ΔΔΚ - 1421/2022

Summary

A Cypriot court annulled a €5,000 fine issued by the Commissioner for Personal Data Protection against the Pancyprian Judo Federation for failing to cooperate with an investigation. The court held that the DPA had not sufficiently established that the federation acted as either a data controller or processor under GDPR, a prerequisite for applying Articles 31, 58, and 83.

Full text

Help ΔΔΚ - 1421/2022: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editNewer edit →VisualWikitext Revision as of 15:13, 28 May 2026 view sourceDs (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators61 editsmTag: Visual edit← Older edit Revision as of 08:15, 29 May 2026 view source Ap (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators661 editsm Tag: Visual editNewer edit → Line 59: Line 59: |Party_Link_4=|Party_Link_4= |Appeal_From_Body=Commissioner for Personal Data Protection|Appeal_From_Body=Commissioner (Cyprus) |Appeal_From_Case_Number_Name=11.17.001.009.246/11.05.2022|Appeal_From_Case_Number_Name=11.17.001.009.246/11.05.2022 |Appeal_From_Status=|Appeal_From_Status= Revision as of 08:15, 29 May 2026 ΔΔΚ - 1421/2022 Court: ΔΔΚ (Cyprus) Jurisdiction: Cyprus Relevant Law: Article 4(7) GDPR Article 4(8) GDPR Article 31 GDPR Article 58(2) GDPR Article 83 GDPR Decided: 20.05.2026 Published: Parties: Pancyprian Judo Federation Commissioner for Personal Data Protection National Case Number/Name: 1421/2022 European Case Law Identifier: Appeal from: Commissioner (Cyprus)11.17.001.009.246/11.05.2022 Appeal to: Unknown Original Language(s): Greek Original Source: CYLAW (in Greek) Initial Contributor: ds A court annulled the DPA’s €5,000 fine against an athletic federation for failure to cooperate, holding that it had not established that the federation was a controller or processor under the GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On 3 November 2021, a data subject filed a complaint with the Cypriot DPA against an individual who managed a club affiliated with the Pancyprian Judo Federation. The complaint concerned the unauthorised publication of photos and other material, including material depicting the data subject’s minor child, in the context of Pancyprian under-18 judo matches held under the federation’s auspices. On 13 December 2021, the DPA requested various information from the federation. The federation did not respond. The DPA then sent a reminder on 25 January 2022, but the federation again failed to respond. Subsequently, on 30 March 2022 the DPA issued a prima facie decision finding a breach of Article 31 GDPR due to the federation’s lack of cooperation and invited the federation to submit its position. The federation did not respond to this either. On 11 May 2022, the DPA issued the contested decision, finding that the federation had failed to cooperate with it despite repeated requests. It imposed a €5,000 fine for breach of Article 31 GDPR. The federation appealed against the decision, arguing that it was based on an incorrect application of the GDPR and contained legal and factual errors. Holding The court noted that, for Article 31 GDPR, Article 58 GDPR and Article 83 GDPR to apply, the federation had to qualify as either a controller or a processor. The court found that the federation did not fall within the definition of processor under Article 4(8) GDPR. It noted that the DPA did not appear to have treated it as such. The court then examined whether the federation could be considered a controller under Article 4(7) GDPR. It held that the contested decision did not clearly explain why the DPA had classified the federation as a controller. The court inferred that the DPA may have reached this conclusion because the federation had forwarded a letter concerning a past personal data breach to all its members at the request of a lawyer from one of its member clubs. However, the court rejected this reasoning. It held that the federation had merely forwarded the letter and had not given any instructions regarding the purposes or means of processing personal data. The DPA had not investigated whether the federation, either alone or jointly with its members, determined the purposes or means of the processing. Nor could such involvement be presumed merely because the federation had registered member clubs. The court concluded that, since the federation did not qualify as either a controller or a processor, Article 31 GDPR, Article 58(2) GDPR and Article 83 GDPR did not apply. It annulled the contested decision and ordered the DPA to pay €2,000 plus VAT in costs to the federation. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details. CYPRUS BAR ASSOCIATION Search - List of Administrative Court Decisions - Display Reports (Noteup on) - Remove Underlining ADMINISTRATIVE COURT (Case No. 1421/2022) May 20, 2026 [MICHAEL, D/to the D.D.] PANGYPRIAN JUDO FEDERATION Applicant v. OFFICE OF THE PERSONAL DATA PROTECTION COMMISSIONER Wherein the Application .......... C. Siakalli (Ms.) for Orphanides, Christofides and Associates D.E.P.E., for the applicant. Th. Hadjiloukas for Attorney General, for the defendant in the application. DECISION MICHAEL, D.D.D.: The applicant, with the present appeal, requests the annulment of the decision of the defendant in the application dated 11.5.2022 by which it imposed an administrative fine of €5,000 on the applicant. On 3.11.2021, a complaint was filed against a person who maintains a club registered with the applicant for the unauthorized publication of photographic and other material, including the minor child of the complainant, in the context of the national judo competitions for under-18s held under the auspices of the applicant. The defendant in the application, by letter dated 13.12.2021, requested various information from the applicant. The applicant did not respond. On 31.3.2022, the defendant in the application proceeded to issue a prima facie decision finding a violation of Article 31 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the "General Regulation") due to the lack of cooperation by the applicant and granting the applicant the right to submit its positions regarding the content of the letter and the reasons why no sanction should be imposed on it. The applicant did not respond to this letter either and thus the contested decision was issued on 11.5.2022. The applicant suggests that the contested decision was taken on the basis of incorrect application of the General Regulation and under legal and factual error. As follows from points C and D of the contested decision entitled “Reasoning” and “Conclusion” respectively, the defendant in the application ruled that: “24. On December 13, 2021, in the context of investigating the said complaint, the Federation was requested to provide my Office with specific information directly related to the incident under investigation. After the first deadline that had been set (December 31, 2021) had passed, a reminder letter was sent on January 25, 2022, with a new deadline for response on February 2, 2022. The new deadline also passed, without any response from the Federation on the questions that had been raised and which are directly related to the complaint under investigation. Subsequently, on March 30, 2022, my prima facie decision was issued, in which I identified a violation of the provisions of the Regulation and in particular Article 31. This decision was notified to the Federation. 25. Based on Article 31 of the Regulation, the Federation should have cooperated with my Office, formulating its positions on the matter as requested, which it has not done to date. 26. Taking into account the above and the fact that the Federation has not sent its own positions to date, I note, once again, a lack of cooperation with my Office by the Federation and therefore a violation of Article 31 of the Regulation. D. Conclusion 27. Having regard t

Entities