Commissioner (Cyprus) - Online Platform “Agora”

The core failure here was a deliberate refusal to cooperate with a supervisory authority and an inadequate Data Protection Impact Assessment (DPIA) for a platform processing highly sensitive data including political opinions and biometric information. Under GDPR, conducting a thorough DPIA before processing high-risk data is mandatory, not optional, and cooperation with Data Protection Authorities (DPAs) is an independent legal obligation regardless of the data controller's status or position. Submitting an incomplete DPIA signals a fundamental gap in privacy-by-design practices and risk management culture. This case matters because it demonstrates that no individual or organization—regardless of political standing—is exempt from GDPR obligations, and non-cooperation compounds regulatory penalties significantly.