Commissioner (Cyprus) - 1.17.001.007.270
|Commissioner (Cyprus) - 1.17.001.007.270|
|Relevant Law:||Article 5(1)(a) GDPR|
Article 6(1) GDPR
Article 9 GDPR
Article 31 GDPR
|Parties:||Cyprus Association of Automotive Engineer Assessors|
|National Case Number/Name:||1.17.001.007.270|
|European Case Law Identifier:||n/a|
|Original Source:||Cypriot DPA (in EL)|
|Initial Contributor:||Florence D'Ath|
The Cypriot DPA imposed a reprimand and a warning on a professional association for having unlawfully processed the personal data of one of its former members, and for failing to cooperate with the DPA in the course of the complaint procedure.
English Summary[edit | edit source]
Facts[edit | edit source]
A data subject (X) was working as a professional assessor for the Pancyprian Association for Automotive Engineers Assessors (hereinafter AAEA). Following the rescission of X's membership, AAEA sent a letter to several insurance companies, informing them of the fact that X was no longer one of their members, without however obtaining the prior consent of X.
X decided to file a complaint with the Cypriot DPA (the 'Commissioner') against AAEA, considering that they should not have shared such information with the concerned insurance companies, and had therefore unlawfully processed his personal data.
After hearing X on the subject, the Commissioner required information from AAEA with respect to the processing of X's personal data. AAEA however did not reply to the Commissioner.
Holding[edit | edit source]
The Commissioner considered that, by sending a letter to insurance companies regarding the rescission of X's membership, AAEA had violated Article 5(1)(a) GDPR, Article 6(1) GDPR and Article 9(1) GDPR. The Commissioner therefore decided to impose a Reprimand on AAEA, as the latter had failed to substantiate and/or prove the lawfulness of the relevant processing act. For reaching this decision, the Commissioner took into account, among others, the fact that compliance by AAEA with its Code of Professional Ethics was not demonstrated, but also the fact that AAEA is not a regulated or institutionalized supervisory authority (cf. there is no Cypriot law specifically regulating the profession of automotive engineer assessors).
The Commissioner also considered that by failing to reply to its requests for information in the course of the procedure, AAEA had not complied with its obligation to cooperate under Article 31 GDPR. The Commissioner stressed that the requested information was not complex, and that AAEA ought to have responded in due time. However, since, in the end, AAEA provided answers to the Commissioner, the Commissioner decided to impose a warning rather than a fine.
Comment[edit | edit source]
Share your comments here!
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
REPUBLIC OF CYPRUS OFFICE OF THE PROTECTION COMMISSIONER PERSONNEL DATA character ΕΠΙΤΡΟΠΟΣ No. Facsimile: 11.17.001.007.270 DECISION Complaint / complaint XXXXXX against Pancyprian Association Motor Appraisers for breach of personal data I am referring to the complaint lodged at my office on 9 December 2019, by the lawyer Mr. XXXXXX of the law firm L. Papafilippou & Co., from part of Mr XXXXX (hereinafter the "complainant") against the Pancyprian Association of Motor Appraisers (hereinafter referred to as "Kath 'ou"), as well as throughout correspondence on the above subject, which is part of its dossier case. The complaint / complaint has a date of December 5, 2019. A. Allegations of the Complainant 2.1. As mentioned in the complaint / complaint, the complainant was a member of the Defendant from XXXXXX 2015. Attached to the complaint, the certificate member of the complainant by that date. On XXXXXX 2018, it was sent letter to the members of the Association, signed by the chairman of the Board. of Association, Mr. XXXXXX, stating among other things that under Article 8 of the Code Ethics of the Association, the Board is forced to "expel" from the Association of people who charge low for their services, noting that: "He who charges so low gives the right to be doubted his honesty and integrity, because as they say, he who works in his damage, he takes them from somewhere else. This attitude colleagues offends the association and the rest members and for this we will be forced as a council, based on the article 8 of the code of conduct to remove them from the link. Therefore, please comply and show the necessary seriousness if we want to maintain a respectful image of the link us". Jason 1, floor, 1082 NICOSIA / PO Box 23378, 1682 NICOSIA. Tel: 22818456, Fax: 22304565 E-mail: email@example.com, Website: http: //www.dataprotection.gov.cy2.2. The complainant alleges the above, in conjunction with the letter of the Board of the Association dated XXXXXX 2019 to the insurance companies, in which refers to the deletion of the complainant by the Association, violate the personal data of a personal nature, and in particular his membership in an association and linking it to alleged illegal activities. The letter which was attached to the complaint lodged with my Office, states, among others, that the BoD of the Association would like to emphasize, once again, that it will Qualified appraisers of the association must be appointed, for proper professional approach and safe repair of the vehicles involved in an accident, where fair compensation and protection are ensured interests of these companies. By the way, I note that, in this letter, the insurance companies are informed about the deletion of two more members of the Defendant, while it is also stated that any relationship or connection is strictly forbidden with the link. 2.3. In the complaint, the complainant's lawyer also states that his client, up to that time, had not received any letter or any information about his alleged deletion, but also the reasons for them which has allegedly been deleted. He also states that, with his instructions the complainant has addressed a letter to the Defendant. This letter is attached to the complaint. I also note that this letter, from the complainant's lawyer to Defendant, dated 02 December 2019, was notified to my Office on 03 December 2019, via fax. In this letter, his lawyer the complainant states that it considers it completely unacceptable and inadmissible report on the deletion of the complainant, in the Defendant's letter to insurance companies, dated XXXXXX 2019, and that this action constitutes libel, defamation and harmful pseudology. B. Intermediate Actions 3.1. On January 2, 2020, I emailed him Chairman of the Board of the Association, at its e-mail address Liaison Office, with which the Defendant was informed of this complaint and was summoned, as of 31 January 2020, submit specific documents, data and information. More specifically in paragraph 4 of the attached file, it was requested as, until the above date, the Statute of the Association is sent, as well and Regulations, if any, governing the operation of the Association, be clarified whether the practice of the profession of motor appraiser presupposes the registration in the Association, and, if not, indicate the number of members of the Association, as well as the number, or estimate of, number of motor appraisers who do not belong to the Association. It was also requested that any others be provided information or documents are considered necessary to investigate the complaint. 3.2. Despite the fact that the Defendant had to submit the requested information by on the above date, did not take any action, not even in communication or update my office. 