ΔΔΚ - 688/2022

Summary

A Cypriot court has upheld a €10,000 fine imposed by the Data Protection Authority (DPA) on a media group. The fine was issued over a TV report that disclosed a public figure's financial data. The court found that the media company failed to adequately balance journalistic freedom with data protection rights.

Full text

Help ΔΔΚ - 688/2022: Difference between revisions From GDPRhub Jump to:navigation, search Newer edit →VisualWikitext Revision as of 07:43, 12 June 2026 view sourceDs (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators94 edits Tag: submission [1.0] Revision as of 07:47, 17 June 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators94 editsmTag: Visual editNewer edit → Line 70: Line 70: }}}} A court upheld the DPA’s €10,000 fine against a media group over a TV report disclosing a public figure’s financial data, finding that it failed to properly balance journalistic freedom with data protection rights.A court upheld a €10,000 fine against a media company over a TV report disclosing a public figure’s financial data, finding that the media company failed to properly balance its journalistic interest with data protection rights. == English Summary ==== English Summary == Line 85: Line 85: Accordingly, the DPA fined the controller €10,000 and ordered it to remove the publication from the websites of all entities controlled by it within one week.Accordingly, the DPA fined the controller €10,000 and ordered it to remove the publication from the websites of all entities controlled by it within one week. The controller challenged the decision before the Administrative Court of Cyprus. It argued, among other things, that the DPA had violated its right to freedom of expression and its exercise of journalistic freedom under [[Article 85 GDPR|Article 85 GDPR]].The controller challenged the decision before the Administrative Court of Cyprus. It argued, among other things, that the DPA had violated its right to freedom of expression and its exercise of journalistic freedom under [[Article 85 GDPR]]. === Holding ====== Holding === Revision as of 07:47, 17 June 2026 ΔΔΚ - 688/2022 Court: ΔΔΚ (Cyprus) Jurisdiction: Cyprus Relevant Law: Article 5(1)(a) GDPR Article 5(1)(c) GDPR Article 5(1)(d) GDPR Article 85 GDPR Decided: 26.05.2026 Published: Parties: Ekdotikos Oikos Dias Dimosia Ltd Commissioner for Personal Data Protection National Case Number/Name: 688/2022 European Case Law Identifier: Appeal from: Commissioner for Personal Data Protection4/2/2022 Appeal to: Unknown Original Language(s): Greek Original Source: CYLAW (in Greek) Initial Contributor: ds A court upheld a €10,000 fine against a media company over a TV report disclosing a public figure’s financial data, finding that the media company failed to properly balance its journalistic interest with data protection rights. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts On 13 March 2019, Sigma, a Cypriot TV channel belonging to Ekdotikos Oikos Dias Dimosia Ltd, a Cypriot media group (the controller), published a report disclosing financial information concerning a public figure in Cyprus (the data subject). The publication was part of reporting on whether there had been favourable treatment of a politically exposed person. On 15 April 2019, the data subject lodged a complaint with the Cypriot DPA concerning the disclosure of their financial personal data by media outlets belonging to the controller’s group. The DPA found that the controller had failed to properly balance the journalistic interest in publication against the data subject’s rights to privacy and data protection. In particular, the DPA considered that the controller had failed to demonstrate that it had taken into account certain balancing criteria, including whether the processing was carried out exclusively for journalistic purposes, whether it was strictly necessary to ensure the right to information on matters of public interest, whether the information was accurate and truthful, and whether there had been prior contact with the data subject. The DPA held that, by publishing information concerning the data subject’s financial situation, the controller had infringed the principles of lawfulness, fairness and transparency, data minimisation and accuracy. Therefore, it found that the controller infringed Article 5(1)(a) GDPR, Article 5(1)(c) GDPR and Article 5(1)(d) GDPR. Accordingly, the DPA fined the controller €10,000 and ordered it to remove the publication from the websites of all entities controlled by it within one week. The controller challenged the decision before the Administrative Court of Cyprus. It argued, among other things, that the DPA had violated its right to freedom of expression and its exercise of journalistic freedom under Article 85 GDPR. Holding The court found that the DPA had not violated the controller’s freedom of expression or journalistic freedom. It determined that the DPA had examined whether the controller had exceeded what was necessary for the journalistic purpose pursued. The court held that the DPA had sufficiently explained how journalistic freedom must be balanced against the principle of proportionality. It confirmed the DPA’s conclusion that the controller had failed to carry out properly that balancing. The court dismissed the appeal and upheld the DPA’s decision. It also awarded €2,000 in costs against the controller. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details. CYPRUS BAR ASSOCIATION Search - List of Administrative Court Decisions - Display Reports (Noteup on) - Remove Underlining ADMINISTRATIVE COURT (Case No. 688/2022) 26 May 2026 [MICHAEL, D/at D.D.] DIAS PUBLISHING HOUSE LIMITED Applicant v. OF THE REPUBLIC OF CYPRUS, THROUGH THE PERSONAL DATA PROTECTION COMMISSIONER In whose name the Application .......... S. A. Angelides for Andreas S. Angelides D.E.P.E., for the applicant. Th. Piperi - Christodoulou (Ms.) for Attorney General, for the defendant in the application. DECISION MICHAEL, D.D.D.: The applicant, with the present appeal, requests the annulment of the decision of the defendant in the application dated 4.2.2022, by which it ruled that the applicant violated Articles 5(1)(a), (c) and (d) of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the "General Regulation") and imposed on the applicant an administrative fine of €10,000. On 15.4.2019, a person submitted a written complaint to the respondent regarding the publication of personal data by mass media belonging to the applicant's group. By letter dated 28.5.2019, the respondent requested the applicant to submit its positions, which it did by letter dated 28.6.2019. This was followed on 24.5.2021 by the issuance of a decision by which the respondent concluded that the General Regulation had been violated and invited the applicant to submit any mitigating factors so that an administrative fine would not be imposed on her. The applicant responded on 17.6.2021 and on 4.2.2022, the respondent issued the decision contested in the present appeal. The applicant suggests that the contested decision is flawed because the applicant is not the legally responsible party but other legal entities are responsible, because her right to a prior hearing was violated due to the fact that she was never notified of the text of the complaint, because the amount of the administrative fine is not justified, because the right to freedom of expression and the exercise of journalism protected by Article 85 of EC 679/2016 is violated and due to the lack of proper investigation and justification. The defendant in the application in its letter to the applicant dated 28.5.2019 recorded the following: “3.1 According to the information that the complainant presented before me in a SIGMALIVE publication dated 13/3/2019 entitled "EXCLUSIVE: New names of politically expos

Entities