Commissioner (Cyprus) - 11.17.001.010.045
From GDPRhub
| Commissioner - 11.17.001.010.045 | |
|---|---|
| [[File:|center|250px]] | |
| Authority: | Commissioner (Cyprus) |
| Jurisdiction: | Cyprus |
| Relevant Law: | Article 5(1)(c) GDPR Article 6(1)(f) GDPR Article 85 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 14.08.2018 |
| Decided: | 16.01.2023 |
| Published: | |
| Fine: | 7,000 EUR |
| Parties: | n/a |
| National Case Number/Name: | 11.17.001.010.045 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Greek |
| Original Source: | CY Commissioner (in EL) |
| Initial Contributor: | n/a |
The Cypriot DPA issued a fine of €7,000 against a local newspaper for violating Article 5(1)(c) GDPR and Article 6 GDPR. The newspaper published names and photographs of police officers on duty.
English Summary
Facts
On 17 June 2018, local newspaper ‘Politis’ (hereinafter the controller) published the names and photographs of police officers on duty at Larnaca Airport in an article titled “Police altercation with a 70yr old Turkish-Cypriot woman.”
A complaint was filed with the Cypriot DPA and on 14 August 2018, the DPA issued a fine of €10,000 on the basis that the newspaper was in violation of Article 5(1)(c), Article 6 and Article 14 GDPR. This decision was appealed to the Cypriot Court of Appeal and nullified. During this time, the article was removed from the newspaper’s online archives.
On 14 March 2022, the Court reached the decision that the issue was to be re-examined by the DPA.
Holding
The DPA found that the article’s publication was in violation of Article 5(1)(c) GDPR, Article 6(1)(f) GDPR, when read in line with Article 85 GDPR.
Article 5(1)(c) outlines the principle of data minimisation, stating that data processing must be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.” While Article 6 GDPR necessitates that for processing to be lawful it must have a legal basis. Article 6(1)(f) requires that processing is “necessary for the purposes of the legitimate interest pursued by the controller.”
Article 85 GDPR governs the reconciliation of journalistic freedom with data protection. However, the GDPR leaves this task to the legislatures of each Member State, consequently the laws governing this area are domestic laws.
Section 3 of the Deontological Journalistic Code, with reference to Article 8 ECHR, prohibits the publication of a person’s photograph or personal information unless in exceptional circumstances warranted by a strong public interest.
The DPA held that pursuant to the above, the publication of the names and photographs of the officers was excessive. The article could have been published without those details. Consequently, the controller was found to be in breach of the principle of data minimisation in Article 5(1)(c) GDPR and Article 6(1)(f) GDPR. The controller was in violation of Article 6(1)(f) GDPR as the DPA concluded that there was no valid legitimate interest to form a legal basis to processing. Pursuant to the DPA’s powers under Article 58 GDPR and Article 83 GDPR, the DPA issued a fine of €7,000.
Comment
Link to Cyprus' Deontological Journalistic Code.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
1 No. Fac.: 11.17.001.010.045 BY HAND AND BY ELECTRONIC CORRESPONDENCE January 16, 2023 Decision regarding the publication of names and photos of police-investigators on duty at Larnaca airport Based on the duties and powers conferred on me by Article 57 (1)(f) of Regulation (EU) 2016/679 on the protection of natural persons against the processing of personal data and on the free movement of such data, I examined a complaint submitted to my Office on August 14, 2018 regarding the publication of names and photos of police-investigators on duty at Larnaca airport. Based on the investigation, I found a violation of the Regulation by the "Citizen" newspaper and, therefore, issue this Decision. 2. Incidents of the Case 2.1 Upon examination of the complaint/complaint dated August 14, 2018 (hereinafter "the Complaint") submitted by Messrs. XXXXXX (hereinafter "the Complainants") regarding publication of their names and photos in the newspaper "Politis" (hereinafter "the Complainant"), in a publication dated June 17, 2018 entitled "Police cap on a 70-year-old woman T/c", I issued a Decision dated January 9, 2019. The conclusion of my decision was that "The said publication in the disputed article, of the names of the police-investigators in combination with their photographs, violates the provisions of articles 5(1)(c) and 6 of the Regulation, given that, the news could be published without their names and photos, since the matter of interest from a journalistic point of view is the nature of the case. The publication of the specific personal data does not serve the interest of informing the public and is not considered necessary, in the context of the principle of minimization, for the exercise of the right to information." Weighing all the mitigating and aggravating factors, a monetary penalty of €10,000 (ten thousand 2 euros) was imposed on the person legally responsible for the actions of the Complainant, that is, Arktinos Publishing Ltd, in its capacity as file manager. for committing a violation of its obligation under Articles 5(1)(c) and 6 of the Regulation. Against this decision, the Plaintiff filed the Appeal No. XX/2019 on January 24, 2019. 2.2 On February 03, 2022, the Administrative Court issued a decision on Appeal No. XX/2019 canceling the Decision of my Office dated January 9, 2019, "due to the lack of (due) provision of the right to be heard to the applicant" "on all elements of the case, since each application did not notify or offer the complaint of the complainants to the applicant for inspection, as it should, before the applicant was found guilty or the penalty was imposed". 2.3 In the context of the above annulment decision of the Court and in conjunction with the provisions of article 57 of the General Principles of Administrative Law Law of 1999 (158(Ι)/1999), but also the relevant recommendation I received from the Attorney General's Office, it was decided to review the complaint of Mr. XXXXX, against the Complainant. 2.4 To this end, a letter dated March 14, 2022 to the law firm that represented the Complainants in the review of the original complaint, informing them of the Office's decision to proceed with a review of the complaint. He has been asked to inform us whether he still represents the Complainants and in the event that he will not represent them, to provide us with their contact details so that in case we need to contact them directly. 2.5 On March 17, 2022, following a telephone conversation that Mr. XXXXX had with my Office, he stated that he had been informed by his lawyer about the letter from my Office dated March 14, 2022 as well as for the Decision of the Administrative Court in Appeal No. XX/2019. He further informed my Office that he is no longer represented by said lawyer and that the same applies to Mr. XXXXX who was also informed. Both complainants subsequently sent emails to my Office, providing their contact information in case it is needed during the review of the case. 2.6 On April 18, 2022, a letter was sent to the Plaintiff, informing of the decision to review the Complainant's complaint. Also to comply with the Court's instructions as set out in Appeal No. XX/2019, the Complainants' allegations as contained in the initial letter sent to my Office on August 14, 2018 and seeking the positions/opinions of According to her, in relation to these allegations. 2.7 The allegations of the Complainants were as follows: "... On 17/6/2018 the newspaper "o Politis" published both in print and online, a report which allegedly related to suffering and unnecessary and illegal detention elderly Turkish Cypriot woman who was on the Police Alert List, with a relevant note as being checked for possible possession and use of forged documents. Our clients, as part of their duties and completely legally, cut off the elderly woman in question and searched her to establish the legality or not of the documents she had in her possession. As can be seen from the facts, the son of the elderly woman was present from the beginning to the end of the whole process and illegally and without the consent of our clients in a private/closed area - the office of the Cyprus Police which is located at Larnaca airport, he videotaped and/ or record and/or photograph our customers' conversations and faces. Afterwards, our clients were surprised to see their faces appearing in the above-mentioned editions of the newspaper "The Citizen", while to their surprise they found that not only had their faces been published, but their names and rank were also mentioned. While with regard to the elderly woman, her information was protected by mentioning only her initials. Whether or not the issue should have been made public is not something that concerns us and we will not expand on this part. What concerns us is the overt and/or intentional exposure of our customers' personal information, since protecting their data, i.e. not mentioning their names and not exposing their photos, would not alter the quality of