24. On 04 February 2020, an Office Officer contacted me by phone with the Chairman of the Board of the Association, and after informing him about complaint, granted extension of implementation of the requested until 14 February 2020. 5.1. On 07 February 2020, the Defendant's lawyer, Mr XXXXXX, summoned by phone to my Office, leaving his contact details. The same day contacted him, by phone, Officer of my Office. When communicating, Defendant's lawyer informed that it operates on behalf of the Association and that it will there is an attempt to reconcile with the complainant. At his request, a new extension was granted until 25 February 2020. 5.2. This deadline expired without action, without the submission of the requested information or contact or update my Office. 6.1. On February 27, 2020, an Officer of my Office tried to contact the Defender's lawyer by telephone, without success. 6.2. The same Officer contacted the Defendant's lawyer again by telephone on 28 February 2020. And the lawyer informed again about attempt to reconcile with the complainant. The Officer stated that The complainant's lawyer asked, a few days before, to be informed of the actions and investigations carried out until then by my Office, without leaving no suspicion of the existence or knowledge of an attempt at reconciliation. Then, the Defendant's lawyer stated that the Association had met the previous day evening, and that the reconciliation effort would take place next week and as a result an extension was requested for another week. Based on the above, was given cm exclusive time limit for replying and submitting the requested information until 08 March 2020. 6.3. Despite the fact that the submission deadline had passed, the Defendant did not submit the requested information, nor contacted or informed my Office. 7.1 On 25 February 2020, the complainant 's lawyer requested through to be informed of the actions and / or investigations I have carried out on the complaint. 7.2 On March 3, 2020, I sent an email to his lawyer complainant, by which I informed him that, after the initial investigation that conducted by my Office, I have requested specific information and information from Defendant, who has a deadline for their submission, March 08, 2020. 8. On May 6, 2020, an Office Officer contacted me by telephone the vice president and the secretary of the Board of the Association, Mr. XXXXXX and Mr. XXXXXX respectively, to find out who are legally responsible for receipt correspondence of the Association. 9.1. On the same day, May 6, 2020, the Defendant's lawyer contacted by phone with my Office. When communicating with an Office Officer, his was requested to send an appointment document under the Pancyprian Association 3Value Engineers and indicate who are on behalf of the Association against legally responsible for receiving mail. 9.2 On May 12, 2020, an Office Officer contacted me at Defendant's lawyer, following a voice message the latter left in the Office on May 6, 2020. During the conversation, the lawyer stated that he would send the appointment document the same or the next day, and that, as informed by Defendant, legally responsible for receiving correspondence of the Association is the president, vice president and secretary of the Association. Also after relevant question, he was given general procedural information concerning the first face decisions. 9.3 On the same day, 12 May 2020, the Defendant's lawyer sent the document of appointment of a lawyer under the Pancyprian Association Motor Appraisers. He also informed in his email that like informed, competent persons to receive correspondence, is the president, the vice-president and the secretary of the Defendant. 9.4 Due to the fact that the above-mentioned appointment did not have the stamp of the Association, nor was the name and status of the person signing ex part of the Association, by e-mail of the Office dated 25 May 2020, was requested by the Defendant's lawyer to resubmit an appointment document, which includes the above. 9.5 On 05 June 2020, an e-mail was sent to the lawyer of Prof. by which an exclusive deadline was granted until 10 June 2020 for satisfaction of the above. 9.6 On 09 June 2020, the Defendant's lawyer resubmitted the appointment document bearing the seal of the Association. Also on his electronic There was a message stating that the appointment was signed by Mr XXXXXX and Mr. XXXXXX, Vice President and Secretary, respectively, of the Defendant. 10. On 22 June 2020, he was handed over to the defendant's lawyer at first sight decision of 18 June 2020, after I found that it exists at first sight infringement of Articles 5, 6 (1), 9 (1) and 31 of Regulation (EU) 2016/679 and Article 33 (1) (b), (l), (m) of Law 125 (I) / 2018. My ex-appraisal (reasoning) is set out in paragraph 35 hereof. 10.1. Also, before making a decision on possible enforcement of the administrative fine, the lawyer of the Defendant was summoned as he submits, within six weeks after the final decision, their comments and positions its clients in relation to the above-mentioned infringements mentioned above Regulation and Law 125 (I) / 2018, as well as any other comments or positions of his clients on the case. 11.1 The complainant's lawyer requested, by email, a date 06 May 2020, as informed of my position on the complaint. 411.2 On 03 July 2020, the complainant's lawyer was informed that he has a preliminary ruling is given against the Defendant for breach of the Rules of Procedure (EU) 2016/679 and Law 125 (I) / 2018. 11.3 On 06 July 2020, the complainant's lawyer called in my Office leaving his details. On the same day, Office Officer , called the aforementioned, who asked to be informed of what it means decision at first sight, and he was given the appropriate clarifications. 12. On 02 July 2020, the Defendant's lawyer sent an e-mail requesting that full copies of the case file be provided, in order, as he mentioned, on the one hand to be able to advise his clients accordingly and on the other hand to submit the comments and positions of its customers. 12.1. The defendant's lawyer, on July 9, 2020, informed that the copies of the case file would be received by Mrs XXXXX, a lawyer at the his office. 12.2. Indeed, on the same day, the aforementioned received those documents at inspection framework of the administrative file of the case. 13.1. On 24 July 2020, the Defender's lawyer submitted, by e-mail, questions to my Office. In particular, he asked how of the complainant, as well as whether the positions of his clients should to be submitted in writing or orally. If the written citation of the positions was required and comments of the Defendant, due to workload and for personal reasons, was requested an extension of six weeks for the submission of applications, and as he stated, at least until mid-September. 13.2. On July 28, 2020, I sent a letter to the Defendant's lawyer, to answer to the questions he submitted on 24 July 2020. I informed him that as Administrative Body I exercise my duties by issuing executive administrative acts through a written procedure, and therefore there is no right of reconsideration of the complainant under this procedure. I also informed him that reserves the right to rebut allegations in writing if something like this was asked of him. In addition to the above, I quoted his article 43 (4) on his General Principles Administrative Law of 1999, Law 158 (I) / 1999, based on which, the comments and His clients' positions on the case could be submitted either orally or in writing. I pointed out, however, that it is preferable for them to be submitted in writing, taking into account the particular circumstances of the COVID-19 pandemic. As long as concerns the extension requested for reply, in case the written citation of his comments, he was granted an extension of two weeks, ie until 17 August 2020, after taking into account the large time frame given to him had already been given. 