Source: https://www.whitecase.com/publications/article/gdpr-guide-national-implementation-cyprus
Timestamp: 2019-12-08 14:00:29
Document Index: 144332080

Matched Legal Cases: ['Art. 23', 'Art. 49', 'Art. 49', 'Art. 46', 'Art. 42', 'Art. 6']

GDPR Guide to National Implementation: Cyprus | White & Case LLP
GDPR Guide to National Implementation: Cyprus
Law providing for the protection of natural persons with regard to the processing of personal data and for the free movement of such data (Law 125(I) of 2018) (the “Data Protection Act”)
Link: In English: see here
Regulation of Electronic Communications and Postal Services Law (Law 112(I) of 2004, as amended)
Date in force: 30 April 2004
There are no specific rules governing this issue
Genetic and biometric data cannot be processed for the purposes of obtaining medical and life insurance, even if the data subject has consented.
The controller may not use personal data obtained from processing for archiving purposes, scientific or historical purposes, or statistical purposes to make a decision which has legal effects on the data subject or similarly significantly affects him or her.
Processing genetic and biometric data for the purposes of obtaining medical and life insurance is prohibited.
The right to be provided information applies to the extent that it does not impair the right to freedom of expression and information and journalistic secrecy when processing (of all categories of personal data) is carried out for journalistic or academic purposes or for purposes of artistic or literary expression.
Where an Impact Assessment and prior consultation with the DPA have been carried out, a controller or processor may implement measures to restrict, wholly or partly, the rights referred to in Arts. 12, 18, 19 & 20 GDPR.
Furthermore, where a data breach has taken place, provided that an Impact Assessment and a prior consultation with the DPA have been carried out, a controller may be exempt from the obligation to communicate a personal data breach to the data subject, wholly or partly, for one or more of the purposes referred to in Art. 23(1) GDPR.
An Impact Assessment and consultation with the DPA must be carried out in the following circumstances:
where a controller or processor implements measures to restrict, wholly or partly, the rights referred to in Arts. 12, 18, 19 & 20 GDPR;
where a data breach has taken place;
where the combination of large-scale filing systems by two or more public authorities relates to sensitive personal data or to personal data relating to criminal convictions and offences, or is to be carried out with the use of the identity card number or any other identifier of general application;
prior to the adoption of a new statute or regulation which regulates a specific processing operation or set of operations by the parliament in Cyprus; or
where a controller or processor transfers sensitive personal data to a third country or an international organisation based on the derogations set out in Art. 49 GDPR.
Prior authorisation from the DPA is only required in accordance with the provisions of the GDPR as well as under the circumstances set out in Q11 above.
The DPA may establish and make public a list of additional processing operations and cases requiring the designation of a DPO. At present, no such list appears to have been published.
The DPO is bound by obligations of professional secrecy or confidentiality in the performance of his or her duties, subject to the provisions of any law regulating issues of professional secrecy or confidentiality. However, these obligations do not affect the DPA’s investigative powers.
Data transfers are subject to the following additional restrictions:
where a controller or processor transfers sensitive personal data to a third country or an international organisation, which is based on derogations for specific situations provided for in Art. 49 GDPR, an Impact Assessment and consultation with the DPO must be carried out; and
where the controller or processor intends to transfer sensitive personal data to a recipient in a third country or to an international organisation and the intended transfer is based on appropriate safeguards provided for in Art. 46 GDPR or on BCRs, the controller or processor must inform the DPA of the intended transfer prior to the transfer. The DPA may, for reasons of public interest, impose explicit limits on the controller or processor regarding the relevant transfer. Nevertheless, before imposing such limits, the DPA must consult, where appropriate, the Commission, the Council, the lead DPA and other concerned DPAs of Member States.
Name of DPA: Office of the Commissioner for Personal Data Protection
Address: Iasonos 1, 1082 Nicosia, Cyprus
Website: dataprotection.gov.cy
The DPA has the right to obtain access, without necessarily informing the controller or the processor or their representative in advance, to any premises of the controller or the processor (including means of transport), with the exception of residences.
In the exercise of its investigative powers, the DPA may seize documents or electronic equipment by virtue of a search warrant in accordance with criminal legal procedure.
