ΔΔΚ - 688/2022
From GDPRhub
| ΔΔΚ - 688/2022 | |
|---|---|
 | |
| Court: | ΔΔΚ (Cyprus) |
| Jurisdiction: | Cyprus |
| Relevant Law: | Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 5(1)(d) GDPR Article 85 GDPR |
| Decided: | 26.05.2026 |
| Published: | |
| Parties: | Ekdotikos Oikos Dias Dimosia Ltd Commissioner for Personal Data Protection |
| National Case Number/Name: | 688/2022 |
| European Case Law Identifier: | |
| Appeal from: | Commissioner (Cyprus) 4/2/2022 |
| Appeal to: | Unknown |
| Original Language(s): | Greek |
| Original Source: | CYLAW (in Greek) |
| Initial Contributor: | ds |
A court upheld a €10,000 fine against a media company over a TV report disclosing a public figure’s financial data, finding that the media company failed to properly balance its journalistic interest with data protection rights.
English Summary
Facts
On 13 March 2019, Sigma, a Cypriot TV channel operated within DIAS Media Group (ΕΚΔΟΤΙΚΟΣ ΟΙΚΟΣ ΔΗΜΟΣΙΑ ΔΙΑΣ ΛΙΜΙΤΕΔ), published a report disclosing financial information concerning a public figure in Cyprus (the data subject). The DPA treated DIAS Media Group as the controller responsible for the publication. The report formed part of coverage on whether there had been favourable treatment of a politically exposed person.
On 15 April 2019, the data subject lodged a complaint with the Cypriot DPA concerning the disclosure of their financial personal data by Sigma and other media outlets belonging to the controller’s group.
The DPA found that the controller had failed to properly balance the journalistic interest in publication against the data subject’s rights to privacy and data protection. In particular, the DPA considered that the controller had failed to demonstrate that it had taken into account certain balancing criteria, including whether the processing was carried out exclusively for journalistic purposes, whether it was strictly necessary to ensure the right to information on matters of public interest, whether the information was accurate and truthful, and whether there had been prior contact with the data subject.
The DPA held that, by publishing information concerning the data subject’s financial situation, the controller had infringed the principles of lawfulness, fairness and transparency, data minimisation and accuracy. Therefore, it found that the controller infringed Article 5(1)(a) GDPR, Article 5(1)(c) GDPR and Article 5(1)(d) GDPR.
Accordingly, the DPA fined the controller €10,000 and ordered it to remove the publication from the websites of all entities controlled by it within one week.
The controller challenged the decision before the Administrative Court of Cyprus. It argued, among other things, that the DPA had violated its right to freedom of expression and its exercise of journalistic freedom under Article 85 GDPR.
Holding
The court found that the DPA had not violated the controller’s freedom of expression or journalistic freedom. It determined that the DPA had examined whether the controller had exceeded what was necessary for the journalistic purpose pursued. The court held that the DPA had sufficiently explained how journalistic freedom must be balanced against the principle of proportionality. It confirmed the DPA’s conclusion that the controller had failed to carry out properly that balancing.
The court dismissed the appeal and upheld the DPA’s decision. It also awarded €2,000 in costs against the controller.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
CYPRUS BAR ASSOCIATION
Search - List of Administrative Court Decisions - Display Reports (Noteup on) - Remove Underlining
ADMINISTRATIVE COURT
(Case No. 688/2022)
26 May 2026
[MICHAEL, D/at D.D.]
DIAS PUBLISHING HOUSE LIMITED
Applicant
v.
OF THE REPUBLIC OF CYPRUS, THROUGH THE PERSONAL DATA PROTECTION COMMISSIONER
In whose name the Application
..........
S. A. Angelides for Andreas S. Angelides D.E.P.E., for the applicant.
Th. Piperi - Christodoulou (Ms.) for Attorney General, for the defendant in the application.
DECISION
MICHAEL, D.D.D.: The applicant, with the present appeal, requests the annulment of the decision of the defendant in the application dated 4.2.2022, by which it ruled that the applicant violated Articles 5(1)(a), (c) and (d) of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the "General Regulation") and imposed on the applicant an administrative fine of €10,000.
On 15.4.2019, a person submitted a written complaint to the respondent regarding the publication of personal data by mass media belonging to the applicant's group. By letter dated 28.5.2019, the respondent requested the applicant to submit its positions, which it did by letter dated 28.6.2019. This was followed on 24.5.2021 by the issuance of a decision by which the respondent concluded that the General Regulation had been violated and invited the applicant to submit any mitigating factors so that an administrative fine would not be imposed on her. The applicant responded on 17.6.2021 and on 4.2.2022, the respondent issued the decision contested in the present appeal.
