 2020. Specifically, no
has been placed on the legal or legal basis of the processing act which
falls within my responsibilities, ie the disclosure of his dismissal / deletion
complaining to insurance companies. Relevant is the following excerpt, from
the response of the Defendant's lawyer dated 21 September 2020, and the
which is presented in paragraph 15.1.9 of the present: “No form
intention appears from the facts to have been inherent in either his actions in general
Association or the President personally. "
39.1. With the above statement, the Defendant acknowledges that the
specific act of processing disclosure of its elimination / deletion
complaining to insurance companies, and makes intent as an ingredient
element of a breach of personal data. However, it is not possible
acceptable to substantiate the non-existence of a breach, this statement.
40. The Statute of the Defendant, as well as the Code of Professionalism
Ethics, are binding documents for all members of the Association. There is,
also, the clear reference of the Articles of Association to the Professional Code
Ethics, since under Article 8 - Obligations of members and discipline, members
of the Defendant must comply with the Code of Ethics adopted by
General Assembly of the Defendant. In addition, the Code of Professional Conduct,
states that “The following terms bind, oblige and govern the professional
behavior of members of motor appraisers ".
41. By virtue of its Associations and Institutions and for Other Related Issues
Law of 2017, Law 104 (I) / 2017, article 12 (3), “Expulsion of a member is allowed on
cases provided for in the articles of association, as well as in the case in which
the member, in all his conduct, acts or omissions, brings or
causes humiliation or reduction of the credibility or prestige of the association or other damage
in his interests ".
42.1. The Statute of the Defendant, article 8, provides that “A member may
dismissed repeatedly and despite warnings from the Executive Committee
19 behaves inappropriately or violates the purposes of the Association or them
Ethics Regulation or the provisions of these Articles of Association ".
42.2. The Code of Professional Ethics of the Defendant provides that “10) The
The board of directors of the association will be the competent body that will determine whether the
professional code was not observed by a member or members and will have the power to
decide as the case may be until the expulsion of the member or members ".
Also relevant is Article 8 of the Code of Professional Ethics of the Defendant,
"8) The member must always behave in a way that does not expose or
offends the association, the other members or its position as a member ", after
based on this article, as mentioned in the letter of the Chairman of the Board. of
Association to the members of the Association, dated XXXXXX 2018, will be
Defendant is forced to expel members.
42.3. After a thorough study of the Articles of Association and the Professional Code
Ethics of the Defendant, it can be concluded that it does not exist
any article or provision which provides for the disclosure of the decision
expulsion / deletion of Defendant members in insurance companies or in general in
third parties.
43. In the letter of the Defendant to its members, dated XXXXXX 2018,
The following excerpt is included, which I quote as is:
"To achieve our goal which is the recognition of the Association for
the legal regulation by the state, of the scientific and professional
branch of Mechanical Appraisers of Motorcycles as independent
scientific and professional class, we have prepared a strategy, to
promotion of a bill recognizing the Pancyprian Association
Motor Appraisers, as the Competent Authority, which regulates the qualifications
of the appraiser and extend the issuance of his license
profession.
At the same time and in relation to the draft law, we implemented a program
training of the mechanical assessor for its preparation
written examination that will be organized by PSEM for the issuance of the professional
Certificate of the Mechanical Appraiser ".
44. Bearing in mind that:
- Defendant never denied the data processing act
personal nature of the complainant, ie its disclosure
expulsion / deletion of the complainant to the insurance companies,
- the existence of intent is not a component of a breach
personal data, but, on the contrary, is an element which
taken into account when measuring administrative sanction,
- the Defendant failed to document and / or prove the lawfulness of the relevant
processing operation,
20as well as the following, which possibly and under certain conditions to
justified the processing operation in question:
on the basis of the relevant documents before me, and more
in particular the Statute and the Code of Professional Ethics of the Defendant,
as well as the letter of dismissal of the complainant from the Association
date XXXXXX 2019, the fulfillment of any condition is not demonstrated
pursuant to Rules 6 and 9 of the Rules of Procedure, on the basis of which it could
the legality of the processing operation in question is established,
- the profession represented by the Defendant is not institutionalized and
legally guaranteed,
- Defendant is not an established supervisory authority,
it appears that the disclosure of the expulsion / deletion of the complainant on
insurance companies is not based on, nor has a legal basis in the provisions of Article
6 (1), or for specific categories of Rule 9 (1) of the Rules of Procedure, and therefore Prof.
has violated the principle of legality of Article 5 (1) (a) of the Rules of Procedure.
45. Considering that:
- the Defendant was granted three extensions of submission of the requested
data,
- the Defendant and / or his lawyer did not, during that time,
submitted any information, nor did they update or contact
my Office for non-submission of requested information,
- the questions I asked in the letter were not answered in full
dated 02 January 2020,
- the lack of complexity and the possession of the requested data do not
justified any delay or request for extension, and
- the defendant's lawyer insisted on his and the defendant's consistency,
evidence of lack of appropriate cooperation with my Office for the exercise
of my duties as provided for in Rule 31 of the Rules of Procedure.
F. Conclusion
46.1. Exercising the duties conferred on me by the provisions of Article 57 (1) (f)
of the Regulation: “Without prejudice to the other duties set out in
this Regulation, each supervisory authority in its territory: f) handles complaints
submitted by the data subject or by a body or organization or
association in accordance with Article 80 and shall, to the extent appropriate, investigate the subject matter
of the complaint and informs the complainant of the progress and the outcome
research within a reasonable time, especially if further research is required
or coordination with another supervisory authority, "
46.2. after considering and evaluating the Defendant's allegations,
46.3. appreciating and evaluating positively:
- the Defendant's initiatives for professional institutionalization / law
establishing, and assuming the role of supervisory authority,
21 - the fact that it has not been brought before me before
complaint / complaint and / or infringement found against the Defendant,
46.4. after finding that the Defendant had violated Articles 5 (1) (a), 6 (1), 9 (1) and 31
of the Rules of Procedure, in accordance with paragraphs 44 and 45 hereof,
and
46.5. exercising the corrective powers conferred on me by Article 58 (2) (a) and (b)
of the Regulation, according to which: “Each control authority has all the following
corrective powers: (a) issue warnings to the controller; or
to the processor that intended processing operations are possible
infringe the provisions of this Regulation; (b) reprimand him
controller or processor when processing operations
have violated the provisions of this Regulation "
46.6. I decided,
in my judgment and subject to the above provisions, to address:
a. Reprimand to the Defendant as from now on
related processing operations which have no legal basis and / or do not
comply with the principle of legality, and
b. Warning to the Defendant as from now on
all necessary actions and responds promptly and with due diligence to
requests to facilitate the exercise of the Regulation and Law 125 (I) / 2018
my duties, powers and responsibilities, keeping in mind that you are relevant
behaviors on his part will no longer be accepted.
Irini Loizidou Nikolaidou
Commissioner for Protection
Personal Data Nicosia, March 04, 2021
22
