Cyprus
Other chapters
Foreword and issue-by-issue comparison
Cyprus
Get your copy
Request a hard copy of the GDPR Guide to National Implementation »
In this chapter:
Q1/ Applicable legislation
(a) Have the requirements of the GDPR been addressed by introducing a new law, or by updating existing legislation?
New legislation has been passed.
———
(b) Relevant legislation includes:
- Law providing for the protection of natural persons with regard to the processing of personal data and for the free movement of such data (Law 125(I) of 2018) (the “Data Protection Act”)
- Date in force: 31 July 2018
- Link: In English: see here
- Regulation of Electronic Communications and Postal Services Law (Law 112(I) of 2004, as amended)
- Date in force: 30 April 2004
- Link: In English: see here
———
(c) What is the status of national pre-GDPR data protection law?
The relevant pre-GDPR legislation has been repealed in full.
Q2/ Personal data of deceased persons
Does national law make specific rules regarding the processing of personal data of deceased persons?
There are no specific rules governing this issue.
Q3/ Legal bases for processing
(a) Does national law make specific rules regarding the processing of personal data in compliance with a legal obligation?
There are no specific rules governing this issue.
———
(b) Does national law make specific rules regarding the processing of personal data for the performance of tasks carried out in the public interest?
There are no specific rules governing this issue
———
(c) Does national law make specific rules regarding the processing of personal data in the exercise of official authority vested in the controller?
There are no specific rules governing this issue.
———
(d) Does national law contain criteria in addition to those listed in the GDPR, to determine whether processing for a new purpose is compatible with the purpose for which the personal data were initially collected?
There are no specific additional criteria governing this issue.
Q4/ Consent of children
At what age can a child give their consent to processing in relation to ISS?
14 years of age.
Q5/ Processing of sensitive personal data
(a) Are there any sensitive personal data which cannot be processed on the basis of a data subject’s consent?
Genetic and biometric data cannot be processed for the purposes of obtaining medical and life insurance, even if the data subject has consented.
———
b) Does national law contain any specific requirements regarding the processing of sensitive personal data in respect of the following:
(i) Employment, social security and/or social protection law
There are no specific rules on processing this category of data.
(ii) Substantial public interest
There are no specific rules on processing this category of data.
(iii) Preventative or occupational medicine; employee working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems or services
There are no specific rules on processing this category of data.
(iv) Public interest in the area of public health
There are no specific rules on processing this category of data.
(v) Archiving purposes, scientific or historical research purposes or statistical purposes
The controller may not use personal data obtained from processing for archiving purposes, scientific or historical purposes, or statistical purposes to make a decision which has legal effects on the data subject or similarly significantly affects him or her.
———
(c) Has national law introduced any further conditions and/ or limitations with regard to the processing of genetic data, biometric data, or health data?
Processing genetic and biometric data for the purposes of obtaining medical and life insurance is prohibited.
Q6/ Data relating to criminal offences or convictions
Under what conditions does national law permit the processing of personal data relating to criminal convictions?
There are no specific rules on processing this category of data.
Q7/ Exemptions
(a) Does national law specify exemptions to a data subject’s right to erasure?
There are no specific exemptions to the right to erasure.
———
(b) Does national law specify exemptions to a data subject’s right to be provided information under Art. 14 GDPR where the personal data has not been obtained from the data subject?
The right to be provided information applies to the extent that it does not impair the right to freedom of expression and information and journalistic secrecy when processing (of all categories of personal data) is carried out for journalistic or academic purposes or for purposes of artistic or literary expression.
———
(c) Does national law specify exemptions to a data subject’s right to not be subject to a decision based solely on automated processing, including profiling?
There are no specific exemptions to the right to not be subject to automated individual decision-making.
Q8/ Restrictions on data subjects’ rights
Aside from the exemptions noted in Q7, does national law contain any other restrictions on the rights of data subjects under Chapter III GDPR?
Where an Impact Assessment and prior consultation with the DPA have been carried out, a controller or processor may implement measures to restrict, wholly or partly, the rights referred to in Arts. 12, 18, 19 & 20 GDPR.
Furthermore, where a data breach has taken place, provided that an Impact Assessment and a prior consultation with the DPA have been carried out, a controller may be exempt from the obligation to communicate a personal data breach to the data subject, wholly or partly, for one or more of the purposes referred to in Art. 23(1) GDPR.
Q9/ Joint controllership
Does national law provide rules or guidance on the apportionment of responsibility between joint controllers?
There are no additional rules on apportionment of liability between joint controllers.
Q10/ Processor
In addition to the contract between controller and processor, are there any pieces of legislation which govern processing by a processor?
There are no additional pieces of legislation.
Q11/ Impact Assessments
Are there any circumstances in which national law requires an Impact Assessment to be carried out, where the GDPR would not otherwise require such an assessment?
