[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnX2r11x8UUIWii24jQbMJl2oNdtrE158DJ1DVuBn4c0":3},{"article":4,"iocs":41},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":23,"category":24,"article_tags":28},"bac47b0e-5570-4dcb-8e36-c326887ef378","ΔΔΚ - 1421\u002F2022","1421-2022-d1cd42","Created page with \"{{COURTdecisionBOX |Jurisdiction=Cyprus |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=ΔΔΚ |Court_Original_Name=ΔΙΟΙΚΗΤΙΚΟ ΔΙΚΑΣΤΗΡΙΟ ΚΥΠΡΟΥ |Court_English_Name=ADMINISTRATIVE COURT OF CYPRUS |Court_With_Country=ΔΔΚ (Cyprus) |Case_Number_Name=1421\u002F2022 |ECLI= |Original_Source_Name_1=CYLAW |Original_Source_Link_1=https:\u002F\u002Fwww.cylaw.org\u002Fcgi-bin\u002Fopen.pl?file=administrative\u002F2026\u002F202605-1421-22.html&qstring=%F0%F1%EF%F3%F9%F0...\" New page {{COURTdecisionBOX |Jurisdiction=Cyprus |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=ΔΔΚ |Court_Original_Name=ΔΙΟΙΚΗΤΙΚΟ ΔΙΚΑΣΤΗΡΙΟ ΚΥΠΡΟΥ |Court_English_Name=ADMINISTRATIVE COURT OF CYPRUS |Court_With_Country=ΔΔΚ (Cyprus) |Case_Number_Name=1421\u002F2022 |ECLI= |Original_Source_Name_1=CYLAW |Original_Source_Link_1=https:\u002F\u002Fwww.cylaw.org\u002Fcgi-bin\u002Fopen.pl?file=administrative\u002F2026\u002F202605-1421-22.html&qstring=%F0%F1%EF%F3%F9%F0%2A%20%E4%E5%E4%EF%EC%E5%ED%2A |Original_Source_Language_1=Greek |Original_Source_Language__Code_1=EL |Original_Source_Name_2= |Original_Source_Link_2= |Original_Source_Language_2= |Original_Source_Language__Code_2= |Date_Decided=20.05.2026 |Date_Published= |Year=2026 |GDPR_Article_1=Article 4(7) GDPR |GDPR_Article_Link_1=Article 4 GDPR#7 |GDPR_Article_2=Article 4(8) GDPR |GDPR_Article_Link_2=Article 4 GDPR#8 |GDPR_Article_3=Article 31 GDPR |GDPR_Article_Link_3=Article 31 GDPR |GDPR_Article_4=Article 58(2) GDPR |GDPR_Article_Link_4=Article 58 GDPR#2 |GDPR_Article_5=Article 83 GDPR |GDPR_Article_Link_5=Article 83 GDPR |GDPR_Article_6= |GDPR_Article_Link_6= |GDPR_Article_7= |GDPR_Article_Link_7= |EU_Law_Name_1= |EU_Law_Link_1= |EU_Law_Name_2= |EU_Law_Link_2= |National_Law_Name_1= |National_Law_Link_1= |National_Law_Name_2= |National_Law_Link_2= |Party_Name_1=Pancyprian Judo Federation |Party_Link_1= |Party_Name_2=Commissioner for Personal Data Protection |Party_Link_2=https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Commissioner_(Cyprus) |Party_Name_3= |Party_Link_3= |Party_Name_4= |Party_Link_4= |Appeal_From_Body=Commissioner for Personal Data Protection |Appeal_From_Case_Number_Name=11.17.001.009.246\u002F11.05.2022 |Appeal_From_Status= |Appeal_From_Link=https:\u002F\u002Fwww.dataprotection.gov.cy\u002Fdataprotection\u002Fdataprotection.nsf\u002Fall\u002F1978BD92BBEDDA44C225887F002107BD\u002F$file\u002F%CE%91%CF%80%CF%8C%CF%86%CE%B1%CF%83%CE%B7%20%CE%B3%CE%B9%CE%B1%20%CE%A0%CE%B1%CE%B3%CE%BA%CF%8D%CF%80%CF%81%CE%B9%CE%B1%20%CE%9F%CE%BC%CE%BF%CF%83%CF%80%CE%BF%CE%BD%CE%B4%CE%AF%CE%B1%20%CE%A4%CE%B6%CE%BF%CF%8D%CE%BD%CF%84%CE%BF.pdf?openelement |Appeal_To_Body= |Appeal_To_Case_Number_Name= |Appeal_To_Status=Unknown |Appeal_To_Link= |Initial_Contributor=ds | }} A court annulled a DPA’s €5,000 fine against an athletic federation for failure to cooperate, holding that the DPA had not established that the federation was a controller or processor under the GDPR. == English Summary == === Facts === On 3 November 2021, a data subject filed a complaint against an individual who managed a club affiliated with the Pancyprian Judo Federation. The complaint concerned the unauthorised publication of photos and other material, including material depicting the data subject’s minor child, in the context of Pancyprian under-18 judo matches held under the federation’s auspices. On 13 December 2021, the DPA requested various information from the federation. The federation did not respond. The DPA then sent a reminder on 25 January 2022, but the federation again failed to respond. Subsequently, on 30 March 2022 the DPA issued a prima facie decision finding a breach of [[Article 31 GDPR|Article 31 GDPR]] due to the federation’s lack of cooperation and invited the federation to submit its position. The federation did not respond to this either. On 11 May 2022, the DPA issued the contested decision, finding that the federation had failed to cooperate with it despite repeated requests. It imposed a €5,000 fine for breach of [[Article 31 GDPR|Article 31 GDPR]]. The federation appealed against the decision, arguing that it was based on an incorrect application of the GDPR and contained legal and factual errors. === Holding === The court noted that, for [[Article 31 GDPR|Article 31 GDPR]], [[Article 58 GDPR|Article 58 GDPR]] and [[Article 83 GDPR|Article 