14.1. On August 17, 2020, the last date on which it was due Defendant's lawyer to submit his views and comments at first sight my decision, the aforementioned visited my Office. He called 5 by telephone the complainant's lawyer, and a call was made to open hearing, ie with the simultaneous participation of both lawyers. During the In this call, the complainant's lawyer did not object to its extension during the reply period by the Defendant's lawyer, which I accepted. It was requested by the defendant's lawyer, as he also sent in writing the request for extension. 14.2. On the same day, the Defendant's lawyer sent an e-mail to my Office, by notifying the complainant's lawyer, to which stated that discussions were taking place on the substance of the matter between the parties and there is a high probability of an "out-of-court" settlement of the case. It was requested extension of its reply deadline until 21 September 2020. 14.3. The same day, I sent an e-mail to the Defender's lawyer, with notification to the complainant's lawyer, which I granted to first the requested extension, ie extension until 21 September 2020. C. Defendant's allegations 15. On September 21, 2020, the Chairman of the Board of the Defendant presented to My office, the answer of the Defendant's lawyer. 15.1. In his letter, the defendant's lawyer stated that: 15.1.1. Unable to grasp the legal meaning and interpretation of the term “seems to there was ... »violation of the provisions of the Rules of Procedure. He wondered if he could and that there was no infringement, and why his clients are then called upon to submit them posts and their comments. I note that the Defender's lawyer refers to my letter to him, dated 18 June 2020, in which I stated that “with Based on the evidence before me, it appears that there was, at first sight, infringement of the provisions of Regulation (EU) 2016/679 (...) ". 15.1.2. In his view, three important questions arise: - Why it was needed XXXXXX from the letter of the President of the Defendant, date XXXXXX 2018, in order to "offend" the complainant and proceed to his complaint? - Because it took XXXXXX months from the letter of the Association to insurance companies, dated XXXXXX 2019, in order to "affect" the complainant and to make the complaint? - Because my office took almost a month to inform its customers about the complainant's complaint? 15.1.3. The letter of the president of the Defendant to the members of the Association, dated XXXXXX 2018, bears the form of informing the members of the Association about the General Assembly that preceded, in XXXXXX 2018, refers to a plethora issues, consumes a few lines towards the end on the issue in question and finally is signed only by the president of the Association. 615.1.4. The time frame I set in my letter dated 02 January 2020, to the Defendant, for reply by 31 January 2020, and in fact, as he mentions, during the holiday season for Christmas and New Year's Eve is an "objectively impossible" thing. Also, that the above is incompatible with the not-so-immediate response, as he states, of my Office, since, for example, it took 13 days for him to be asked to send re-appointment document with specific details. 15.1.5. Through the calendar data quoted in my letter dated 18 June 2020, is attributed to its customers, as it states, a form of inconsistency and / or obstruction. He points out that from these same calendars evidence, it turns out the exact opposite, that is, that his customers and himself, given the given conditions and circumstances, were completely consistent and formal in relation to anything they should do about the case. Except, as he mentions, if one would expect that in the middle of the New Year holidays initially and most importantly "in the middle of the Coronavirus pandemic" afterwards, will set the complainant's complaint and submission as the highest priority of the requested information in my Office. He also wonders if my Office it worked, and if so, if it performed such work, from the moment they Courts suspended their work. For this reason, please be informed about the manner and the days and hours of operation of my Office for the time period January - May 2020. 15.1.6. It is my position that my conclusion about existence at first sight violation of the Regulation and Law 125 (I) / 2018, is based mainly on erroneous, as he states with all due respect, a finding of 'non-performance of due importance and non-cooperation "on the part of its customers. For the reason this, submits that the above is not correct and should be revoked and / or revoked. 15.1.7. The question arises, as he states, about how his provisions Regulation and Law 125 (I) / 2018, which I quoted in my letter to on the same date 18 June 2020, were applied in the case, and also sets the question about what the relevant findings are legal and real. Submits, yet, the position that neither findings are legally and factually cited nor how to apply and evaluate them in relation to the case. 15.1.8. The right to be heard by the "accused", the citation of the evaluation and its justification in relation to any findings of the defendant, the information (caution) of the "accused" about the existence of proceedings against him and the informing (caution) of the "accused" about the possibility of her trial in his absence, are, as he states, its cornerstones administration of justice. It has also been emphasized that the above is well-established underlined in without exaggeration thousands of decisions over time. He is of the opinion that the above did not happen in any way or in any way implementation. In addition, it states that its importance and criticality are understood proper application of the above principles, given that cases of this nature treated as "quasi-criminal cases". 715.1.9. It raises the question, whether what the complainant attributes to them his clients, constitute a violation of the Regulation and Law 125 (I) / 2018, meeting first the conditions required and secondly the components of any alleged breach. It also states that having Deep down the case, he undoubtedly answers "no" to the above questions. I quote the data as it is, as he states, on which he bases his opinion: "A) No form of intention appears from the facts to have existed in the en generates actions of either the Association or the President personally. B) There is no connection or connection between the two letters namely the President of the Association day XXXXXX 2018 and the Association day. XXXXXX 2019. C) Between the above two letters, there is a time difference XXXXXX months, so that the complainant's claim that the combination of these two letters, violates in any way "the personal data and in particular his participation in association and its connection with illegal actions ". D) None in the letter of the Association dated. XXXXXX 2019 reference is made in the letter of the President dated XXXXXX 2018 nor is it related to it, moreover, these two letters are completely different from each other content. E) The Complainant received official knowledge of his expulsion (and no deletion) by relevant letter dated XXXXXX 2019 after it preceded meeting with the Board of Directors of the Association. F) The conclusion that the Complainant himself comes to through