the report of the because of a newspaper, but instead would demonstrate the proper and expected behavior towards our customers and their families. Any defense of public interest, truth, etc., gives way to the content of the aforementioned paragraph. In other words, the minimum that the employees of this particular newspaper could have done is to have protected our customers from this unnecessary exposure that they encountered, which is in no way legitimized since they had not given such consent, but neither do the persons which the law excludes. In conclusion, our clients with a letter from their lawyer Mr XXXXX dated 20/06/2018 requested the removal of the publication in question and/or its modification in a way that does not expose them, they also demanded and were entitled to a public apology as a moral obligation , since they did not receive the same treatment regarding the protection of their personal data as the Turkish Cypriot and her son received. The aim of our clients was to end this issue out of court and without further complications, hence the reason why the letter dated 20/06/2018 was initially sent by our Law Office to the newspaper "o Politis" itself and we did not address the Commissioner Data Protection. On 10/07/2018 we received a written response from the lawyer of the above newspaper telling us that the content of our letter is rejected. We would like you to investigate the matter in question based on the relevant legislation and if there is a violation to initiate criminal proceedings against the newspaper in question. It should be noted that it is expected that our customers will file a relevant complaint for criminal prosecution against the person who photographed/videographed/recorded them in a closed/private space without their consent in violation of the relevant legislation...". 4 2.8 The Complainant was also notified of a copy of the article in question, as it was posted in the online newspaper Politis on June 17, 2018, entitled "Police cap in 70-year-old T/k". 2.9 It was pointed out that the administrative file is available for inspection at any time. 2.10 Subsequently, the positions/opinions of the Complainant were requested, regarding the allegations of the Complainants. 2.11 On April 19, 2022, a response letter was sent from the Complainant (through a lawyer) expressing surprise at receiving the letter dated April 18, 2022, with which he was informed about the decision to review the case. The Prosecutor reserved her rights to raise, among other things, issues of jurisdiction, lack of impartiality and abuse of power by the Commissioner and requested the arrangement of an inspection of the administrative file, so that she could subsequently present her positions to my Office. 2.12 Following my Office's written and telephone communication with Ms., an inspection of the administrative file was arranged on May 11, 2022. It was clarified in the meantime in writing that it is practice not to provide copies of documents contained within the administrative file and subsequently by telephone that this practice is implemented following the guidance of the Legal Service. It was also clarified that notes could, in any case, be taken on the contents of the file. The Complainant reserved her rights, citing that this in essence practically removes the very right of access to the file. 2.13 After the inspection of the administrative file, on May 20, 2022, the complainant's positions/opinions were received by email (with an attached letter dated May 19, 2022), which are summarized as follows: (1) That there is management's insistence on reopening a case, almost 4 years after the complaint of Mr. XXXXXX. After an inspection of the file, it was found that there is no new request from the complainants or even a desire to re-examine their complaint. What emerges is only the communication of the Commissioner's Office with their lawyer at the time, where he is informed of the Office's decision to review their complaint. As they had informed the Office of the Commissioner in a letter dated 30/10/2018, the Complainants had registered the lawsuit XXXXX/18 E. D. Nicosia for the above publication. The lawsuit was settled with the publication of a text in the Politis newspaper and was withdrawn as settled. The Defendant questioned the complaint, since the lawsuit was settled and withdrawn as settled and the absence of evidence to show that the Complainants persist 4 years later, about the motives, the existence of good faith and impartiality of the administration, and against whether a question of abuse of power is raised. He referred to an article in the newspaper "Alithea" dated February 16, 2019 entitled "She also fined her ... husband", which referred to the Commissioner's decision 5 dated January 9, 2019 which was subsequently cancelled, in a way that she is praised by the newspaper for imposing the sanction, despite her husband's relationship with the Politis newspaper, as well as in the publications of the Politis newspaper itself. February 4, 2022 entitled "Void the penalty of 10,000 euros to "CITIZEN"", copies of which were attached to her reply. (2) That it is a matter of limited publication, due to the fact that the photograph was taken in a public place, namely at Larnaca airport during the performance of the Complainants' duties as public officials, namely Airport Security police officers and investigators. He referred in this regard to the Case of Alpha Doryforiki Tileorasi Anonymi Etairia v Greece, Application no 72562/10, dated 22/5/2018. (3) That the reasons the journalist chose to publish the names and photographs of the complainants are related: A. To the facts of the case. They concern the treatment she received according to information collected by the journalist, an elderly woman, a citizen of the Republic of Cyprus who belongs to the Turkish Cypriot community by officials of the Republic of Cyprus. Treatment which the journalist considered humiliating, racist and possibly motivated by political motives, possibly also illegal, since the person in question (who spoke neither Greek nor English and therefore communication with her was done through her son in English) he was detained at the airport for some time, transferred to the Larnaca Airport, his luggage was searched, without at any point being given satisfactory or any explanations and finally he was released. That is why it is no coincidence that the complaint does not concern the claim of the complainants that the facts of the case have not been recorded correctly, but only about the publication of their names and photographs. And according to the editor's information, the name of the woman in question appeared as a suspect in possession of forged documents/false identity. The above treatment took place even though as established by airport security, the woman's ID was genuine, issued in 2016 and of a new type. B. With the editor's information that there was a delay in communication between the Larnaca TAE and the Airport police, as a result of which the TAE police officers arrived at the airport to check the Turkish Cypriot an hour after her arrival in Cyprus. Also, while the TAE Police officers had verified that her identity was genuine, they nevertheless insisted on taking her to the Larnaca police station for further verification of information. They searched her luggage claiming they were looking for fake travel documents. They also checked the luggage of her son who was traveling with her. While it was confirmed that the Turkish Cypriot woman was not tested for anything, the TAE police officers offered her to give a DNA sample if she wanted. They spoke disparagingly in front of her and her son, describing them as "kotziakari" and "Turkish Cypriot bastard". 6 C. With information from the newspaper about similar behavior at Larnaca airport that happened to one of the sons of the above woman in 2011. The said Turkish Cypriot even submitted a complaint to the Administrative Commissioner in August 2011, which was answered in 2017. According with it, the Chief of Police replied that the check he had been subjected to was due to the fact that there were indications that his identity was forged. Regarding his complaint about the general treatment he suffered, the Commissioner of Administration reported that the Chief of Police refused to answer. The details of this event were published in Politis newspaper on 6/18/2018. Copies of the publication and the response of the Administrative Commissioner were shared with my Office. D. With the fact that the journalist, before publishing the relevant text, brought the issue to the attention of the Police Spokesperson and asked for his opinions, but without receiving an answer. She also tried to contact him by phone, to no avail. A copy of the email has been shared with my Office. E. With the fact that the Police twice refused to answer, first to the Commissioner of Administration and then to the journalist, for the same behavior suffered by 2 members of the same family, citizens of the Republic of Cyprus, Turkish Cypriots. One can reasonably claim indifference on their part, but also wonder the following: since after the