Commissioner (Cyprus) - Online Platform “Agora”

Summary

The Cypriot Data Protection Authority (DPA) fined a Member of the European Parliament (MEP) €6,000 for failing to cooperate with its investigation into his online platform, "Agora". The MEP refused repeated requests to suspend the platform's operations, which involved processing sensitive data like political opinions and biometric information, and submitted an incomplete Data Protection Impact Assessment (DPIA). The DPA emphasized that cooperation with supervisory authorities is an autonomous obligation.

Full text

Help Commissioner (Cyprus) - Online Platform “Agora”: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editNewer edit →VisualWikitext Revision as of 09:24, 25 September 2026 view sourceApostolos (talk | contribs)16 edits Tag: Visual edit← Older edit Revision as of 08:23, 28 September 2026 view source Apostolos (talk | contribs)16 editsmTag: Visual editNewer edit → Line 96: Line 96: }}}} The Cypriot DPA fined an MEP €6,000 for failing to cooperate with the supervisory authority under [[Article 31 GDPR]], after he refused to fully comply with repeated requests to temporarily suspend the operations of his online platform "Agora".The DPA fined an MEP €6,000 for failing to cooperate with the supervisory authority under [[Article 31 GDPR]], particularly, after he refused to fully comply with repeated requests to temporarily suspend the operations of his online platform "Agora". == English Summary ==== English Summary == Revision as of 08:23, 28 September 2026 Commissioner - Online Platform “Agora” Authority: Commissioner (Cyprus) Jurisdiction: Cyprus Relevant Law: Article 31 GDPR Article 35 GDPR Article 36 GDPR Article 58(2)(i) GDPR Article 83(4)(a) GDPR Type: Investigation Outcome: Violation Found Started: 29.10.2025 Decided: 17.09.2026 Published: 22.09.2026 Fine: 6,000 EUR Parties: n/a National Case Number/Name: Online Platform “Agora” European Case Law Identifier: n/a Appeal: Unknown Original Language(s): Greek Original Source: Commissioner (Cyprus) (in EL) Initial Contributor: Apostolos Karasakalidis The DPA fined an MEP €6,000 for failing to cooperate with the supervisory authority under Article 31 GDPR, particularly, after he refused to fully comply with repeated requests to temporarily suspend the operations of his online platform "Agora". Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts In October 2025, the DPA initiated an ex officio investigation after discovering that the digital platform/application "Agora" was launched under the responsibility of an MEP, the controller. The platform offered user participation in opinion polls, expression of political opinions, and applications for parliamentary candidacy. It also required user identification through ID cards and biometric data analysis. Because of large-scale processing and the involvement of special categories of data (political opinions), the DPA requested that the controller submit a Data Protection Impact Assessment (DPIA) for prior consultation under Articles 35 and 36 GDPR. The DPA also repeatedly requested the controller to temporarily suspend the platform's operation until the consultation process was concluded. Subsequently, the controller submitted an incomplete DPIA with pending mitigation measures and only partially suspended certain features (such as voting mechanisms and candidate data collection). However, on 23 February 2026, the DPA found that personal data processing was still ongoing, including user registration, identity verification, and access to candidate profiles. On the same day, the controller publicly stated in a livestream that there was "no chance" he would take down the app. Holding The DPA stressed that the controller’s obligation to cooperate with the supervisory authority is autonomous. An infringement does not require a prior determination of substantive non-compliance (e.g., regarding legal basis or security measures) or proof of actual harm to data subjects. Following, the DPA held that the controller violated his obligation to cooperate with the supervisory authority under Article 31 GDPR and imposed an administrative fine of €6,000 under Article 58(2)(i) and Article 83(4)(a) GDPR. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details. Republic of Cyprus OFFICE OF THE COMMISSIONER FOR THE PROTECTION OF PERSONAL DATA DECISION App AND/OR THE “Agora” ONLINE PLATFORM Retrieved from "https://gdprhub.eu/index.php?title=Commissioner_(Cyprus)_-_Online_Platform_“Agora”&oldid=53194" Categories: Commissioner (Cyprus)CyprusArticle 31 GDPRArticle 35 GDPRArticle 36 GDPRArticle 58(2)(i) GDPRArticle 83(4)(a) GDPR2026Greek This page was last edited on 28 September 2026, at 08:23. Content is available under Creative Commons Attribution-NonCommercial-ShareAlike unless otherwise noted. Privacy policy About GDPRhub Disclaimers

Entities