combination of the two letters in question is unfounded and arbitrary, and lacks any legal or factual basis. G) In the same complaint of the Complainant dated. XXXXXX 2019, which took place by letter of his lawyer it is clear that the The complainant is possessed by a sense of revenge against the Association. Specifically, the Complainant refers to paragraph 6 thereof letter / complaint: "With the above and in combination with the letter dated. XXXXXX 2019 essentially our client is photographed as the person making it in illegal and / or dishonest acts. Note that it is known to members of the Board of Directors of that Association that our client mostly cooperates with a specific insurance company, the General Insurance of Cyprus, providing appraiser services after award to him which he submitted to the group of the Bank of Cyprus. The members of the Board of the Association and in particular o President of this cooperate themselves with this insurance company company." In other words, the Complainant points out that the Board of Directors hastened of the Association deleted him for vested interests. From her and only the thought of the Complainant I respectfully submit that they appear his other motives and aspirations ". 815.1.10. Takes the position that all the data that make up the present case, lead effortlessly to the conclusion that no infringement was committed by his customers and that, in any event, the present case does not ultimately fall with the whole respect, as it states, for my responsibilities and powers as defined and are delimited in the Regulation and in Law 125 (I) / 2018. 15.1.11. It conveys the assurance of its customers about the sense of legitimacy that distinguished them and distinguishes them, their unwillingness to hurt in any way the prestige, reputation and character of anyone and their disposition and intention, in order to avoid such issues. 15.2. The Defendant's lawyer's letter contained his Statute Association, the Code of Professional Ethics, the application for membership of the complainant dated XXXXXXX 2015, the letter of approval of the complainant for admission to the Association dated ΧΧΧΧΧ 2015, his expulsion letter complained by the Association date XXXXXX 2019, as well as receipt registered mail to the complainant dated XXXXXX 2019. 15.2.1. According to the Statute of the Defendant, article 2 - Aims, point 5, its purpose Association is "As it takes any measure and proceeds to anyone The link to be promoted, promoted and protected was deemed appropriate the scientific and professional interests of its members ". Pursuant to Article 8 of the Articles of Association - Obligations of members and discipline: "A. The members of the Association are expected to behave with decency and generally with their action and participation in the events of the Association to serve and promote its purposes. They also have to comply with the Code of Conduct to be adopted by the General Meeting. B. A member may be expelled if repeatedly and in spite of warnings of the Executive Committee behave improperly or violates the purposes of the Association or the Code of Conduct or of the provisions of these Articles of Association. (...) ». 15.2.2. The Code of Professional Ethics, which states that “The following terms bind, oblige and govern the professional conduct of members of motor appraisers ", including, inter alia, the following provisions: "8) The member must always behave in a way that does not expose or offends the association, the other members or its position as a member ". "10) The board of directors of the association will be the competent body that will determine whether the professional code has not been complied with by a member or members and will have the power to decide as the case may be until expulsion of the member or members ". 915.2.3. In the letter of approval of the complainant for admission to the Association dated XXXXXX 2015, includes the following: “We consider it necessary to you we mention and draw your attention that our link is bound by code of professional conduct and you will be asked to subscribe to it relevant form ". 15.2.4. In the letter of expulsion of the date complained by the Association XXXXXX 2019, the following excerpt is included: "It is with great sadness that we contact you today to express ourselves to you our frustration regarding your obligations to the Association. Despite repeated efforts and after personal contact and meeting with the board however you have not proceeded to necessary actions resulting in a conflict of conditions the statute and the code of professional conduct. We are obliged, based on the statute, to expel you from the link. "Membership obligations and discipline" »Article 8» We kindly ask you to remove from the reports from now on expertise that you deliver and / or carry out on behalf of any insurance company and / or elsewhere, any item or and logo that connects you with the Pancyprian Association of Appraisers Motorized ". D. Legal framework 16. Pursuant to Rule 5 (1) of the Rules of Procedure concerning the Authorities governing the processing of personal data, such data, inter alia, be processed lawfully and in a transparent manner in relation to the data subject ("legality, objectivity and transparency"). 17. Under the same article, paragraph 2 clarifies that the person responsible is responsible and able to demonstrate compliance with paragraph 1 ("accountability"). 18. In accordance with Article 6 1 1 of the Rules of Procedure, the processing is lawful only if and when at least one of the following applies conditions: (a) the data subject has consented to their processing personal data for one or more specific aims, (b) processing is necessary for the performance of a contract for which the data subject is a Contracting Party or to take action against request of the data subject before concluding a contract, c) processing is necessary to comply with a legal obligation the controller, D) processing is necessary to safeguard its vital interest data subject or other natural person, (e) the processing is necessary for the performance of a task which is carried out in the public interest or in the exercise of public authority assigned to the controller, f) the processing is necessary for the purposes of the law interests pursued by the controller or a third party, unless against their interests prevail over the interests or fundamental rights and freedoms of the data subject enforcing their protection personal data, especially if the data subject is a child. 19. Pursuant to Article 9 (1) of the Rules of Procedure, processing of personal data disclosing racial or ethnic origin, political views, religious or philosophical beliefs or participation in a trade union, as well as genetic processing data, biometric data for the purpose of unmistakable identification data relating to health or data relating to natural sex life or sexual orientation. 