incident with her son from 2011, in which it did not emerge that there were no forged documents, why should the same family continue to suffer from the authorities on the same issue 7 years later, especially since the identity of the woman, as the police themselves found, was of a new type. It is also reasonable to consider that the result of this very attitude by the Police is the covering up of any responsibilities for arbitrary behavior towards persons based on their ethnic origin. St. With the fact that the journalist, trying to raise awareness of the above incident, considered that a simple reference to it without the names of the officials who handled the matter, would not have any practical effect and, moreover, would possibly give the impression that the criticism is leveling to all airport security and police officers in general, which would not be fair. In addition, he indirectly wanted to hurt the attitude of the Police for their refusal to be officially involved in this incident. G. By demonstrating that the authorities and the state are not an impersonal and anonymous mechanism, but consist of functionaries who are autonomous individuals and are personally responsible for the way they treat citizens and mainly exercise powers on behalf of the State. Also that these officials cannot conveniently hide behind the anonymity afforded by the status of public official/public servant and either break the laws or behave abusively, but must act responsibly and perform their duties in accordance with the principles of good administration. H. In that the journalist wanted to highlight another incident involving discrimination against a citizen on the basis of her ethnic 7 origin and racist behavior by government officials, such as airport security personnel and members of the of the Police in general. After all, it is good to bear in mind that in the Commission's annual reports on discrimination and racist attitudes in Cyprus, it is repeatedly stated that the unresolved Cypriot problem is a source of continuous ethnic discrimination, especially in relation to the Turkish Cypriots. (4) According to the position of the Plaintiff, the Complainants have not suffered any damage. (5) It was also stated that there was no bad faith or fraud on the part of the Complainant, hence proceeding with the settlement of the action XXXXX/181 E. D. Nicosia. (6) Finally, it was mentioned that the publication is no longer online. 2.14 On June 30, 2022, my Office sent a letter to the Complainants, asking them to confirm the depiction of their face on the publication and their personal data that is found. It was also brought to their attention that the Complainant referred to among them Lawsuit number XXXXX/2018, which has been settled with the publication of a text in the newspaper Politis and has subsequently been withdrawn, as settled. The Complainants were requested to inform my Office of the settlement date, whether the subject matter of the Lawsuit concerned defamation or the issue of damages for a breach of their personal data and if there was a copy of the probate warrant and/or the record of the Lawsuit settlement , as communicated to me. 2.15 Mr. XXXXX replied on July 6, 2022, confirming that the article refers to him using his surname "XXXXX" and the first letter of his first name, i.e. "X". He further clarified that his status at the airport was XXXX at the Passport Control Center, rather than airport security as stated. Attached a copy of the second photo of the publication dated June 17, 2018, circling the person pictured in the center of the photo as his own. He also clarified that they had not claimed any compensation due to the information they had received from their lawyer that our Office had established criminal offenses regarding the violation of personal data by imposing a €10,000 fine on the Complainant. Therefore they did not claim any amount as compensation because they considered that the Defendant suffered the consequences of the Law. They agreed with the Defendant to make an apologetic announcement in a column of the printed form of the newspaper and to download the relevant online publication, which the Defendant has done. This was agreed after he had been satisfied with the sentence of my Office. He did not receive a summons, nor was he informed that the case was withdrawn, and the newspaper was never forced to pay the fine. 1 Apparently it concerns a typographical error, since initially the Defendant referred to the complaint in Action No. XXXXX/18. 8 He pleaded that if my Office continues to believe that the newspaper committed "criminal" offenses and since they have not been asked to pay for their huge error, to complete the review case, since it never agreed to its withdrawal. 2.16 Mr XXXX replied on 19 July 2022, confirming that his face is depicted in both photographs in the publication (officer on the left). His name and rank are not mentioned. The matter had been handled by their lawyer who had informed them that my Office would impose a fine of €10,000 on the Complainant and that the Complainant had verbally agreed to publish an apology, which was done. With the above facts, they were satisfied and did not proceed with any other Action for damages. They had not been summoned by the Court. If Ms. refuses to pay the fine imposed on her by my Office, then they continue to have a complaint about their faces being published in the newspaper. 2.17 On September 29, 2022, a letter was sent to the Plaintiff, where she was asked, for the purposes of documenting her positions, to provide a copy of the Court minutes of the settlement of the Lawsuit and the text published in the "Politis" newspaper. We also noted that in her earlier letter she referred to Case No. XXXX/18, while in her later letter to Case No. XXXX/18. 2.18 The Complainant clarified on September 30, 2022 that the correct reference is Action No. XXXXX/18. The number XXXXX/18 was written by mistake. The said Action was settled by agreement with the other side. The relevant text was published, which was submitted, on April 9, 2019 and on May 30, 2019 the Lawsuit was withdrawn by the Plaintiffs' lawyers unconditionally. Court Minutes were not considered necessary to request and are therefore not available. 2.19 On October 6, 2022, after taking into account the facts before me, up to that moment, and after having weighed between the right to information of public opinion and the freedom of the press against the right to protect the personal data of the complainants, I issued prima facie decision by which I found a violation of the provisions of articles 5(1)(c) and 6(1)(f) of the Regulation. Next, within the framework of the powers granted to me by Article 58(4) of the Regulation where, among other things, it provides that the exercise by a supervisory authority of its powers is subject to the appropriate guarantees, including the appropriate procedure provided for by the law of the Member State and within the framework of the right to be heard provided by article 43 of the General Principles of the Administrative Law Law of 1999, Law 158(I)/1999, as amended, I called the Complainant as she states for what reasons she believes that she should not to impose any corrective measure or administrative sanction (beyond the existing withdrawal of the online publication and related public apology) within 4 weeks of the decision in question. I further asked how it informed me about its turnover for the previous financial year. 9 2.20 The Complainant filed her own pleadings on October 21, 2022, stating, inter alia, the following: 2.20.1 She reserves her rights to appeal to the competent Court the prima facie decision by which I have concluded that there are violations of the provisions of articles 5(1)(c) and 6(1)(f) of the Regulation, including as a wrong and/or consequence of a bad exercise of my discretion when balancing the rights of the complainants with the right to liberty of the expression of the journalist and the owners of the Politis newspaper, which is protected by Article 10 of the ECHR and the Charter of Fundamental Rights of the European Union. 2.20.2 Repeats what is mentioned in the letters of April 19, 2022 and May 19, 2022, for which it also reserves its rights to invoke them in the competent Court, as reasons why the decision should be annulled. 2.20.3 It reserves its rights to appeal the prima facie decision to the competent Court due to the violation of Article 6(1) of the ECHR, Article 41 of the Charter of Fundamental Rights of the European Union and Article 43 of Law 158(1 )/99, in relation to her right to a fair trial and prior hearing since, according to what was mentioned in the prima facie decision, after the Defendant sent a letter of complaint dated May 19, 2022, further steps followed by my Office, such as re-contacting the complainants and receiving new allegations and/or documents from them, concerning the substance of the case, of which the Defendant was never informed and never invited to decide on these allegations, before issuing the prima facie decision. And this despite the fact that in the interim, specifically on September 29, 2022, a letter was sent to the Defendant requesting that a copy of the Court's minutes be provided in relation to the settlement of Case 2545/18 E.D. Nicosia and a copy of the publication of the apology. 