83 GDPR]] to apply, the federation had to qualify as either a controller or a processor. The court found that the federation did not fall within the definition of processor under [[Article 4 GDPR#8|Article 4(8) GDPR]]. It noted that the DPA did not appear to have treated it as such. The court then examined whether the federation could be considered a controller under [[Article 4 GDPR#7|Article 4(7) GDPR]]. It held that the contested decision did not clearly explain why the DPA had classified the federation as a controller. The court inferred that the DPA may have reached this conclusion because the federation had forwarded a letter concerning a past personal data breach to all its members at the request of a lawyer from one of its member clubs. However, the court rejected this reasoning. It held that the federation had merely forwarded the letter and had not given any instructions regarding the purposes or means of processing personal data. The DPA had not investigated whether the federation, either alone or jointly with its members, determined the purposes or means of the processing. Nor could such involvement be presumed merely because the federation had registered member clubs. The court concluded that, since the federation did not qualify as either a controller or a processor, [[Article 31 GDPR|Article 31 GDPR]], [[Article 58 GDPR#2|Article 58(2) GDPR]] and [[Article 83 GDPR|Article 83 GDPR]] did not apply. It annulled the contested decision and ordered the DPA to pay €2,000 plus VAT in costs to the federation. == Comment == ''Share your comments here!'' == Further Resources == ''Share blogs or news articles here!'' == English Machine Translation of the Decision == The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details. CYPRUS BAR ASSOCIATION Search - List of Administrative Court Decisions - Display Reports (Noteup on) - Remove Underlining ADMINISTRATIVE COURT (Case No. 1421\u002F2022) May 20, 2026 [MICHAEL, D\u002Fto the D.D.] PANGYPRIAN JUDO FEDERATION Applicant v. OFFICE OF THE PERSONAL DATA PROTECTION COMMISSIONER Wherein the Application .......... C. Siakalli (Ms.) for Orphanides, Christofides and Associates D.E.P.E., for the applicant. Th. Hadjiloukas for Attorney General, for the defendant in the application. DECISION MICHAEL, D.D.D.: The applicant, with the present appeal, requests the annulment of the decision of the defendant in the application dated 11.5.2022 by which it imposed an administrative fine of €5,000 on the applicant. On 3.11.2021, a complaint was filed against a person who maintains a club registered with the applicant for the unauthorized publication of photographic and other material, including the minor child of the complainant, in the context of the national judo competitions for under-18s held under the auspices of the applicant. The defendant in the application, by letter dated 13.12.2021, requested various information from the applicant. The applicant did not respond. On 31.3.2022, the defendant in the application proceeded to issue a prima facie decision finding a violation of Article 31 of Regulation (EU) 2016\u002F679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the \"General Regulation\") due to the lack of cooperation by the applicant and granting the applicant the right to submit its positions regarding the content of the letter and the reasons why no sanction should be imposed on it. The applicant did not respond to this letter either and thus the contested decision was issued on 11.5.2022. The applicant suggests that the contested decision was taken on the basis of incorrect application of the General Regulation and under legal and factual error. As follows from points C and D of the contested decision entitled “Reasoning” and “Conclusion” respectively, the defendant in the application ruled that: “24. On December 13, 2021, in the context of investigating the said complaint, the Federation was requested to provide my Office with specific information directly related to the incident under investigation. After the first deadline that had been set (December 31, 2021) had passed, a reminder letter was sent on January 25, 2022, with a new deadline for response on February 2, 2022. The new deadline also passed, without any response from the Federation on the questions that had been raised and which are directly related to the complaint under investigation. Subsequently, on March 30, 2022, my prima facie decision was issued, in which I identified a violation of the provisions of the Regulation and in particular Article 31. This decision was notified to the Federation. 