20. In the same Article, namely Article 9, paragraph 2 states that previous paragraph does not apply in the following cases: (a) the data subject has given explicit consent to processing of this personal data for one or more for specific purposes, unless the law of the Union or of a Member State so provides . Whereas the prohibition referred to in paragraph 1 may not be lifted by data subject, (b) the processing is necessary for the performance of the obligations and exercise of specific rights of the controller or the subject data in the field of labor law and social security law and social protection, if permitted by Union or State law by collective agreement in accordance with national law providing appropriate guarantees for the fundamental rights and interests of their subject data, c) treatment is necessary to protect the animals interests of the data subject or other natural person, if the data subject is physically or legally incapable of consent, (d) the processing is carried out, with appropriate guarantees, within the framework of legal activities of an institution, organization or other non-profit organization with political, philosophical, religious or trade union goal and provided that the processing concerns only the members or former members of the body or persons who have regular communication with him in relation to his purposes and that the personal data are not disclosed outside this body without the consent of the data subjects, (e) the processing concerns personal data which they hold explicitly disclosed by the data subject, f) processing is necessary for the foundation, exercise or support legal claims or when the courts act in their jurisdiction, g) the processing is necessary for reasons of substantial publicity under the law of the Union or a Member State which is proportionate Towards the intended purpose, it respects the essence of the right to protection and provides appropriate and specific measures to ensure fundamental rights and interests of the data subject, (h) the treatment is necessary for preventive purposes; or occupational medicine, assessment of the employee's ability to work, medical diagnosis, provision of health or social care or treatment or management of health and social systems and services based on it Union law or the law of a Member State or under a contract with a professional in the field of health and without prejudice to the conditions and guarantees provided referred to in paragraph 3, (i) the processing is necessary for reasons of public interest in in the field of public health, such as protection against serious cross-border threats against health or ensuring high standards of quality and safety healthcare and medicines or medical devices, on the basis of the law of the Union or the law of a Member State, as appropriate and specific measures to protect his rights and freedoms subject to the data, in particular professional secrecy, or (j) the processing is necessary for archiving purposes public interest, for the purposes of scientific or historical research or for statistics for the purposes of Article 89 (1) under Union law or Member State which are proportionate to the objective pursued shall respect the substance of the right to data protection and provide for appropriate and specific measures to safeguard fundamental rights and freedoms interests of the data subject. 21. Pursuant to Rule 31 of the Rules of Procedure, the controller and processors and, where appropriate, their representatives shall cooperate, upon request, with the supervisory authority for the performance of its duties. 22. Pursuant to Rule 57 (1) (f) of the Rules of Procedure, the Commissioner, inter alia, handles complaints submitted by the data subject or by body or organization or association in accordance with Article 80 and investigates, in so far as the subject of the complaint is appropriate. 23. Pursuant to Article 58 (2) of the Rules of Procedure, the Commissioner has all the following corrective powers: (a) issue warnings to the controller or processing that intended processing operations are likely to infringe the provisions of this Regulation, b) reprimand the controller or executor processing when processing operations have violated provisions of this Regulation, (c) instruct the controller or executor processing to comply with the data subject 's requests for the exercise of his rights in accordance with this Regulation, (d) instruct the controller or executor make the processing operations in accordance with its provisions of this Regulation, if necessary, in a specific way and within a certain deadline, (E) instruct the controller to announce the breach of personal data to the data subject, (f) impose a temporary or permanent restriction, including ban on processing, g) order the correction or deletion of personnel data nature or restriction of processing under Articles 16, 17 and 18 and order to notify these actions to recipients to whom the data disclosed under Article 17 (2) and Article 19, (h) withdraw the certification or order the certification body to withdraw a certificate issued in accordance with Articles 42 and 43 or order the certification body not to issue certification if the requirements certification are not met or are no longer met, (i) impose an administrative fine pursuant to Article 83, in addition to or in lieu of of the measures referred to in this paragraph, as the case may be in each individual case, (j) order the suspension of data traffic to a recipient at third country or to an international organization. 24. In accordance with Rule 83 (2) of the Rules of Procedure fines, depending on the circumstances of each individual case, are imposed in addition to or instead of the measures referred to in Article 58 (2) (a) to (h) and in Article 58 (2) (j). When deciding on with the imposition of an administrative fine, as well as on the amount of the administrative for each individual case, due account shall be taken of the following: (a) the nature, gravity and duration of the infringement, taking into account the nature, extent or purpose of the treatment concerned and the number of subjects of the data affected by the infringement and the degree of damage suffered suffered, b) the deceit or negligence which caused the infringement; (c) any action taken by the controller or perform the treatment to mitigate the damage suffered by their subjects data, (d) the degree of responsibility of the controller or its executor taking into account the technical and organizational measures they apply pursuant to Articles 25 and 32, (e) any relevant previous infringements by the controller; or of the processor, (f) the degree of cooperation with the supervisory authority to remedy it infringement and the reduction of its possible adverse effects, (g) the categories of personal data affected by violation, (h) the manner in which the supervisory authority was informed of the infringement; in particular if and to what extent the controller or processor notified the infringement, (i) where measures have been previously ordered referred to in Article 58 (2) against the person responsible the processor or the processor in relation to the same object, h compliance with these measures, (J) compliance with approved codes of conduct in accordance with Article 40; or approved certification mechanisms in accordance with Article 42 and (k) any other aggravating or mitigating factor arising out of circumstances of the case. 25. In accordance with Article 83 (3), in the event that the person responsible the processor or the processor, for the same or for related operations violates several provisions of this Regulation, the total amount of the administrative fine does not exceed the amount set for the heaviest violation. 26. Infringement of the provisions of Article 83 (4) concern, inter alia, the obligations of the controller and his processing in accordance with Articles 8, 11, 25 to 39 and 42 and 43, impose, in accordance with paragraph 2, administrative fines of up to EUR 10 000 000 or, in the case of businesses, up to 2% of the total global annual cycle of the previous financial year, whichever is higher. 