2.20.4 Finally, the Defendant in the complaint stated that without prejudice to the above and on the substance, she inadvertently did not mention that the settlement of the Action XXXXX/18 E. D. Nicosia included the payment of €500 and VAT to the complainants' lawyers. She enclosed, in support of her position, a copy of the payment receipt and reiterated her reservation regarding her rights. 3. Legal Aspect 3.1 In accordance with Article 57(1)(f) of Regulation (EU) 2016/679, the Office of the Personal Data Protection Commissioner duly handles complaints submitted by data subjects, while in accordance with Article 57( 1)(a) monitors and enforces the implementation of the Regulation. 3.2. Article 4(1) of the Regulation states that "personal data": is "any information concerning an identified or identifiable 10 natural person ("data subject"); an identifiable natural person is one whose identity can be ascertained, directly or indirectly, in particular by reference to an identifier such as a name, an identity number, location data, an online identifier or one or more factors specific to physical, physiological, genetic, psychological, economic, cultural or social identity of the natural person in question" 3.3 Controller is "the natural or legal person, public authority, agency or other entity that, alone or jointly with others, determines the purposes and manner of processing personal data;..." ( Article 4(7) of the Regulation), while a processing act is "any act or series of acts carried out with or without the use of automated means, on personal data or sets of personal data, such as the collection, registration, organization, the structuring, storage, adaptation or alteration, retrieval, retrieval of information, use, disclosure by transmission, dissemination or any other form of disposal, association or combination, restriction, deletion or destruction" (Article 4(2) of the Regulation. 3.4 According to Article 5(1)(c) of the Regulation, the personal data processed by a controller must "be appropriate, relevant and limited to what is necessary for the purposes for which they are processed ("minimization of data »)». Furthermore, a processing of personal data, in order to be characterized as lawful, must meet at least one of the conditions of Article 6 of the Regulation (e.g. consent (6(1)(a)), necessary for the performance of a contract ( 6(1)(b)), to comply with a legal obligation (6(1)(c)), to fulfill a duty performed in the public interest or in the exercise of public authority (6(1)(e)), for the purposes of legitimate interests pursued by the controller or a third party, unless these interests are overridden by the interest or fundamental rights and freedoms of the data subject that require the protection of personal data (see Article 6(1)(f) ), etc. 3.5 Article 14 provides for the information of the data subject, when his personal data has not been collected by him. The controller provides the data subject with, inter alia, information in relation to the purposes of the processing for which the personal data are intended, as well as the legal basis for the processing, the recipients or categories of recipients of the personal data, if the legal basis is the legal interest, the legal interests pursued, his rights, etc. 3.6 Furthermore, according to Article 85 of the Regulation, Member States should reconcile the right to the protection of personal data under this Regulation with the right to freedom of expression and information, including, but not limited to, processing for journalistic purposes. 11 3.7 A related provision has been included in the local Law on the Protection of Natural Persons Against the Processing of Personal Data and the Free Circulation of Such Data Law of 2018, N.125(I)/2018, which provides that: "29. 1. The processing of personal data or special categories of personal data or personal data relating to criminal convictions and offenses which is carried out for journalistic or academic purposes or for the purposes of artistic or literary expression is legal, provided that these purposes are proportionate to the intended objective and respect the essence of the rights as defined in the Charter of Fundamental Rights of the European Union (Charter), in the European Convention on Human Rights and Fundamental Freedoms (ECHR), which has been ratified by the European Convention for the Protection of Human Rights (Enacting) Law, and in Part II of the Constitution. (2) The provisions of articles 14 and 15 of the Regulation are applied to the extent that they do not affect the right to freedom of expression and information and journalistic confidentiality." 3.8 The right to freedom of expression is established by Article 10 of the European Convention on Human Rights of the Council of Europe (ECHR), Article 11 of the Charter of Fundamental Rights of the European Union and Article 19 of the Constitution. The right to the protection of private and family life is established by Article 8 of the Convention, Article 7 of the Charter and Article 15 of the Constitution, while the right to the protection of personal data is established by Article 8 of the Charter. The European Court of Human Rights has ruled in relation to the provision of Article 8 of the ECHR that the protection of "private life" based on this Article, does not exclude the professional life of employees and is not limited to life within the place of residence. 3.9 Related to the need to balance between the right to privacy and public information, is Decision no. 43/2007 of the Greek Personal Data Protection Authority where, among other things, it states the following: principle of proportionality ... in such a way that the protected goods (freedom of information and citizens' right to information ... and right to personality and to the protection of private life and right to informational self-determination) retain their normative scope (see A. Elder , The protection of the citizen from the electronic processing of personal data, Ed. Ant. Sakkoula, Athens 2002, p. 209). The judgment as to whether the specific processing was carried out legally or whether, on the contrary, the right to informational self-determination of the affected persons and to private life was violated, is subject both to the criterion of whether this processing served the interest of informing public opinion, and to the extent the considered offense was within the framework of the 12 principle of proportionality necessary for the exercise of the right to information (see no. 100/31.1.2000 decision of the Authority, p. 7). "The principle of weighing is accepted by the established jurisprudence of the Greek courts and the European Court of Human Rights (ECtHR), according to which the media have, according to Article 10 of the European Convention on Human Rights (ECHR), ratified with the n.d. 53/1974, duty to inform the public about cases and issues of general interest and accordingly the public has the right to be informed about these issues. Especially when it comes to figures of public life or matters of public interest, the need to inform the public is more intense. For this reason, the ECtHR recognizes the role of journalists as public watchdogs, i.e. the control function of the press, which covers its ability to embellish bad texts with its publication and public criticism. Public officials, judges, cannot escape journalistic scrutiny and sharp criticism, in order for public opinion to be convinced that, among other things, the judges respond to their public duties and the purpose of their mission. And while the press is one of the means available to public opinion to ascertain that judges are exercising their high duties, Article 10 ECHR does not guarantee unrestricted freedom of the press, even when it comes to the publication of serious matters of public concern. of interest. Paragraph 2 provides that the exercise of freedom involves obligations and responsibilities that also apply to the press." 3.10 Additionally, the Code of Journalistic Ethics states the following: "3. PRIVACY The dignity and privacy of each person are respected and no personal information is disclosed. Interventions and investigations into the private life of persons, without their consent, including taking photographs of persons or filming or recording sounds without their knowledge or consent - unless they are involved in events or situations that constitute news of general interest - on private property or elsewhere , as well as the securing of information by interception or long-term photography mechanisms are generally unacceptable, and their disclosure can only be justified in exceptional cases and exclusively in the public interest. The media and their officials do not engage in unprovoked personal attacks and abusive and insulting characterizations that tarnish honor and reputation." "9. PRESUMPTION OF INNOCENCE Officials fully respect the principle that a suspect or accused of committing an offense is innocent until proven guilty by due process and therefore avoid making public anything that leads to conclusions as to the suspect's guilt or innocence and/or accused or tends to drag or impeach him." "15. PUBLIC INTEREST In this Code, cases which, by invoking the public interest, justify a deviation from the rule, are mainly the following: (a) Assisting in the detection or disclosure of a crime. (b) Protection of public safety or health. (c) Protection of human rights. 