The applicant suggests that the contested decision is flawed because the applicant is not the legally responsible party but other legal entities are responsible, because her right to a prior hearing was violated due to the fact that she was never notified of the text of the complaint, because the amount of the administrative fine is not justified, because the right to freedom of expression and the exercise of journalism protected by Article 85 of EC 679/2016 is violated and due to the lack of proper investigation and justification.
The defendant in the application in its letter to the applicant dated 28.5.2019 recorded the following:
“3.1 According to the information that the complainant presented before me in a SIGMALIVE publication dated 13/3/2019 entitled "EXCLUSIVE: New names of politically exposed persons come to light, signed by Kyriakos Penindaex", and a relevant video excerpt from the "sections on the facts" of the SIGMA television station, reference has been made to the following financial data concerning the private sphere of the complainant's activities:
[.]
4. Commissioner's Comment:
4.1 The complainant's status as a public figure is indisputable [.].
4.2 This fact alone does not allow and/or does not justify the collection and processing through the disclosure/publication of information which exclusively concerns and/or is reduced to the private sphere of the activities of the public figure, even if and regardless of whether these acts fall within the framework of freedom of expression and freedom of the press, in the interest of informing public opinion, i.e. for journalistic purposes only.
4.3 The weighing in each specific case must be made for each specific processing between the two conflicting rights, namely freedom of expression and the press including the public's claim to be informed and the public figure's right to the protection of private life and personal data. The principle of balancing is accepted by the settled case law of the Greek courts and the European Court of Human Rights (ECtHR), according to which the media have, under Article 10 of the European Convention on Human Rights (ECHR), a duty to inform the public about cases and issues of general interest and, accordingly, the public has the right to be informed about these issues. Especially when it comes to public figures or issues of public interest, the need to inform the public is more intense. For this reason, the ECtHR recognizes the role of journalists as public watchdogs, i.e. the control function of the Press, which covers its ability to denounce wrongdoings by publishing and publicly criticizing them.
[.]
4.4 In addition to the weighing and reconciling of the two rights, it is commonly accepted both jurisprudentially and institutionally that the press officer must act in good faith and, before the imminent publication of information, is bound and has a duty to proceed to an assessment of the information in question and to ensure that it is reliable and accurate (Code of Journalistic Ethics, para. 1.)
[.]
5. Applicable legislative framework:
5.1 The provisions of article 29(1) of Law No. 125(Ι)/2018 of the Law of 2018 on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of Such Data, which supplements the General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR”), under which:
“29.-(1) The processing of personal data or special categories of personal data or personal data relating to criminal convictions and offences carried out for journalistic or academic purposes or for the purposes of artistic or literary expression is lawful, provided that such purposes are proportionate to the objective pursued and respect the essence of the rights as set out in the Charter of Fundamental Rights of the European Union, in the European Convention on Human Rights and Fundamental Freedoms (ECHR), which has been ratified by the European Convention for the Protection of Human Rights (Ratification) Law, and in Part II of the Constitution.
5.2 In accordance with the provisions of Article 5(1)(a), (c) and (d) of the Regulation, namely the Principles (of lawfulness, proportionality and accuracy) governing the processing of personal data:
“5(1) Personal data:
a) shall be processed lawfully and fairly in a transparent manner in relation to the data subject (“lawfulness, objectivity and transparency”),
[.]
c) shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”),
d) shall be accurate and, where necessary, kept up to date; all reasonable steps shall be taken to ensure that data are promptly erased or saved; personal data which are inaccurate, in relation to the purposes of the processing ("accuracy"),".
6. In light of the above, you are invited to submit your positions and indicate:
6.1 how you have proceeded to weigh the two rights of freedom of expression and of the press against the freedom of privacy and the protection of private life and personal data of the complainant in relation to the criteria set out in paragraph 4.6 of this letter and,
6.2 to take a position on the legislative framework and in particular how you have ensured compliance with the above principles of lawful processing of personal data (see paragraph 5.2)."
In response, the applicant proceeded with an e-mail message dated 28.6.2019. The said message was sent by Mr. K. D. Smaragdakis in his capacity as "Data Protection Officer (DPO), Dias Media Group". The message does not include any reference that the applicant is not the legally responsible party as the applicant suggests in the context of her appeal, therefore, the suggestion is rejected since the application was never brought to the attention of the defendant, with the result that it cannot be raised at this stage (Epavlis Komitis Ltd v. Tender Review Authority (2009) 3 A.A.D. 342).
Nor is the suggestion that the applicant's right to a prior hearing was violated because she was not notified of the full text of the complaint. The defendant's application through her letter to the applicant dated 28.5.2019 raised those points on which it wished to take the applicant's positions, that is, to give her the opportunity to exercise her right to a prior hearing. If the letter of complaint included other references that the respondent in the application did not consider to require a response from the applicant either due to the excessive length of the letter or due to lack of direct relevance, this does not lead to a violation of the right to a prior hearing. The essential thing is which issues from the letter of complaint did the respondent in the application consider to potentially violate the relevant legislation and therefore require investigation and whether the applicant's position on them was requested. Since this was done, the applicant's right to a prior hearing is satisfied. Nor does the Court, in examining the legality of the contested act, extend beyond what was exchanged between the applicant and the respondent in the application.