An Impact Assessment and consultation with the DPA must be carried out in the following circumstances:
- where a controller or processor implements measures to restrict, wholly or partly, the rights referred to in Arts. 12, 18, 19 & 20 GDPR;
- where a data breach has taken place;
- where the combination of large-scale filing systems by two or more public authorities relates to sensitive personal data or to personal data relating to criminal convictions and offences, or is to be carried out with the use of the identity card number or any other identifier of general application;
- prior to the adoption of a new statute or regulation which regulates a specific processing operation or set of operations by the parliament in Cyprus; or
- where a controller or processor transfers sensitive personal data to a third country or an international organisation based on the derogations set out in Art. 49 GDPR.
Q12/ Prior authorisation and public interest
Are there any circumstances in which national law requires controllers to consult with, or obtain prior authorisation from, the DPA in relation to processing for the performance of a task carried out by the controller in the public interest (including processing in relation to social protection and public health)?
Prior authorisation from the DPA is only required in accordance with the provisions of the GDPR as well as under the circumstances set out in Q11 above.
Q13/ DPOs
(a) Does national law require controllers to appoint a DPO in circumstances other than those in Art. 37(1) GDPR?
The DPA may establish and make public a list of additional processing operations and cases requiring the designation of a DPO. At present, no such list appears to have been published.
———
(b) Does national law impose secrecy and confidentiality obligations on DPOs and if so, in what circumstances do they apply?
The DPO is bound by obligations of professional secrecy or confidentiality in the performance of his or her duties, subject to the provisions of any law regulating issues of professional secrecy or confidentiality. However, these obligations do not affect the DPA’s investigative powers.
Q14/ International data transfers
(a) Does national law make specific rules about transfers of personal data from public registers?
Data transfers from public registers are not subject to specific rules.
———
(b) Does national law restrict the transfer of specific categories of personal data to third countries?
Data transfers are subject to the following additional restrictions:
- where a controller or processor transfers sensitive personal data to a third country or an international organisation, which is based on derogations for specific situations provided for in Art. 49 GDPR, an Impact Assessment and consultation with the DPO must be carried out; and
- where the controller or processor intends to transfer sensitive personal data to a recipient in a third country or to an international organisation and the intended transfer is based on appropriate safeguards provided for in Art. 46 GDPR or on BCRs, the controller or processor must inform the DPA of the intended transfer prior to the transfer. The DPA may, for reasons of public interest, impose explicit limits on the controller or processor regarding the relevant transfer. Nevertheless, before imposing such limits, the DPA must consult, where appropriate, the Commission, the Council, the lead DPA and other concerned DPAs of Member States.
Q15/ DPAs
(a) Details of the DPA(s).
- Name of DPA: Office of the Commissioner for Personal Data Protection
- Address: Iasonos 1, 1082 Nicosia, Cyprus
- Postal Address: P.O. Box 23378, 1682 Nicosia, Cyprus
- Website: dataprotection.gov.cy
———
(b) If more than one national DPA has been established, what is the rationale behind multiple DPAs?
Not applicable as there is only one DPA.
———
(c) How does national law ensure consistent application of the GDPR by the various DPAs in accordance with Art. 63 GDPR?
Not applicable.
———
(d) Does national law grant the relevant DPA additional powers beyond those set out in Art. 58 GDPR?
The DPA has the right to obtain access, without necessarily informing the controller or the processor or their representative in advance, to any premises of the controller or the processor (including means of transport), with the exception of residences.
In the exercise of its investigative powers, the DPA may seize documents or electronic equipment by virtue of a search warrant in accordance with criminal legal procedure.
With regard to authorisation and advisory powers, the DPA has the power to:
- authorise the combination of public filing systems provided;
- impose terms and conditions in relation to the application of the measures for the restriction of the rights of data subjects;
- impose terms and conditions for the exemption to the obligation to communicate the data breach to the data subject;
- impose explicit limits on the transfer of sensitive personal data referred; and
- recommend to the Minister of Justice the entry into agreements with other countries and establish and sign Memoranda of Understanding with third countries, in the absence of a binding legal measure taken by the Commission.
The DPA must notify the Attorney General of the Republic and/or the police of any infringement of the provisions of the GDPR or the national law which may constitute a criminal offense in accordance with provisions of the national law.
———
(e) What national appeals process exists to enable parties to challenge the decisions of the DPA?
The decisions of the DPA may be appealed before the Administrative Court.
———
(f) Have specific national rules been adopted regarding the DPA’s power to obtain information from controllers or processors that are subject to obligations of professional secrecy (or equivalent)?
The DPA has access to all the personal data and to all the information required for the performance of its tasks, including confidential information, except where information is covered by legal professional privilege.
Q16/ Claims by not-for-profit bodies
Does national law specify any not-for-profit bodies that are entitled to bring claims on behalf of individuals without the specific mandate of those individuals?
There are no not-for-profit bodies that are specifically mandated to bring such claims.