25. Based on Article 31 of the Regulation, the Federation should have cooperated with my Office, formulating its positions on the matter as requested, which it has not done to date. 26. Taking into account the above and the fact that the Federation has not sent its own positions to date, I note, once again, a lack of cooperation with my Office by the Federation and therefore a violation of Article 31 of the Regulation. D. Conclusion 27. Having regard to the above and based on the powers granted to me by Articles 58 and 83 of Regulation (EU) 2016\u002F679, Article 24(b) of Law 125(I)\u002F2018, I reiterate my finding of a violation by the Respondent of the complaint: (a) of Article 31 of the Regulation, since it did not cooperate with my Office despite repeated requests and did not provide any response to the issues that had been brought to its attention. 28. Unfortunately, no mitigating factor can be assessed in favor of the Federation, since it did not raise any mitigating factor itself, as requested by my prima facie decision dated March 30, 2022. There was a complete lack of cooperation. I consider that under the circumstances, the imposition of the administrative sanction provided for in Article 58(2)(i), namely the imposition of an administrative fine pursuant to Article 83 of the Regulations, is justified. 29. In light of the above, I HAVE DECIDED to impose the following administrative sanction: - To the Cyprus Judo Federation, an administrative sanction of €5,000.00.” Article 31 of the General Regulation, which is invoked in the contested decision, provides the following: “The controller and the processor and, where applicable, their representatives shall cooperate, upon request, with the supervisory authority for the exercise of its tasks.” And Article 58(2) under the heading “Powers” provides that: “2. Each supervisory authority shall have all of the following corrective powers: a) to address warnings to the controller or processor that intended processing operations are likely to infringe provisions of this Regulation, b) to address reprimands to the controller or processor where processing operations have infringed provisions of this Regulation, c) to order the controller or processor to comply with requests by the data subject for the exercise of his or her rights under this Regulation, d) to order the controller or processor to bring the processing operations into compliance with the provisions of this Regulation, where necessary, in a specific manner and within a specified time limit, e) to order the controller to communicate the personal data breach to the data subject, f) to impose a temporary or permanent restriction, including a ban on processing, g) to order the rectification or erasure of personal data or the restriction of processing pursuant to Articles 16, 17 and 18 and an order to notify such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19, h) to withdraw the certification or to order the certification body to withdraw a certificate issued in accordance with Articles 42 and 43 or to order the certification body not to issue a certification, where the certification requirements are not or are no longer met, i) to impose an administrative fine pursuant to Article 83, in addition to or instead of the measures referred to in this paragraph, depending on the circumstances of each individual case, j) to order the suspension of the flow of data to a recipient in a third country or to an international organisation.” For the above provisions to apply, the applicant must be either the controller or the processor. Articles 4(7) and (8) provide the following definitions: \"7) 'controller' means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for his appointment may be laid down by Union or Member State law, 8) 'processor' means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, The applicant certainly does not fall within the definition of processor and in any event, nor does the respondent appear to have treated it as such. As to whether the applicant constitutes a controller, the contested decision does not clearly state the reason why the respondent concluded that the applicant falls within the specific definition. I assume that because the applicant on 6.6.2018 forwarded, at the request of a union lawyer, a letter to all its members referring to a leak of personal data, the respondent concluded that the applicant is a controller. This conclusion, however, seems arbitrary and hasty. The applicant simply forwarded a letter. It did not provide instructions regarding the purpose and manner of processing personal data. Consequently, the respondent does not appear to have investigated in any