The The applicant also suggests that the respondent violated the applicant's right to freedom of expression and the exercise of journalism and did not conduct an appropriate investigation and justification. The suggestion is unfounded. As the respondent explains in various parts of its decision, "the subject of judgment by my Office is the control of whether the Respondent, with its actions and/or omissions through the publication of information and data concerning the complainant, exceeded the measure of what was necessary in the sense of what was absolutely necessary to achieve the intended purpose, which as it repeatedly stated was to demonstrate whether or not there was favorable treatment of the PEPs". In this context, the examination of the complaint was initiated and with the justification and explanation given in both parts of the decisions of the respondent, the application, indeed this was the only examination and the findings it reached were reasonable. Neither the journalistic duties and obligations of the applicant are violated in any way, since the respondent in the application explicitly explains in various points, mainly in Part A of the decision, how the journalistic duty is balanced with the principle of proportionality that must be observed in the exercise of the said duty. Based on the analysis that the respondent in the application cites in the two texts of its decisions, I do not see any reason for judicial intervention.
Finally, in relation to the administrative fine, the applicant suggests that it was imposed unjustifiably without taking into account the provisions of the law and without explaining the reason for imposing the specific fine.
The defendant's application in the Decision Part A dated 24.5.2021 records the following in point D entitled "Conclusion":
"In compliance with the analysis and reasoning in the form of Comments in Part B of this, and after having heard the defendant regarding the application of the criteria for weighing the two rights that I set out (see par. 2.4.6 Part A), the observance of these criteria as well as the legislative framework (see par. 2.6 Part A), I have concluded that the defendant, by his acts and/or omissions, processed the data complained of in excess of the basic principles of lawful processing, namely the provisions of Article 5(1)(a), (c) and (d) of the Regulation, which are set out in Part C of this. Based on the evidence before me, the Defendant failed to take into account any of the 6 criteria I had set and/or failed to substantiate and/or prove that he acted in accordance with and/or took into account any of the weighing criteria such as:
"4.6.2 the processing is carried out exclusively for journalistic purposes
4.6.3 the processing is absolutely necessary to ensure the right to information on matters of public interest
4.6.4 the information is accurate and reflects the truth,
4.6.5 prior communication with the complainant".
In light of the above Conclusion, the Respondent is hereby invited by this Decision Part A to, in accordance with the provisions of Article 43 of the General Principles of Administrative Law Law, N,158(I)/1999, exercising the right to a prior hearing, submit within four weeks from the date of receipt of this Decision his positions as well as the reasons and mitigating factors for which he believes that any of the sanctions provided for in the provisions of Article 58 (2)(a), (b), (d), (f) and (i) of the Regulation should not be imposed on him, which are set out in Part C of this Decision.
The powers under Article 58 of the General Regulation as recorded in point C of the above decision are as follows:
«2. Each supervisory authority shall have all of the following corrective powers:
a) to address warnings to the controller or the processor that intended processing operations are likely to infringe provisions of this Regulation,
b) to address reprimands to the controller or the processor where processing operations have infringed provisions of this Regulation,
[.]
d) to order the controller or the processor to bring processing operations into compliance with the provisions of this Regulation, where necessary, in a specific manner and within a specified time limit,
[.]
f) to impose a temporary or definitive restriction, including a ban on processing,
[.]
i) to impose an administrative fine pursuant to Article 83, in addition to or instead of the measures referred to in this paragraph, depending on the circumstances of each individual case,”.