27. In accordance with paragraph 5 of that article, namely Article 83, infringements of the basic principles for processing, including the conditions set out in apply for approval in accordance with Articles 5, 6, 7 and 9 draw, in accordance with paragraph 2, administrative fines of up to EUR 20 000 000 or, in the case of undertakings, up to 4% of the previous global turnover financial year, depending on which is higher. E. Rationale 28. Although I take it for granted, I make it clear that I did not consider it actions, facts, evidence and / or allegations which do not relate to responsibilities provided to me under the Regulation and Law 125 (1) / 2018. 28.1. Therefore, I did not consider issues relating, inter alia, to correctness or of the Defendant's decision to expel / delete the complainant from Link, to the connection / identification or not of the complainant with alleged illegal actions, in the existence or non-existence of libel, defamation and harmful falsehood against of the complainant, whether or not there is an intention in the actions of either the Defendant or of the president of the Association personally, in the existence or not of relevance or connection between the letter of the president of the defendant dated XXXXXX 2018 and letter of the Defendant dated XXXXXX 2019, on whether the complainant possessed by a sense of revenge, as well as whether in deeds and / or allegations made to me, there is a discrepancy between the two parties or skip my update, as I quote for example in the next one paragraph, but in no way affect its substance or nature processing of personal data relating to my responsibilities. For example and in continuation of the above, I quote the following: despite fact that the Defendant's lawyer in his letter dated 21 September 2020, attached the letter of dismissal of the complainant from the Association 14-day XXXXXX 2019, as well as receipt of registered mail to the complainant dated XXXXXX 2019, the complainant's lawyer in letter in which the complaint was submitted on 09 December 2019, stated that the the complainant, up to that time, had not received any letter or any information about his alleged deletion, but neither the reasons for which it has allegedly been deleted, and that, on the complainant's instructions has written a letter to the Defendant. I note, further, that the aforementioned The complainant's letter to the Defendant is dated 02 December 2019, for which, however, the Defendant's lawyer has not done anything report. The validity or otherwise of the information in this paragraph does not affect substance of the complaint concerning the data processing act in question therefore I have not, nor will I, proceed to an attempt to clarify or clarify them. 28.2. From the above, I explicitly point out that the competence given to me by Regulation and Law 125 (I) / 2018 is to examine whether the disclosure the expulsion / deletion of the complainant to the insurance companies, as act of processing personal data, was lawful and in accordance with the legal framework I mentioned above. 29. I note that, in this Decision, as well as in previous letters I use the terms expulsion and deletion, without any discrimination between them, since while in the Articles of Association of the Association, article 8, in his letter of the President of the Defendant to the members of the Association dated XXXXXXX 2018 and in Defendant's letter to the complainant dated XXXXXX 2019 appears on word expulsion, or its equivalent, in the Defendant's letter to the insurance companies companies dated XXXXXX 2019 the word deletion appears. 30. I quote my ex-officio evaluation (reasoning) as it stands This is contained in my letter to the Defendant, dated 18 June 2020: «26. I have not been presented with any evidence to defend him Association that refutes the allegations of the complainant about her breach of his personal data after, despite the fact that they have grant your customers three extensions of submission requested in my Office letter dated 02 January 2020, did not take any action, contact or even inform him Office. 27. The non-sending to my Office of the Statute of the Association, as well and Regulations, if any, governing the operation of the Association, as was requested in my Office letter dated 02 January 2020, does not prove that personal data are submitted to lawful and lawful processing in a transparent manner in relation to the subject. 28. Despite the fact that the Association, as the person in charge of processing, has the responsibility and must be able to demonstrate compliance with paragraph 1 of Rule 5, your customers did not any action to my Office. 15 29. No evidence or argument has been provided for the documentation the legality of the processing carried out by your customers. 30. Your customers have not taken any action to prove it non-prohibition of the processing of personal data which reveal participation in a trade union organization and in general the processing of specific categories of personal data. 31. The three deadlines for submitting the requested letter of the Office dated 02 January 2020, which had been granted to them your customers, expired without submitting any item, and without be informed or contact my Office for non their submission. Moreover, not even after the expiry of the deadline your customers did not submit any information, nor did they update or contacted my Office. The above data prove the non their collaboration with my Office. 32. In a letter from my Office dated 02 January 2020, the Articles of Association and any Regulations governing its operation were requested Link. I consider that their submission required minimal or no burden. Your customers were also asked to specify whether the Practicing the profession of motor appraiser presupposes the registration in the Association, and, if not, indicate the number of its members Link, as well as the number, or estimate number, of appraisers motor vehicles not owned by the Association, as well as to provide any other information or documents they deem necessary for investigation of the complaint. I consider the above data or information was aware of your customers, and therefore easily accessible and available for submission. 33. Based on the above, and taking into account that time has elapsed more than five months after sending my letter to my Office without submitting the above or any other information, the choice of improper performance is clearly demonstrated and of non-cooperation with my Office in which your clients were obliged to proceed, in the exercise of my duties. 34. After evaluating the information I have before me I find out that there is a prima facie violation of Articles 5, 6 (1), 9 (1) and 31 thereof Regulation (EU) 2016/679 and Article 33 (1) (b), (l), (m) of the Law 125 (Ι) / 2018. » 31. Regarding the reference of the Defendant's lawyer in his letter dated 21 September 2020, as referred to in paragraph 15.1.1. of present, that he is unable to grasp the legal meaning and interpretation of the term “it seems that there was ... »a violation of the provisions of the Rules of Procedure, as well as in his question, whether that is, there may not have been an infringement, and why its customers are called, then submit their posts and comments, I have to remind him that with the This letter is updated on the basis of the information previously provided before me, that there is a violation of specific provisions of the Rules of Procedure and 16 of Law 125 (I) / 2018, and before my final decision is made, it is given an opportunity as heard, since its customers may be affected by the issue administrative act, submitting comments and positions to mitigate any ratification. In addition to the above, by evaluating the positions and answers, the which he was called upon to give, it would eventually be deemed a possible breach of its provisions Regulation and Law 125 (I) / 2018, as well as the enforcement of the corresponding, under circumstances, administrative sanction. 