Cyprus Data Protection Commissioner Maria Christodoulidou has imposed a €6,000 administrative fine in connection with the operation of the Agora application and online platform.
The platform operates under the responsibility of MEP and Direct Democracy President Fidias Panayiotou, who the Commissioner identifies as the data controller.
The Commissioner said the fine was considered “reasonable and proportionate”.
Commissioner cites lack of cooperation
According to the decision published on Tuesday, Panayiotou’s actions and omissions in not fully complying with the Authority’s request for the temporary suspension of all functions involving the collection and processing of personal data constituted a breach of Article 31 of the General Data Protection Regulation (GDPR).
The Commissioner said this also breached his obligation to cooperate with the supervisory authority in carrying out its duties under Article 57(1)(a) of the regulation.
The decision states that the actions and omissions hindered or obstructed the Authority’s detailed examination of the case.
The Commissioner cited Panayiotou’s failure to cooperate with explicit and repeated requests concerning the investigation of personal-data processing through the Agora application and online platform as an aggravating factor.
Partial compliance with suspension request
The decision states that, despite successive requests and specific clarifications about the scope of the temporary suspension sought by the Authority, Panayiotou’s compliance was “fragmented, incomplete and did not respond to the Authority’s request in its entirety”.
The Commissioner also cited Panayiotou’s degree of responsibility as an aggravating factor, noting that, as the data controller, he was required to respond fully, clearly, promptly and substantively to the Authority’s requests.
He was also expected to provide accurate, complete and consistent information to allow the Authority to effectively carry out its supervisory duties.
The Commissioner described the level of cooperation as limited, stating that Panayiotou did not comply with the clear request to temporarily suspend the platform and did not initially provide full and clear feedback on the compliance measures he had taken.
Active functions continued, decision says
The decision further states that some information and assurances provided by Panayiotou did not fully and accurately reflect the platform’s actual operating status in light of the Authority’s subsequent findings.
This, according to the Commissioner, made the detailed assessment of the case more difficult and/or obstructed the Authority’s work.
During its inspection, the Authority found that functions of the Agora platform involving the collection and/or processing of personal data remained active, despite its clear request for the platform to be temporarily suspended in its entirety.
The Commissioner also considered Panayiotou’s public statements that the application and/or online platform would not be shut down as an aggravating factor, describing them as supporting an assessment of a lack of substantive willingness to comply and cooperate with the Authority.
The GDPR requires data controllers to cooperate with supervisory authorities in the performance of their tasks, while Cyprus law provides for administrative sanctions in cases involving non-compliance with data-protection requirements.
Also read: 44-year-old Welshman dies in Cyprus after developing pancreatitis
For more videos and updates, check out our YouTube channel