13 (d) Prevention of misleading the public as a result of actions or statements of individuals or organizations.'' 3.11 Based on the jurisprudence of the European Court of Human Rights (ECHR) regarding the right to the protection of private and family life, guaranteed by Article 8 of the European Convention on Human Rights and Article 15 of the Constitution, in cases of this nature, it should be it is examined whether the event (a) took place in a public or private space, (b) whether it concerns a public figure or functionary or an ordinary private individual and (c) in the event that some information is published, whether the public interest in the specific publication outweighs the right to protect the private and family life of the persons to whom the publication concerns. 3.12 Relevant jurisprudence on the matter is set out in the case to which the Complainant of the European Court of Human Rights also referred, Alpha Doryforiki Tileorasi Anonymi Etairia v. Greece (Application no. 72562/10), Decision dated May 22, 2018, which involved the release of three different videos that had been filmed with a hidden camera and shown on the TV show "Jungle". The videos showed a certain politician, a member of the parliamentary committee, entering a gaming arcade and using two gaming machines. A second video showed the meeting the politician had with partners of the show, during which the first video was revealed to him, while the third video showed the meeting the politician had with M.T. in the second's office. The videos were also shown on a second TV show entitled "Yellow Press". In relation to the existing jurisprudence, the following was repeated: "46. The Court reiterates that the outcome of the application should not, in theory, vary according to whether it has been lodged with the Court under Article 8 of the Convention by the person who was the subject of the news report, or under Article 10 by the publisher. Indeed, as a matter of principle these rights deserve equal respect (see Von Hannover (no. 2), cited above, § 106). Accordingly, the margin of appreciation should in theory be the same in both cases. 47. The Court has identified, as far as relevant to the present case, the following criteria within the context of balancing competing rights: the contribution to a debate of public interest; the degree to which the person affected is well-known; the subject of the news report? the method of obtaining the information and its veracity; the prior conduct of the person concerned? the content, form and consequences of the publication; and the severity of the sanction imposed (see Couderc and Hachette Filipacchi Associés, cited above, § 93; Axel Springer AG v. Germany [GC], no. 39954/08, §§ 90-95, 7 February 2012; and Von Hannover (no. 2), cited above, §§ 109-13). 48. In addition, the Court reiterates that it is commonly acknowledged that the audiovisual media often have a much more immediate and powerful effect than the print media (see Jersild, cited above, § 31, and Peck v. the United Kingdom, no. 44647/98, § 62, ECHR 2003-I). Accordingly, although freedom of expression also extends to the publication of photographs, the Court recalls that this is an area in which the protection of the rights of others takes on particular importance, especially where the images contain very personal and intimate "information" about an individual or where they are taken on 14 private premises and clandestinely through the use of secret recording devices (see Von Hannover, cited above, § 59; Hachette Filipacchi Associés (ICI PARIS) v. France, no. 12268/03, § 47, 23 July 2009; and MGN Limited v. the United Kingdom, no. 39401/04, §§ 143, 18 January 2011). Factors relevant to an assessment of where the balance between competing interests lies include the additional contribution made by the publication of the photographs to a debate of general interest, as well as the content of the photographs (see Krone Verlag GmbH & Co. KG v. Austria, no. 34315/96, § 37, 26 February 2002) (ii) Application of the above principles in the present case a) Contribution of the report to a debate of public interest 49. An initial essential criterion is the contribution made by articles in the press to a debate of public interest. The Court has previously recognized the existence of such an interest where the publication concerned political issues or crimes (see Axel Springer AG, cited above, § 90, with further references)." 3.13 The Court differentiated its position regarding the three videos, since the first incident took place in a public place, where anyone could take a photo or video of the depicted political person, while the second and third incident took place in private space, where one had the right to expect protection of one's privacy. He also agreed with the conclusion of the Greek authorities, that the projection of the second and third videos exceeded the limits of responsible journalism. He also noted that there is a difference in the case from that in Hladimann and Others v. Switzerland (no. 21830/09, ECHR 2015), since there measures were taken to protect the persons by blurring the image and changing the voice of the depicted persons, while in the present case, there was no attempt to compensate the affected person for the intrusion into his private life . It was taken into account the fact that since the release of the videos, the political person lost his position in the political movement to which he belonged, as well as the fact that the production company had been punished with a fairly large amount of monetary penalty (100,000 euros), which, however, would it could also be considered relatively lenient considering the factors that had been measured, such as e.g. the previous similar behavior of the production company. The Court noted that the financial penalty was imposed on the company and not on the journalist, who had used the hidden camera or hosted the television program. The Court concluded that there was no violation of Article 10 of the Treaty, regarding the outcome of the Greek Authorities in relation to the second and third videos and the conviction of the production company. 3.14 In a decision of the Supreme Court, which upheld a decision of my Office, in Review Appeal No. 32/2013, date 1/3/2019, between the Republic of Cyprus, through the Personal Data Protection Commissioner and Dias Publishing House Ltd, among others, the following was mentioned: "In the case of Axel Springer AG v. Germany (GC), No. 39954/08, dated 7.2.2012, the ECtHR emphasized that when balancing the right to freedom of expression on the one hand and the right to respect for private life on the other, the following 15 factors should be taken into account: (a) whether the published article is general of interest, (b) whether the person involved is a public figure and (c) how the relevant information was obtained and whether it is substantiated. The ECtHR referred to the principle of proportionality as important when balancing the two aforementioned rights." "According to Article 4 (1) (c) of the Law, the data controller must ensure that the personal data is relevant, relevant and "no more than is necessary in view of the purposes of the processing". 3.15 Article 57 of the General Principles of Administrative Law Law of 1999 (158(I)/1999), provides that: 57. After an annulment decision, the act disappears and the administration is obliged to restore things to the position they were in before the issuance of the annulled act. 3.16 In the cases of Vnukovo Airlines (V.A.) et al. Law of the Attorney General (2001) A.A.D. 969 and Kyriakidis v. Dimokratia (2013) 3 A.A.D. 629, it was held that the administration is obliged to restore things to the state they were in before the annulment, to take care of the review process of the contested administrative matter and to decide in a lawful manner and in line with the findings of the administrative court. During the review, the administrative procedure is repeated from the point where it was found to be illegal. 3.17 More specifically, in Kyriakidis v. Dimokratia (2013) 3 A.A.D. 629 was mentioned in this regard: "... we consider that in every case of an annulment decision it is the duty of the Administration to conduct a review - or, when a reason is established, a re-investigation (see Naziris v. R.I.K. (2007) 3 A.A. D. 38) - for the restoration of the damaged legality, as established in the revising annulment decision. In our opinion, this is a duty that is emphasized by long-established and clear jurisprudence (see Englezakis et al. Law of the Attorney General (1992) 1(A) A.A.D. 697, which refers to the earlier of the subject jurisprudence, as well as in the Attorney General v. Holy Archdiocese of Cyprus (1999) 1(A) A.A.D. 342), which jurisprudence does not seem to recognize that it recedes even in cases where it cannot be physically (in natura) restoration of things to their former state..." 