32. Defendant's lawyer comments on specific points, such as these are presented in paragraphs 15.1.2. and 15.1.4. of this, delay actions of my Office. I must, however, point out to him that even if there was any delay, in no case did it adversely affect him and its customers. Especially for the appointment document that he was asked to send from new and in which there is clearly the seal of the Association it represents and indicate the name and capacity of the person signing it, it was something he had to take care of from the beginning and dutifully write correctly. 33. I must point out that during the restrictive measures due of the COVID-19 pandemic, my Office was in continuous and uninterrupted operation. 34. Regarding the reference of the Defendant's lawyer in his letter dated 21 September 2020, as presented in paragraph 15.1.7., that neither findings are legally and factually presented nor the manner implementation and evaluation in relation to the case, I emphasize that the analysis and documentation contained in my letter dated 18 June 2020, emerged based on all that data I had at my disposal up to that point. Or not his response and the non-submission of the Defendant's positions resulted in the specific analysis and documentation. Moreover, pursuant to Article 5 (2) thereof Regulation, “The controller is responsible and is able to prove compliance with paragraph 1 ("accountability") ". 35. In the letter of the Defendant's lawyer, dated 21 September 2020, he states that they were not implemented in any way or in any way following: "The right to be heard by the 'accused'" Both with my letter dated 02 January 2020 and with the letter dated 18 June 2020, the Defendant was granted the right to be heard. After all, the defendant's lawyer himself admitted in his letter dated September 21, 2020, that its customers are invited to submit positions and their comments. "The citation of the evaluation and its justification in relation to any Findings of the Judge » The evaluation and the justification are included in Part C. At first sight Commissioner's assessment (reasoning) of my letter of 18 June 2020 to the Defendant. I repeat, as above, that analysis and documentation presented, arose on the basis of all that information to me were listed and I had, until that moment, at my disposal. 17 "The caution of the" accused "about the existence of a procedure against him" This information is evidenced by my letter dated 02 January 2020. The Defendant's no or no timely response, in no case annuls his act of briefing, which I have duly proceeded with. "The caution of the" accused "about the possibility of a trial of the case in his absence " My letter dated 02 January 2020, but mainly my letter dated 18 June 2020, requesting the positions and comments of the Defendant before taking a decision on the possible imposition of an administrative sanction, prove that there is no possibility of a trial in his absence "Accused", since the Defendant was properly informed about the case and was invited to submit his positions. The option of not submitting the positions of Prof. which, in any case, is not meant as a "trial of the case in his absence". On the basis of my explanations, as set out above, it follows that none of the specific positions of the Defendant are substantiated. 36. In my Office letter dated 02 January 2020, the Articles of Association and any Regulations governing the operation of the Association. Also, Defendant was asked to clarify whether the practice of his profession motor appraiser presupposes registration in the Association, and, if not, to indicates the number of members of the Association, as well as its number, or estimate number of appraisers of motor vehicles that do not belong to the Association, as well as provide any other information or documents it deems necessary for investigation of the complaint. I consider that the submission of the requested documents required minimal or insignificant burden, while I consider, at the same time, that the above elements or information was known to the Defendant, and therefore easily accessible and available for submission, therefore in no case is it substantiated that it was which is "objectively impossible", as the defendant's lawyer claims in letter dated 21 September 2020, if we also take into account that in This period included 19 working days after the Epiphany holiday. 37. The initial deadline as well as the three extensions of submission of the requested of my Office letter dated 02 January 2020, ie the Dates 31 January 2020, 14 February 2020, 25 February 2020 and 08 March 2020, which had been granted to the Defendant and his lawyer, expired without any evidence being submitted, and without taking place information or contact my Office for non-submission. Therefore, it appears that the above, given the given conditions and circumstances, were inconsistent and atypical with regard to anything they should do about the case. I can not understand the reason or reasons that his lawyer As he considers the opposite, in his letter dated 21 September 2020. In addition, the report of the Defendant's lawyer "in the midst of his pandemic Koronoviou "is considered, if nothing else, very unfortunate, since the first case in Cyprus was announced on 09 March 2020, ie after the expiration of the third extension granted to Defendant. 1837.1. As above, as I mentioned in my letter to his lawyer Defendant, dated June 18, 2020, proves the choice of non-return and non-cooperation with my Office in which clients they were obliged to carry out, in the exercise of my duties. 38. Regarding the reference of the Defendant's lawyer in his letter dated 21 September 2020, that “cases of this nature are dealt with as "quasi-criminal cases", I would like to emphasize that the Commissioner for Protection Personal Data is an independent administrative authority and the procedure followed in the investigation and handling of complaints submitted by the data subject or by a body or organization or association in accordance with Article 80 of the Rules of Procedure, obeys the General Administrative Principles Law. 39. In fact, by the letter of the Defendant's lawyer dated 21 September 2020, Defendant has not exhausted or responded to all of them questions I asked in my letter dated 02 January 2020. Specifically, no has been placed on the legal or legal basis of the processing act which falls within my responsibilities, ie the disclosure of his dismissal / deletion complaining to insurance companies. Relevant is the following excerpt, from the response of the Defendant's lawyer dated 21 September 2020, and the which is presented in paragraph 15.1.9 of the present: “No form intention appears from the facts to have been inherent in either his actions in general Association or the President personally. " 39.1. With the above statement, the Defendant acknowledges that the specific act of processing disclosure of its elimination / deletion complaining to insurance companies, and makes intent as an ingredient element of a breach of personal data. However, it is not possible acceptable to substantiate the non-existence of a breach, this statement. 