Commissioner (Cyprus) - 17.05.23
| Comissioner - XXXXXXXXX | |
|---|---|
| [[File:|center|250px]] | |
| Authority: | Comissioner (Cyprus) |
| Jurisdiction: | Cyprus |
| Relevant Law: | Article 5(1)(c) GDPR Article 6 GDPR Article 29(1) of Law 125(I)/2018 |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 17.10.2018 |
| Decided: | |
| Published: | 17.05.2023 |
| Fine: | 3000 EUR |
| Parties: | Breikot Management Ltd 5 anonymous complainants |
| National Case Number/Name: | XXXXXXXXX |
| European Case Law Identifier: | XXXXXXXXX |
| Appeal: | Appealed - Partly Confirmed Administrative Court 962/2019 |
| Original Language(s): | Greek |
| Original Source: | Commissioner (Cyprus) (in EL) (in EL) |
| Initial Contributor: | Evangelia Tsimpida |
The DPA of Cyprus reviews a case of imposition of an administrative fine for violation of Articles 5(1)(c) and 6 GDPR and Article 29(1) of Law 125(I)/2018 following an appeal by the data controller to the Administrative Courts.
English Summary
Facts
In September and October 2018, four articles were published in the print edition of the newspaper "24h", owned by Breikot Management Ltd, a member of the Nikodea Media Group, in which the names of five persons, photographs of three of them and a reference to the conviction of one of them were published. Following complaints by the persons concerned on 17/10/2018, whose details were published in the newspaper, the DPA taking into account factors such as the deletion of the relevant publications from the company's website, and the failure to withdraw the printed newspapers, issued a decision, which was appealed before the Administrative Court on January 24, 2019, by the Breikot Management Ltd, which constitutes the data controller. Following the Administrative Court's decision, the DPA was asked to review the case against the data controller.
Holding
The DPA took into account the above factors, as well as the purposes of public information and the principle of data minimisation, and found that the purposes of public information and the mentioning of the names of the complainants and the conviction of one of them outweighed the interests, fundamental rights and freedoms of the complainants, but that the publication of the photographs of three (3) of the five (5) complainants in three (3) of the four (4) publications exceeded the principle of data minimisation and that, in any case, it was excessive in relation to the purpose pursued, in violation of Articles 5(1)(c) and 6 of the Regulations and Article 29(1) of Law 125(I)/2018. Accordingly, the DPA imposed a fine of €3,000 (three thousand euros) on the data controller, namely Breikot Management Ltd, in its capacity as controller of the file, for breach of its obligation under Articles 5(1)(c) and 6 GDPR. the Administrative Court to which the data controller appealed upheld the Decision to the extent that it concerned the infringement, but annulled it to the extent that it concerned the amount of the administrative fine imposed. The DPA was asked to review the case to the extent that it concerns the amount of the administrative fine. Referring to the reasoning of two cases with similar facts and taking again into account the burdening and reducing factors taken into account in its first decision, the DPA upheld the administrative fine of €3,000 for its violation of Articles 5(1)(c) and 6 GDPR, since there was no differentiation of the burdening and reducing factors compared to the first decision to justify a reduction of the fine.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.