3.18 Regarding the right to bring legal action of a subject whose personal data is affected are Articles 79 and 82(1) of the Regulation, which are as follows: "79 . 1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy if he or she considers that his or her rights under this Regulation have been infringed as a result of 16 processing of his personal data concerning him in violation of this regulation. 2. Proceedings against a data controller or processor are brought before the courts of the Member State in which the data controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State in which the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of public of its powers." "82. 1. Any person who has suffered material or non-material damage as a result of a violation of this regulation is entitled to compensation from the data controller or processor for the damage suffered. ……………………………………………………………………………………………… 6. Judicial proceedings for the exercise of the right to compensation shall be submitted before the competent courts under the law of the Member State referred to in Article 79 paragraph 2. 3.19 It should also be noted that based on Article 58(2), the Commissioner has all the following corrective powers: "a) to issue warnings to the controller or processor that intended processing operations are likely to violate the provisions of this regulation, b) to address reprimands to the data controller or the processor when processing operations have violated provisions of this regulation, c) to instruct the data controller or the processor to comply with the requests of the data subject for the exercise of the rights of in accordance with this regulation, d) to instruct the data controller or the processor to make the processing operations comply with the provisions of this regulation, if necessary, in a specific way and within a certain period, e) to instruct the controller to notify the personal data breach to the data subject, f) to impose a temporary or definitive restriction, including the prohibition of processing, g) to order correction or deletion of personal data or restriction of processing pursuant to articles 16, 17 and 18 and order notification of these actions to recipients to whom the personal data was disclosed pursuant to article 17 paragraph 2 and article 19, h) withdraw the certification or order the certification body to withdraw a certificate issued in accordance with articles 42 and 43 or to order the certification body not to issue certification, if the certification requirements are not met or are no longer met, 17 i) to impose an administrative fine under article 83, in addition to or instead of the measures referred to in this paragraph, depending on the circumstances of each individual case, j) to give an order to suspend the flow of data to a recipient in a third country or an international organization." 3.20 Article 83 of the Regulation, which concerns the general conditions for imposing administrative fines, among other things, provides the following: "1. Each supervisory authority shall ensure that the imposition of administrative fines in accordance with this article against infringements of this regulation referred to in paragraphs 4, 5 and 6 is effective, proportionate and dissuasive in each individual case. 2. Administrative fines, depending on the circumstances of each individual case, are imposed in addition to or instead of the measures referred to in Article 58 paragraph 2 points a) to h) and Article 58 paragraph 2 point j). When deciding on the imposition of an administrative fine, as well as on the amount of the administrative fine for each individual case, the following shall be duly taken into account: a) the nature, gravity and duration of the infringement, taking into account the nature, extent or purpose of the relevant processing, as well as the number of data subjects affected by the breach and the degree of damage they suffered, b) the fraud or negligence that caused the breach, c) any actions taken by the controller or the processor to mitigate the damage suffered by the data subjects, d) the degree of responsibility of the controller or the processor, taking into account the technical and organizational measures they apply pursuant to articles 25 and 32, e) any relevant previous violations of the controller or processor, f) the degree of cooperation with the supervisory authority to remedy the violation and limit its possible adverse effects, g) the categories of personal data affected by the violation, h) the way with which the supervisory authority was informed of the breach, in particular whether and to what extent the data controller or processor notified the breach, i) in the event that the measures referred to in Article 58 paragraph 2 were previously ordered to be taken against the data controller involved or of the processor in relation to the same object, the compliance with said measures, j) the observance of approved codes of conduct in accordance with article 40 or approved certification mechanisms in accordance with article 42 and k) any other aggravating or mitigating factor that arises from the circumstances of the particular case, such as the financial benefits obtained or losses avoided, directly or indirectly, from the infringement. 18 3. In the event that the data controller or processor, for the same or related processing operations, violates several provisions of this regulation, the total amount of the administrative fine does not exceed the amount defined for the heaviest violation. 4. Violations of the following provisions shall attract, in accordance with paragraph 2, administrative fines of up to EUR 10 000 000 or, in the case of undertakings, up to 2 % of the total worldwide annual turnover of the previous financial year, whichever is higher: a ) the obligations of the controller and the processor in accordance with Articles 8, 11, 25 to 39 and 42 and 43, b) the obligations of the certification body in accordance with Articles 42 and 43, c) the obligations of the monitoring body in accordance with Article 41 paragraph 4. 5. Violations of the following provisions shall attract, in accordance with paragraph 2, administrative fines of up to EUR 20 000 000 or, in the case of undertakings, up to 4 % of the total global annual turnover of the previous financial year, depending whichever is higher: a) the basic principles for processing, including the conditions applicable to consent, in accordance with Articles 5, 6, 7 and 9, b) the rights of data subjects in accordance with Articles 12 to 22, c) the transmission of personal data to a recipient in a third country or an international organization in accordance with articles 44 to 49, d) any obligations under the law of the Member State which are established by virtue of chapter IX, e) non-compliance with order or to temporarily or permanently limit the processing or to suspend the circulation of data imposed by the supervisory authority pursuant to article 58 paragraph 2 or not providing access in violation of article 58 paragraph 1."3.21 Recital (148) of the Regulation, clarifies further that: "(148) In order to strengthen the enforcement of the rules of this regulation, sanctions, including administrative fines, should be imposed for each violation of this regulation, in addition to or instead of the appropriate measures imposed by the supervisory authority in accordance with this regulation. In the case of a minor offence, or if the potential fine would impose a disproportionate burden on an individual, a reprimand could be imposed instead of a fine. However, due consideration should be given to the nature, seriousness and duration of the infringement, the willful nature of the infringement, the actions taken to mitigate the damage, the degree of responsibility or any other relevant previous infringements, the manner in which the supervisory authority was informed of the infringement, the compliance with the measures against the controller or processor, the observance of a code of conduct and any other aggravating or mitigating factor. The imposition of sanctions, including administrative fines, should be subject to appropriate procedural safeguards in accordance with the general principles of Union law and the Charter, including effective judicial protection and due process.' 