40. The Statute of the Defendant, as well as the Code of Professionalism Ethics, are binding documents for all members of the Association. There is, also, the clear reference of the Articles of Association to the Professional Code Ethics, since under Article 8 - Obligations of members and discipline, members of the Defendant must comply with the Code of Ethics adopted by General Assembly of the Defendant. In addition, the Code of Professional Conduct, states that “The following terms bind, oblige and govern the professional behavior of members of motor appraisers ". 41. By virtue of its Associations and Institutions and for Other Related Issues Law of 2017, Law 104 (I) / 2017, article 12 (3), “Expulsion of a member is allowed on cases provided for in the articles of association, as well as in the case in which the member, in all his conduct, acts or omissions, brings or causes humiliation or reduction of the credibility or prestige of the association or other damage in his interests ". 42.1. The Statute of the Defendant, article 8, provides that “A member may dismissed repeatedly and despite warnings from the Executive Committee 19 behaves inappropriately or violates the purposes of the Association or them Ethics Regulation or the provisions of these Articles of Association ". 42.2. The Code of Professional Ethics of the Defendant provides that “10) The The board of directors of the association will be the competent body that will determine whether the professional code was not observed by a member or members and will have the power to decide as the case may be until the expulsion of the member or members ". Also relevant is Article 8 of the Code of Professional Ethics of the Defendant, "8) The member must always behave in a way that does not expose or offends the association, the other members or its position as a member ", after based on this article, as mentioned in the letter of the Chairman of the Board. of Association to the members of the Association, dated XXXXXX 2018, will be Defendant is forced to expel members. 42.3. After a thorough study of the Articles of Association and the Professional Code Ethics of the Defendant, it can be concluded that it does not exist any article or provision which provides for the disclosure of the decision expulsion / deletion of Defendant members in insurance companies or in general in third parties. 43. In the letter of the Defendant to its members, dated XXXXXX 2018, The following excerpt is included, which I quote as is: "To achieve our goal which is the recognition of the Association for the legal regulation by the state, of the scientific and professional branch of Mechanical Appraisers of Motorcycles as independent scientific and professional class, we have prepared a strategy, to promotion of a bill recognizing the Pancyprian Association Motor Appraisers, as the Competent Authority, which regulates the qualifications of the appraiser and extend the issuance of his license profession. At the same time and in relation to the draft law, we implemented a program training of the mechanical assessor for its preparation written examination that will be organized by PSEM for the issuance of the professional Certificate of the Mechanical Appraiser ". 44. Bearing in mind that: - Defendant never denied the data processing act personal nature of the complainant, ie its disclosure expulsion / deletion of the complainant to the insurance companies, - the existence of intent is not a component of a breach personal data, but, on the contrary, is an element which taken into account when measuring administrative sanction, - the Defendant failed to document and / or prove the lawfulness of the relevant processing operation, 20as well as the following, which possibly and under certain conditions to justified the processing operation in question: on the basis of the relevant documents before me, and more in particular the Statute and the Code of Professional Ethics of the Defendant, as well as the letter of dismissal of the complainant from the Association date XXXXXX 2019, the fulfillment of any condition is not demonstrated pursuant to Rules 6 and 9 of the Rules of Procedure, on the basis of which it could the legality of the processing operation in question is established, - the profession represented by the Defendant is not institutionalized and legally guaranteed, - Defendant is not an established supervisory authority, it appears that the disclosure of the expulsion / deletion of the complainant on insurance companies is not based on, nor has a legal basis in the provisions of Article 6 (1), or for specific categories of Rule 9 (1) of the Rules of Procedure, and therefore Prof. has violated the principle of legality of Article 5 (1) (a) of the Rules of Procedure. 45. Considering that: - the Defendant was granted three extensions of submission of the requested data, - the Defendant and / or his lawyer did not, during that time, submitted any information, nor did they update or contact my Office for non-submission of requested information, - the questions I asked in the letter were not answered in full dated 02 January 2020, - the lack of complexity and the possession of the requested data do not justified any delay or request for extension, and - the defendant's lawyer insisted on his and the defendant's consistency, evidence of lack of appropriate cooperation with my Office for the exercise of my duties as provided for in Rule 31 of the Rules of Procedure. F. Conclusion 46.1. Exercising the duties conferred on me by the provisions of Article 57 (1) (f) of the Regulation: “Without prejudice to the other duties set out in this Regulation, each supervisory authority in its territory: f) handles complaints submitted by the data subject or by a body or organization or association in accordance with Article 80 and shall, to the extent appropriate, investigate the subject matter of the complaint and informs the complainant of the progress and the outcome research within a reasonable time, especially if further research is required or coordination with another supervisory authority, " 46.2. after considering and evaluating the Defendant's allegations, 46.3. appreciating and evaluating positively: - the Defendant's initiatives for professional institutionalization / law establishing, and assuming the role of supervisory authority, 21 - the fact that it has not been brought before me before complaint / complaint and / or infringement found against the Defendant, 46.4. after finding that the Defendant had violated Articles 5 (1) (a), 6 (1), 9 (1) and 31 of the Rules of Procedure, in accordance with paragraphs 44 and 45 hereof, and 46.5. exercising the corrective powers conferred on me by Article 58 (2) (a) and (b) of the Regulation, according to which: “Each control authority has all the following corrective powers: (a) issue warnings to the controller; or to the processor that intended processing operations are possible infringe the provisions of this Regulation; (b) reprimand him controller or processor when processing operations have violated the provisions of this Regulation " 46.6. I decided, in my judgment and subject to the above provisions, to address: a. Reprimand to the Defendant as from now on related processing operations which have no legal basis and / or do not comply with the principle of legality, and b. Warning to the Defendant as from now on all necessary actions and responds promptly and with due diligence to requests to facilitate the exercise of the Regulation and Law 125 (I) / 2018 my duties, powers and responsibilities, keeping in mind that you are relevant behaviors on his part will no longer be accepted. Irini Loizidou Nikolaidou Commissioner for Protection Personal Data Nicosia, March 04, 2021 22