26 Mar 2019
A financial penalty of €10,000 was imposed on a local newspaper by the Office of the Cyprus Data Protection Commissioner for unlawful disclosure of the names and photos of police officers.
On June 17, 2018 the publication of the newspaper, both in paper and online version, allegedly stated inconvenience, unnecessary and unlawful detention of a citizen, and revealed the names and photos of the two police investigators involved, as well as, the photo of a third police investigator. According to the Commissioner, in this case the aim pursued could have been achieved by mentioning only the initials of the police investigators’ names and/or by showing their faces blurred and/or by publishing photos taken from a long distance so that it would be impossible to identify the persons.
After having taken into consideration relevant judgments of the EU Court of Justice and the European Court of Human Rights, as well as, decisions of other Data Protection Authorities, the Commissioner decided to impose a €10,000 fine on the newspaper for violating the principles of articles 5 §1c and 6 of the GDPR. As far the article 5 §1c of the GDPR is concerned, it provides that personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimization’) while article 6 of the GDPR refers to the lawfulness of processing.
All in all, the main issue that the Commissioner had to handle in this case was the balance between the freedom of expression and the right to privacy.