With regard to authorisation and advisory powers, the DPA has the power to:
authorise the combination of public filing systems provided;
impose terms and conditions in relation to the application of the measures for the restriction of the rights of data subjects;
impose terms and conditions for the exemption to the obligation to communicate the data breach to the data subject;
impose explicit limits on the transfer of sensitive personal data referred; and
recommend to the Minister of Justice the entry into agreements with other countries and establish and sign Memoranda of Understanding with third countries, in the absence of a binding legal measure taken by the Commission.
The DPA must notify the Attorney General of the Republic and/or the police of any infringement of the provisions of the GDPR or the national law which may constitute a criminal offense in accordance with provisions of the national law.
The decisions of the DPA may be appealed before the Administrative Court.
The DPA has access to all the personal data and to all the information required for the performance of its tasks, including confidential information, except where information is covered by legal professional privilege.
An administrative fine imposed on a public authority carrying out not-for-profit activities must not exceed €200,000.
The following additional penalties or sanctions are available:
imprisonment which must not exceed three years and/or a fine which must not exceed €30,000 (for breach of, inter alia, Arts. 30, 31, 33(1)-(2), 34, 35(1) & 42 GDPR or the provisions of Chapter V GDPR);
imprisonment which must not exceed one year and/or a fine which must not exceed €10,000 (for a breach in relation to processing which is not covered by a specific offence, or where a public authority combines large-scale filing systems in breach of the law); or
imprisonment which must not exceed five years and/ or a fine which must not exceed €50,000 (for breach by a natural person of obligations relating to transfers, Art. 42 GDPR, and the duty to not obstruct the work of the DPO).
The processing of personal data, sensitive personal data or personal data relating to criminal convictions and offenses, when carried out for journalistic or academic purposes or for purposes of artistic or literary expression, is permitted provided that those purposes are proportionate to the aim pursued and the data subject’s ECHR rights. Furthermore, the provisions of Arts. 14 & 15 GDPR do apply to the extent that they do not impair the right to freedom of expression and information and journalistic secrecy.
Without prejudice to the provisions of Art. 6(1)(e) GDPR, the processing of personal data is permitted and is lawful when it is carried out by:
courts acting in their judicial capacity for the purpose of delivering justice, including the processing of personal data necessary for the publication and adoption of decisions of any court; and
the Cyprus Parliament, provided such processing is carried out within its powers.
In relation to the Courts’ decisions, the processing of sensitive data is permitted and lawful in the following situations:
when it is carried out for the purpose of publishing or issuing a decision of any court; or
when it is necessary for the purpose of delivering justice.
Personal data in official documents held by a public authority or entity performing a task in the public interest must be disclosed in accordance with the specific provisions relating to access to information from public authorities.
issuing a fine of €10,000 to a newspaper for releasing the names of police members involved in an ongoing investigation;
issuing a fine for €5,000 to a medical centre for the loss of a patient’s medical file;
issuing a reprimand, without fine, to the Ministry of Education for sending emails relating to a government decision to the personal email addresses of school teachers located on a database solely intended for administrative purposes;
issuing a reprimand, without fine, to a municipal authority for the unauthorised sharing of personal data;
issuing a reprimand, without fine, to a doctor for releasing the picture of a patient to the public without prior authorisation; and
issuing a reprimand, without fine, to a university refusing a data subject the right to access their job evaluations and references.
guidance on trade union membership disclosure; (see here (in Greek));
guidance on CCTV in the workplace, and guidance on the use of biometric data; and (see here (in Greek)); and
guidance on access to emails of current and former employees (see here (in Greek)).
Chrysses Demetriades & Co. contributors
Partner, Chrysses Demetriades & Co.
T +357 25 800236
Polyvios’s practice focuses on Dispute Resolution, EU & Competition and Data Protection. He heads the Competition and the Data Protection teams at Chrysses Demetriades & Co. LLC. The Data Protection team at Chrysses Demetriades & Co. LLC advises multinational and domestic clients spanning across various sectors such as shipping, insurance, advertising and hotels with respect to European and Cyprus Data Protection law compliance and investigations.
Christos Malikkidis
Associate, Chrysses Demetriades & Co.
T +357 25 800275
Associate, Chrysses Demetriades & Co. Christos is an active member of the Data Protection team of Chrysses Demetriades & Co. LLC and is regularly involved in the preparation of privacy policies, relevant data protection agreements and consent forms. He also provides e-privacy and direct marketing advice and assists clients with data breach incidents and international data transfers.