3.22 In the introductory note of Guidelines 4/2022 for the calculation of administrative sanctions on the basis of GDPR 2016/679, which 19 was issued by the European Data Protection Board (EDPB) on May 12, 2022 (which are under public consultation), it is noted the following: "The calculation of the amount of the fine is at the discretion of the supervisory authority, subject to the rules provided for in the GDPR. In that context, the GDPR requires that the amount of the fine shall in each individual case be effective, proportionate and dissuasive (Article 83(1) GDPR). Moreover, when setting the amount of the fine, supervisory authorities shall give due regard to a list of circumstances that refer to features of the infringement (its seriousness) or of the character of the perpetrator (Article 83(2) GDPR). Finally, the amount of the fine shall not exceed the maximum amounts provided for in Articles 83(4) (5) and (6) GDPR. The quantification of the amount of the fine is therefore based on a specific evaluation carried out in each case, within the parameters provided for by the GDPR." 4. Rationale 4.1 First of all, I will refer to the claim of the Complainant, regarding the administration's insistence on re-opening a case, almost 4 years later and as considering a non-existent request. The Administrative Court had pointed out in Appeal XX/2019 the lack of granting the Defendant the right to be heard on all the elements of the case since it was not notified of the allegations of the Complainants or offered to inspect the administrative file, at the initial stage of examination of the complaint . Accordingly, in compliance with the provisions of Law 158(I)/1999, the instructions of the Court, the relevant Jurisprudence (see e.g. Kyriakidis v. Democracy, above) and the recommendation of the Legal Service, my Office had the duty as review the Complaint from the point the Court raised, which was the point immediately after receiving the complaint. 4.2 Secondly, it should be mentioned that it is unfortunate and inappropriate that the Complainant attributes personal motives to me. Primarily, the consideration of complaints/complaints of affected persons to my Office, is a duty that stems both from the Regulation and from Laws and Jurisprudence, and secondarily, as explained above, there is a duty to review the complaint, after the annulment decision of the Court . 4.3 With reference to the claim that the Lawsuit has been settled with the publication of an apologetic text in the Politis newspaper and the specific publication has been withdrawn, it should be said that according to the provisions of Articles 79 and 82(1) of the Regulation, the filing of a Lawsuit does not prevent in any way, a data subject who considers that his rights have been affected, to submit a complaint to a Supervisory Authority at the same time. The data subject can apply to the Court for an award of damages, which he is not entitled to receive in the context of an administrative case. It should be noted that the circumstances that allowed the settlement of the Lawsuit, which is now invoked by the Defendant in the complaint, were different at that stage of time than they are today. According to the position of the complainants, among the reasons they took into account in order to accept the settlement, was the fact that my Office imposed an administrative fine against the Complainant. This was also the main reason why they did not promote 20 the Education. From what they had presented to us, it also seems that they were not aware of the fact that an Appeal was pending, which subsequently led to the annulment of the contested Decision and the consequent annulment of the administrative fine. The content of the apology notice dated April 9, 2019, according to which the Complainant expresses her regret if the publication of the personal data of the complainants in the publication of June 17, 2018, caused them any disturbance, discomfort or grief. Both the apology and the removal of the text from the internet can be counted as actions to mitigate the impact on the rights of the affected subjects. 4.3.1 I reject the position of Ms. the complaint dated October 21, 2022, that Article 6(1) of the ECHR, Article 41 of the Charter of Fundamental Rights of the European Union and Article 43 of Law 158(1)/99 have been violated, by the fact that, according to the position of, new allegations and/or documents were presented by the complainants, to which he was not called upon to respond. The plaintiff in the first complaint had raised the allegation in her letter dated May 19, 2022 regarding settlement of pending, related to the complaint, Lawsuit. A claim he left unsubstantiated. The complainants were then asked to comment on the allegation of the Complainant and if they have any supporting material to provide it. The complainants gave their positions in relation to the allegation put before me by the Complainant. They did not have supporting evidence of the existence of compromised Education. Having these facts before me, the Complainant was asked to present supporting elements of the position (which I repeat was the first she presented before me), as she should have done in any case from the beginning. Any similar things mentioned by the complainants regarding the circumstances that led to their agreement to withdraw the Lawsuit, do not differentiate and do not affect the essence of the case, i.e. whether when the Defendant had published the complaint together with the article and the personal data of the complainants (names and photos) citing public information, had carried out the corresponding weighting of rights. 4.4 I now proceed to consider the Complaint, as it stands before me today, on its merits. The name and photograph of a natural person, to the extent that his identity is revealed immediately or indirectly, constitute "personal data", according to the definition given in article 4(1) of the Regulation. The publication of the name and photo of a natural person constitutes processing of personal data, in the sense of article 4 of the Regulation. 4.5 The publication in a newspaper of the names and photos of the police-investigators, even in relation to their professional life, constitutes processing of personal data by the data controller. The processor may be, among others, a legal entity, provided that it determines the purposes and method of processing. In this case, the person responsible for the processing is the Complainant, Arktinos Publications Ltd. 21 4.6 The Complainant stated that it is a matter of limited publication, due to the fact that the photo was taken in a public place, namely at Larnaca Airport, during the performance of the complainants' duties as public officials and referred in this regard to the Alpha Doryforiki case (as above ). I remind you that the Court in the case in question accepted the video recording of only one of the three videos as compatible with the purposes of freedom of expression, the one in which the specific political figure was in an open public space, that is accessible to anyone. However, it rejected the request of the Applicants for a violation of freedom of expression with regard to the other two videos that were taken in a closed space, since the expectations of the data subject for the protection of his privacy were taken into account. It should also be noted that in this case the data subject was a well-known political figure, in contrast to the data subjects in the present case, who were ordinary officials during the performance of their duties. The degree to which a person has a public profile or is known, or whether even through his actions or position he could expose himself to the public sphere, affects the level of protection of his privacy. In the present case, the police-investigators were not known, nor their position or their actions over time, making them public figures, in the sense of the increased public interest in their person and the necessity of publishing their personal data. The photos that were taken and published with the police-investigators, it is clear that they were taken inside a closed office. As confirmed by the publication, the 70-year-old T/K was moved "From the area where she was interrogated […] back to the airport Security offices". The same is confirmed by the position of the complainants, who spoke of illegal and without their consent videotaping and/or sound recording and/or photographing them "in a private/closed area - office of the Cyprus Police which is located at Larnaca airport". According to the Principle of Proportionality (see also article 29 of Law 125(I)/2018), it should be weighed whether the publication of personal data is necessary and proportional to the intended purpose. Proportionality which was correctly applied in the case of the elderly T/K, but was not applied in the case of the police-investigators. I also note that the personal data of a third police-investigator are exposed in this particular publication, but he did not make a complaint to my Office . 4.7 Despite the fact that the Defendant in the complaint states that the positions of the Chief of Police were requested, so as to possibly justify the validity of the information, I repeat that the persons and names exposed did not offer anything more to the essence of public information . I notice that the journalist, in his electronic letter to the Chief of Police, did not consider it necessary to refer to the police-investigators by name, but presented the content of the complaint that reached them, making a general reference to the behavior of "Policemen of the TAE of Larnaca". As the complainants state in their complaint, they were completely unaware of their photos being taken, they had not received any information and "were surprised to see their faces appear in" "issues of the 22 newspaper", and that "their names were also mentioned them and their rank". The information to the Police concerned the "unfavorable treatment of an elderly Turkish Cypriot woman by TAE Larnaca police officers on June 4, 2018" and asked for her comments on the complaint, as well as to answer the question of whether the TAE police officers were acting on instructions, and if so, who was giving the said instructions. 