way whether the applicant actually determines, either on its own or jointly with its members, the purposes and manner of processing personal data. Nor is it presumed that because it is a federation with registered members, it has any involvement in the personal data processed by each association. Under the data as explained above, since the applicant does not fall within the definition of controller, Articles 31, 58(2) and 83 of the General Regulation do not apply. For the above reasons, I conclude that the appeal succeeds and the contested decision is annulled. €2,000 plus VAT is awarded in favor of the applicant and against the defendant in the application. E. MICHAEL, D.D.D. cylaw.org: From KINOP\u002FCyLii for the Pancyprian Bar Association","A Cypriot court annulled a €5,000 fine issued by the Data Protection Authority (DPA) against the Pancyprian Judo Federation for failing to cooperate with an investigation. The court ruled that the DPA had not sufficiently demonstrated that the federation acted as either a data controller or processor under GDPR, thus the fine was not applicable.","A court in Cyprus annulled a €5,000 GDPR fine against a sports federation due to a lack of controller\u002Fprocessor status.","Help ΔΔΚ - 1421\u002F2022: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 15:09, 28 May 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators61 edits Tag: submission [1.0]Newer edit → (No difference) Revision as of 15:09, 28 May 2026 ΔΔΚ - 1421\u002F2022 Court: ΔΔΚ (Cyprus) Jurisdiction: Cyprus Relevant Law: Article 4(7) GDPR Article 4(8) GDPR Article 31 GDPR Article 58(2) GDPR Article 83 GDPR Decided: 20.05.2026 Published: Parties: Pancyprian Judo Federation Commissioner for Personal Data Protection National Case Number\u002FName: 1421\u002F2022 European Case Law Identifier: Appeal from: Commissioner for Personal Data Protection11.17.001.009.246\u002F11.05.2022 Appeal to: Unknown Original Language(s): Greek Original Source: CYLAW (in Greek) Initial Contributor: ds A court annulled a DPA’s €5,000 fine against an athletic federation for failure to cooperate, holding that the DPA had not established that the federation was a controller or processor under the GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On 3 November 2021, a data subject filed a complaint against an individual who managed a club affiliated with the Pancyprian Judo Federation. The complaint concerned the unauthorised publication of photos and other material, including material depicting the data subject’s minor child, in the context of Pancyprian under-18 judo matches held under the federation’s auspices. On 13 December 2021, the DPA requested various information from the federation. The federation did not respond. The DPA then sent a reminder on 25 January 2022, but the federation again failed to respond. Subsequently, on 30 March 2022 the DPA issued a prima facie decision finding a breach of Article 31 GDPR due to the federation’s lack of cooperation and invited the federation to submit its position. The federation did not respond to this either. On 11 May 2022, the DPA issued the contested decision, finding that the federation had failed to cooperate with it despite repeated requests. It imposed a €5,000 fine for breach of Article 31 GDPR. The federation appealed against the decision, arguing that it was based on an incorrect application of the GDPR and contained legal and factual errors. Holding The court noted that, for Article 31 GDPR, Article 58 GDPR and Article 83 GDPR to apply, the federation had to qualify as either a controller or a processor. The court found that the federation did not fall within the definition of processor under Article 4(8) GDPR. It noted that the DPA did not appear to have treated it as such. The court then examined whether the federation could be considered a controller under Article 4(7) GDPR. It held that the contested decision did not clearly explain why the DPA had classified the federation as a controller. The court inferred that the DPA may have reached this conclusion because the federation had forwarded a letter concerning a past personal data breach to all its members at the request of a lawyer from one of its member clubs. However, the court rejected this reasoning. It held that the federation had merely forwarded the letter and had not given any instructions regarding the purposes or means of processing personal data. The DPA had not investigated whether the federation, either alone or jointly with its members, determined the purposes or means of the processing. Nor could such involvement be presumed merely because the federation had registered member clubs. The court concluded that, since the federation did not qualify as either a controller or a processor, Article 31 GDPR, Article 58(2) GDPR and Article 83 GDPR did not apply. It annulled the contested decision and ordered the DPA to pay €2,000 plus VAT in costs to the federation. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details. CYPRUS BAR ASSOCIATION Search - List of Administrative Court Decisions - Display Reports (Noteup on) - Remove Underlining ADMINISTRATIVE COURT (Case No. 1421\u002F2022) May 20, 2026 [MICHAEL, D\u002Fto the D.D.] PANGYPRIAN JUDO FEDERATION Applicant v. OFFICE OF THE PERSONAL DATA PROTECTION COMMISSIONER Wherein the Application .......... C. Siakalli (Ms.) for Orphanides, Christofides and Associates D.E.P.E., for the applicant. Th. Hadjiloukas for Attorney General, for the defendant in the application. DECISION MICHAEL, D.D.D.: The applicant, with the present appeal, requests the annulment of the decision of the defendant in the application dated 11.5.2022 by which it imposed an administrative fine of €5,000 on the applicant. On 3.11.2021, a complaint was filed against a person who maintains a club registered with the applicant for the unauthorized publication of photographic and other material, including the minor child of the complainant, in the context of the national judo competitions for under-18s held under the auspices of the applicant. The defendant in the application, by letter dated 13.12.2021, requested various information from the applicant. The applicant did not respond. On 31.3.2022, the defendant in the application proceeded to issue a prima facie decision finding a violation of Article 31 of Regulation (EU) 2016\u002F679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the \"General Regulation\") due to the lack of cooperation by the applicant and granting the applicant the right to submit its positions regarding the content of the letter and the reasons why no sanction should be imposed on it. The applicant did not respond to this letter either and thus the contested decision was issued on 11.5.2022. The applicant suggests that the contested decision was taken on the basis of incorrect application of the General Regulation and under legal and factual error. As follows from points C and D of the contested decision entitled “Reasoning” and “Conclusion” respectively, the defendant in the application ruled that: “24. On December 13, 2021, in the context of investigating the said complaint, the Federation was requested to provide my Office with specific information directly related to the incident under investigation. After the first deadline that had been set (December 31, 2021) had passed, a reminder letter was sent on January 25, 2022, with a new deadline for response on February 2, 2022. The new deadline also passed, without any response from the Federation on the questions that had been raised and which are directly related to the complaint under investigation. Subsequently, on March 30, 2022, my prima facie decision was issued, in which I identified a violation of the provisions of the Regulation and in particular Article 31. This decision was notified to the Federation. 25. Based on Article 31 of the Regulation, the Federation should have cooperated with my Office, formulating its positions on the matter as requested, which it has not done to date. 26. Taking into account the above and the fact that the Federation has not sent its own positions to date, I note, once again, a lack of cooperation with my Office by the Federation and therefore a violation of Article 31 of the Regulation. D. Conclusion 27. Having regard to the above and based on the powers granted to me by Articles 58 and 83 of Regulation (EU) 2016\u002F679, Article 24(b) of Law 125(I)\u002F2018, I reiterate my finding of a violation by the Respondent of the complaint: (a) of Article 31 of the Regulation, since it did not cooperate with my Office despite repeated requests and did not provide any response to the issues that had been brought to its attention. 28. Unfortunately, no mitigating factor can be assessed in favor of the ","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=%CE%94%CE%94%CE%9A_-_1421\u002F2022&diff=51758&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-05-28T15:09:52+00:00","2026-05-28T16:00:22.592898+00:00",7,[18,21],{"name":19,"type":20},"Pancyprian Judo Federation","vendor",{"name":22,"type":20},"Commissioner for Personal Data Protection","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":23,"icon":25,"name":26,"slug":27},null,"GDPR","gdpr",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]