News

Cyprus DPC Rulings on Data Breaches by the Cyprus Football Association, Cyprus News Agency, and Arktinos Publications Ltd

On 17 June 2024, the Commissioner for Data Protection of Cyprus published her decisions (issued in February 2024) in relation to three similar complaints for infringement of the provisions of Chapter V of the GDPR due to the use of Google Analytics and Facebook Connect and the transfer of personal data to the United States of America.

Background

A total of 101 similar complaints were lodged in August 2020 following the decision against companies based in 30 EU and EEA Member States and the European Data Protection Board has set up a task force for uniform handling of complaints.

The complaints were also filed against Google and Facebook for continuing to accept the data transfers.

The European Data Protection Board (EPDB) also set up a task force to promote a consistent approach fir the handling of these 101 identical complaints through the cooperation and effective exchange of information between the supervisory authorities.

The complaints were initially submitted to the Austrian Data Protection Supervisory Authority in the aftermath of the CJEU Schrems II judgment, by an Austrian resident who was represented by the non-profit organization noyb – European Centre for Digital Rights, which was founded by lawyer and data protection activist Maximillian Schrems, in accordance with Article 80 (1) of the GDPR.

The complaints that were forwarded to the Commissioner for Data Protection of Cyprus were filed against:

1. the Cyprus Football Association and Google LLC
2. the Cyprus News Agency and Google LLC and
3. "ARKTINOS" Publications Ltd (Newspaper POLITIS)  Facebook Ireland Ltd and Facebook Inc.

 

The Complaint and Decision against Cyprus Football Association and Google LLC

Cyprus Football Association (“CFA”) is a legal entity which is based and operates only in the Republic of Cyprus. The objectives of CFA include the organization and supervision of football in Cyprus and its promotion internationally.

CFA is a member of FIFA and UEFA.

CFA decided to integrate Google Analytics tool into cfa.com.cy website to personalize content, to provide functional means and to analyze browsing of their website.

According to the relevant complaint and decision of the Commissioner, the Complainant visited the official website of CFA (http://cfa.com.cy) while being logged in to the Google account that was associated with the Complainant’s email address.  CFA had embedded the HTML code for Google Services (including Google Analytics) on their website and the installation of the tool resulted in the transmission of data of the Complainant to the USA.

The Commissioner decided that because of CFA’s, decision to integrate the Google Analytics tool to its website, CFA were the controllers for the processing under investigation.

As controllers, they were required to take all measures not to undermine the level of protection of personal data which they process or which they entrust to a processor.

The Commissioner concluded that CFA failed to demonstrate that the level of protection of natural persons guaranteed by the GDPR is not undermined due to the transfer. However, the Commissioner found that no violation of Article 44 of the GDPR by Google LLC can be established under the circumstances.

Based on all the evidence before her, the Commissioner considered that an administrative fine was not justified under the circumstances but decided to issue a reprimand to CFA for violating Article 44 of the GDPR, and an order that CFA must ensure that any future transfer can take place on the basis of the new EU-US Data Privacy Framework and the Commission Implementing Decision (EU) 2023/1795, or on the basis of an appropriate safeguard pursuant to Article 46 of the GDPR.

 

The Complaint and Decision against Cyprus News Agency and Google LLC

The Cyprus News Agency  (“CNA”) is a legal entity governed by public law and operating under the Cyprus News Agency Law.

It is governed by a seven-member Board of Directors consisting mainly of journalists representing the Cyprus Journalists Union, the Cyprus Newspaper and Magazine Publishers Association, the Cyprus Broadcasting Corporation, the Press and Information Office and the Ministry of Interior.

CNA decided to integrate Google Analytics tool into www.cna.org.cy website to personalize content, to provide functional means and to analyze browsing of their website.

According to the relevant complaint and decision of the Commissioner, the Complainant visited the official website of CAN (http://www.cna.org.cy) while being logged in to the Google account that was associated with the Complainant’s email address. CNA had embedded the HTML code for Google Services (including Google Analytics) on their website and the installation of the tool resulted in the transmission of data of the Complainant to the USA.

The Commissioner decided that because of CNA’s, decision to integrate the Google Analytics tool to its website, CNA were the controllers for the processing under investigation.

As controllers, they were required to take all measures not to undermine the level of protection of personal data which they process or which they entrust to a processor.

The Commissioner concluded that CNA failed to prove its compliance with Rule 5(1) of the GDPR and failed to demonstrate that the level of protection of natural persons guaranteed by the GDPR is not undermined due to the transfer. However, the Commissioner found that no violation of Article 44 of the GDPR by Google LLC can be established under the circumstances.

Based on all the evidence before her, the Commissioner considered that an administrative fine was not justified under the circumstances but decided to issue a reprimand to CNA for violating Article 5(2) of the GDPR, a reprimand for violating Article 44 of the GDPR, and an order that CNA must ensure that any future transfer can take place on the basis of the new EU-US Data Privacy Framework and the Commission Implementing Decision (EU) 2023/1795, or on the basis of an appropriate safeguard pursuant to Article 46 of the GDPR.

 

The Complaint and Decision against "Arktinos" Publications Ltd (POLITIS newspaper), Facebook Ireland Ltd and Facebook Inc.

Arktinos Publications Lts  (“Arktinos”) is a legal entity registered in Cyprus and the publisher of the daily newspaper “Politis”.

According to the relevant complaint and decision of the Commissioner, the Complainant visited the website of the “Politis” newspaper at (http://politis.com.cy ) while being logged in to his email and Facebook account.  Arktinos had embedded the HTML code for Facebook Pixel tool on their website and the installation of the tool resulted in the transmission of data of the Complainant to Facebook Inc in the United States of America.

The Commissioner decided that because of Arktinos’ decision to integrate the Facebook Pixel tool to its website, Arktinos were the controllers for the processing under investigation.

As controllers, they were required to take all measures not to undermine the level of protection of personal data which they process or which they entrust to a processor.

The Commissioner concluded that Arktinos failed to prove its compliance with Rule 5(1) and 5(2) of the GDPR and failed to demonstrate that the level of protection of natural persons guaranteed by the GDPR is not undermined due to the transfer in violation of Article 44 of the GDPR. However, the Commissioner found that no violation of Article 44 of the GDPR by Facebook Inc. can be established under the circumstances.

Based on all the evidence before her, the Commissioner considered that an administrative fine was not justified under the circumstances but decided to issue a reprimand to Arktinos for violating Article 5(2) of the GDPR, a reprimand for violating Article 44 of the GDPR, and an order that Arktinos must ensure that any future transfer can take place on the basis of the new EU-US Data Privacy Framework and the Commission Implementing Decision (EU) 2023/1795, or on the basis of an appropriate safeguard pursuant to Article 46 of the GDPR.

 

Article provided by INPLP member: Yiannis Karamanolis (Karamanolis & Karamanolis LLC, Cyprus)

 

 

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)