And in the Decision Part B dated 4.2.2022 in point D entitled "Conclusion - Dispositive":
"8. Having taken into account and taken into account -
8.1 My reasoning, reasoning and conclusion in the Decision Part A after hearing the Respondent regarding a possible violation of the provisions of the legislative framework, according to which, the Respondent, by its acts and/or omissions through the publication of data relating to the financial situation of the complainant, processed and acted in excess of the basic principles of lawful processing, namely the principles of lawfulness, objectivity, transparency, the principle of minimization and the principle of accuracy and therefore acted in violation of the relevant provisions of Article 5(1)(a), (c) and (d) of the Regulation,
8.2 My conclusion that the acts and/or omissions of the Respondent demonstrate that it did not in a proper weighing of the criteria of the two rights, freedom of expression and the press and freedom of privacy and protection of private life, since it failed to take into account and/or did not correctly evaluate any of the 6 criteria that I had set and/or failed to substantiate and/or prove that it acted in accordance with and/or took into account any of the weighing criteria such as:
«4.6.2 the processing is carried out exclusively for journalistic purposes
4.6.3 the processing is absolutely necessary to ensure the right to information on matters of public interest
4.6.4 the information is accurate and reflects the truth,
4.6.5 prior communication with the complainant
8.3 The reasoning and reasoning in this Decision Part B', after having heard the Respondent again in general, but and in relation to the possible imposition of administrative sanction(s),
8.4 All the circumstances and factors that the Respondent has put before me based on all the elements of the Case File, and
8.5 The applicable legislative framework and the provisions regarding the administrative sanctions provided for in the provisions of Article 58 (2) (a), (b), (d), (f) and (i), of the Regulation,
9 I consider in the circumstances surrounding the present case as entirely reasonable and justified the imposition of the administrative sanctions provided for in the provisions of Article 58(2)(d) and 58(2)(i) of the Regulation, subject to which:
Each Supervisory Authority shall have the power -
d) to order the controller or processor to bring the processing operations into compliance with the provisions of this Regulation, if necessary, in a specific manner and within a specified period deadline,
and,
i) to impose an administrative fine pursuant to Article 83, in addition to or instead of the measures referred to in this paragraph, depending on the circumstances of each individual case,
AND,
10. I HAVE DECIDED as follows:
Exercising the above powers conferred on me by the provisions of the legislative framework -
I order the Defendant to ensure, within one week of the receipt of this Decision, the removal of the publication from the website of all entities controlled by the Defendant and
I impose on the Defendant, in my judgment, an administrative fine of €10,000 (ten thousand euros), which I consider reasonable and proportionate based on the reasoning and the conclusion of the Decision. (Decision Part A' and Decision Part B')."
The relevant provisions of Article 83 of the General Regulation are as follows:
"1. Each supervisory authority shall ensure that the imposition of administrative fines in accordance with this Article for infringements of this Regulation referred to in paragraphs 4, 5 and 6 is, in each individual case, effective, proportionate and dissuasive.
2. Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to or instead of the measures referred to in Article 58(2)(a) to (h) and Article 58(2)(j). When deciding on the imposition of an administrative fine, as well as on the amount of the administrative fine in each individual case, due account shall be taken of the following:
a) the nature, gravity and duration of the infringement, taking into account the nature, scope or purpose of the processing concerned, as well as the number of data subjects affected by the infringement and the degree of damage suffered by them;
b) the intent or negligence which caused the infringement;
c) any action taken by the controller or processor to mitigate the damage suffered by data subjects;
d) the degree of responsibility of the controller or processor, taking into account the technical and organisational measures implemented pursuant to Articles 25 and 32;
e) any previous relevant infringements by the controller or processor;
f) the degree of cooperation with the supervisory authority in remedying the breach and limiting its possible adverse effects,
(g) the categories of personal data affected by the breach,
(h) the manner in which the supervisory authority became aware of the breach, in particular whether and to what extent the controller or processor notified the breach,
(i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned in relation to the same subject matter, compliance with those measures,
(j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42, and
(k) any other aggravating or mitigating factors arising from the circumstances of the specific case, such as the financial benefits gained or losses avoided, directly or indirectly, as a result of the breach. infringement.
3. Where the controller or processor, in respect of the same or related processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount laid down for the most serious infringement.
[.]
5. Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines of up to EUR 20 000 000 or, in the case of undertakings, up to 4 % of the total worldwide annual turnover of the preceding business year, whichever is higher:
(a) the basic principles for processing, including the conditions applicable to authorisation, in accordance with Articles 5, 6, 7 and 9;
(b) the rights of data subjects in accordance with Articles 12 to 22;
(c) the transfer of personal data to a recipient in a third country or to an international organisation in accordance with Articles 44 to 49;
(d) any obligations under Member State law established pursuant to Chapter IX;
(e) failure to comply with an order or with a temporary or definitive restriction of processing or with a suspension of data flows imposed by the supervisory authority pursuant to Article 58 paragraph 2 or failure to provide access in violation of article 58 paragraph 1.”
In point C of the decision Part B of the defendant’s application, the mitigating factors taken into account as well as the aggravating factors are recorded, both in accordance with the provisions of Article 83. I do not agree with the applicant’s suggestion. Both Part A of the decision of the defendant’s application and Part B are duly explanatory and analytical so that the decision to impose the administrative fine appears reasonable. In relation to its amount, the maximum that can be imposed is expressly provided for in Article 83.5 of the General Regulation, therefore the defendant’s application acted within the framework permitted by the General Regulation.
For the above reasons, I conclude that the appeal fails and is dismissed and the contested decision is upheld. €2,000 in costs are awarded in favour of the defendant and against the applicant.
E. MICHAEL, LLP cylaw.org: From KINOP/CyLii for the Cyprus Bar Association