4.8 The purpose of freedom of expression, moreover, is not to raise the awareness of specific authorities, as was the position of the Complainant, with the public, nominal targeting of specific public officials, in the exercise of their duties, but to inform the public. In a privileged state, procedures are established which allow the citizen to address his complaints to specific authorities, even when it concerns alleged discrimination and misconduct, as was the case here. Therefore, weighing the conflicting interests, i.e. the legal interest of the "Politis" newspaper to inform the public with the interest of the police-investigators to protect their personal data, the publication of their photos and/or their names, I consider that it was not necessary , objectively necessary and proportional to the intended purpose, that is to publicize the nature of the incident that took place at Larnaca Airport on June 4, 2018. 4.9 The intended purpose could be achieved by referring only to their initials and/or their persons be blurred and/or publish photos that were taken from a long distance, so that it was impossible to recognize the depicted persons, actions which would not bring about any change in the message that the Complainant wanted to convey to the public and in the true nature of the case. 4.10 Taking into account the above and weighing the right to information of public opinion and freedom of the press against the right to protect the personal data of the complainants, I am of the opinion that: (a) The publication in the disputed article of the names of the police-investigators and/or and of their photographs is not considered to have been done for the purpose of protecting the public interest, such as assisting in the detection or disclosure of any crime. (b) The Regulation specifies that the processing, which is carried out in the light of the protection of the legitimate interests of the controller, must be necessary for this purpose and that the interests, fundamental rights and freedoms of the data subject whose personal data to be processed have been evaluated and do not override the legal interests of the controller (Article 6(1)(f) of the Regulation). 4.11 That is why, in this case, the provisions of article 6(1)(f) of the Regulation are not applicable, since the specific disclosure was not necessary for the purposes of the legal interests pursued by the Complainant, i.e. the journalistic information of the general public and does not override the interest or fundamental rights or freedoms of the 23 police-investigators. The publication of the names of the police-investigators and/or their photos does not serve the interest of informing the public and in the context of the principle of minimization, the information in question was not necessary for the exercise of the right to information on behalf of Ms. of the complaint. 4.12 The manner in which the Complainant chose to publicize the specific case was disproportionate to the intended purpose, that is to inform the public about the essence of the case. The claims about the necessity of publicizing the personal data of the police-investigators are not justified since: It is not the responsibility nor the duty of the Complainant to decide whether there has been adverse discrimination and/or whether any criminal act has been committed. For the purpose of raising awareness of the relevant authorities, the case could be reported directly to the authorities, including the names and photographs of the persons involved. Courts are the only bodies that have the jurisdiction to judge someone innocent or guilty. It could, with the right weighting, cover whatever journalistic interest it wanted, without exposing to such an extent the privacy of the complainants. 5. Conclusion 5.1 Taking into account all the above elements as listed, and based on the powers granted to me by Articles 58 and 83 of Regulation (EU) 2016/679, article 24(b) of Law 125(I)/2018 , I find that there was a violation of the provisions of Articles 5(1)(c) and 6(1)(f) of the Regulation, given that the news could have been published without the names and photos of the police-investigators, since the matter what is of interest from a journalistic point of view is the nature of the case and since the publication of names and photographs do not add any additional value. The disclosure of specific personal data does not serve the interest of informing the public and is not considered necessary, in the context of the principle of minimization, for the exercise of the right to information. 5.2 Based on the provisions of Article 83 of the Regulation, as far as they apply in this particular case, I take into account the following mitigating (1)-(5) and aggravating (6)-(7) factors, based on the facts as they are today before us me: (1) The nature of the violation: it concerns the professional life of the complainants, although the protection of "private life" based on Article 8 of the ECHR does not exclude the professional life of employees and is not limited to life within the place of residence . 24 (2) The number of data subjects affected by the violation: it concerns a small number of affected persons, where although there are three persons affected by the publication, the number of only two persons who filed a complaint before me is taken into account. (3) The actions taken by the controller to mitigate the damage suffered by the data subjects: The complainant removed the publication from the internet and issued a written apology. (4) The categories of personal data affected by the violation: It does not concern special categories of personal data, but concerns simple data such as the name and photo of the complainants. (5) The cooperation of the Complainant with my Office: Although the financial statements were not provided as requested by the Complainant, I nevertheless find that there was cooperation of the Complainant with my Office in the context of this investigation. (6) The position of the Defendant in the complaint that she deliberately and not due to negligence published the details of the complainants in the newspaper, since she wanted to demonstrate that the authorities and the state are not an impersonal or even anonymous mechanism, but consist of specific persons who in her position they bear personal responsibility for their actions. (7) The scope of the infringement: The publication was posted on the internet for a long time, with an unlimited and/or indefinite number of readers. Although the exact date of its removal has not been specified, it was posted at least from the date of publication (June 17, 2018) until the date of my Office's first Decision (January 9, 2019). The Plaintiff's apology was published on April 9, 2019, while the Action was withdrawn as settled on May 30, 2019. 5.3 In my previous Decision dated January 9, 2019, I imposed on the Complainant an administrative fine of €10,000, for her breach of her obligations under Articles 5(1)(c) and 6(1)(f) of the GDPR, after taking into account various aggravating and mitigating factors, with a positive and negative sign respectively and with differentiated gravity, depending on the severity of the mitigating or aggravating factor, each time. 5.4 I also point out that in Review Appeal No. 32/2013, by which the Decision of my Office was validated, the administrative sanction imposed on the appellant, in the amount of €3,000, was also validated. This amount was fixed, with a maximum amount imposed at that time of €30,000. After the application of GDPR 2016/679 on May 25, 2018, for the same violation (principle of minimization, as in the present case) a maximum administrative penalty of €20,000,000 is foreseen. 25 5.5 Taking into account the aggravating and mitigating factors set out in paragraph 5.2 of this Decision, as they have been formed during the review of the case, I impose on the Defendant the complaint, an administrative fine of €7,000, for her violation of Articles 5 (1)(c) and 6(1)(f) of the GDPR. 5.6 The reduction of the administrative fine and its differentiation in relation to the first Decision of my Office, was a consequence of the differentiation of the aggravating and mitigating factors that were taken into account during the review, such as the fact that the publication has been removed from the internet, that there has been written apology from the Complainant and that there was cooperation in the context of this investigation. However, the fact of the existence of a violation and the long period of time during which the publication was posted on the internet and accessible to an unlimited number of readers cannot be ignored and/or neutralized. Irini Loizidou Nikolaidou Commissioner for the Protection of Personal Data