Q17/ Administrative fines, penalties and sanctions
(a) Does national law lay down rules on whether and to what extent administrative fines may be imposed on public authorities for breaches of the GDPR?
An administrative fine imposed on a public authority carrying out not-for-profit activities must not exceed €200,000.
———
(b) Does national law impose penalties/sanctions in addition to those set out in the GDPR, for breaches of the GDPR not subject to administrative fines (e.g., criminal penalties)?
The following additional penalties or sanctions are available:
- imprisonment which must not exceed three years and/or a fine which must not exceed €30,000 (for breach of, inter alia, Arts. 30, 31, 33(1)-(2), 34, 35(1) & 42 GDPR or the provisions of Chapter V GDPR);
- imprisonment which must not exceed one year and/or a fine which must not exceed €10,000 (for a breach in relation to processing which is not covered by a specific offence, or where a public authority combines large-scale filing systems in breach of the law); or
- imprisonment which must not exceed five years and/ or a fine which must not exceed €50,000 (for breach by a natural person of obligations relating to transfers, Art. 42 GDPR, and the duty to not obstruct the work of the DPO).
Q18/ Freedom of expression and information
(a) What (if anything) does national law do to balance the provisions of the GDPR against the right to freedom of expression and information?
The processing of personal data, sensitive personal data or personal data relating to criminal convictions and offenses, when carried out for journalistic or academic purposes or for purposes of artistic or literary expression, is permitted provided that those purposes are proportionate to the aim pursued and the data subject’s ECHR rights. Furthermore, the provisions of Arts. 14 & 15 GDPR do apply to the extent that they do not impair the right to freedom of expression and information and journalistic secrecy.
———
(b) What derogations have been introduced by national law concerning the processing of personal data for the purpose of academic, artistic or literary expression?
There are no specific provisions governing this issue.
Q19/ National identification numbers
Does national law stipulate specific conditions for the processing of a national identification number, and if so, what are the conditions?
There are no specific provisions governing this issue.
Q20/ Processing in the context of employment
(a) For what purposes can employees’ personal data in the employment context be processed under national law?
There are no specific provisions governing the processing of employee data.
———
(b) Does national law provide safeguards for employees’ dignity, legitimate interests, and fundamental rights?
There are no specific safeguards of this nature.
Q21/ Other material derogations
Are there any other material derogations from, or additions to, the GDPR under national law?
Without prejudice to the provisions of Art. 6(1)(e) GDPR, the processing of personal data is permitted and is lawful when it is carried out by:
- courts acting in their judicial capacity for the purpose of delivering justice, including the processing of personal data necessary for the publication and adoption of decisions of any court; and
- the Cyprus Parliament, provided such processing is carried out within its powers.
In relation to the Courts’ decisions, the processing of sensitive data is permitted and lawful in the following situations:
- when it is carried out for the purpose of publishing or issuing a decision of any court; or
- when it is necessary for the purpose of delivering justice.
Personal data in official documents held by a public authority or entity performing a task in the public interest must be disclosed in accordance with the specific provisions relating to access to information from public authorities.
Q22/ Current legal challenges
Are there any current legal challenges (e.g., court cases or regulatory appeals) regarding the validity or operation of the national GDPR implementation law (e.g., claims that the law incorrectly applies the GDPR; claims that the law is incompatible with constitutional principles; etc.)?
There are no current legal challenges ongoing.
Q23/ Enforcement
Has the local DPA issued any material fines or taken any material enforcement action to date for breaches of the GDPR?
The DPA has taken enforcement action for breaches of the GDPR, including:
- issuing a fine of €10,000 to a newspaper for releasing the names of police members involved in an ongoing investigation;
- issuing a fine for €5,000 to a medical centre for the loss of a patient’s medical file;
- issuing a reprimand, without fine, to the Ministry of Education for sending emails relating to a government decision to the personal email addresses of school teachers located on a database solely intended for administrative purposes;
- issuing a reprimand, without fine, to a municipal authority for the unauthorised sharing of personal data;
- issuing a reprimand, without fine, to a doctor for releasing the picture of a patient to the public without prior authorisation; and
- issuing a reprimand, without fine, to a university refusing a data subject the right to access their job evaluations and references.
Q24/ Regulatory Guidance
Has the DPA issued any significant guidance on the application of the GDPR or national implementation law?
The DPA has issued the following guidance on the application of the GDPR and/or GDPR implementation law:
- guidance on trade union membership disclosure; (see here (in Greek));
- guidance on CCTV in the workplace, and guidance on the use of biometric data; and (see here (in Greek)); and
- guidance on access to emails of current and former employees (see here (in Greek)).
Chrysses Demetriades & Co. contributors
|
Polyvios Panayides |
|
Polyvios’s practice focuses on Dispute Resolution, EU & Competition and Data Protection. He heads the Competition and the Data Protection teams at Chrysses Demetriades & Co. LLC. The Data Protection team at Chrysses Demetriades & Co. LLC advises multinational and domestic clients spanning across various sectors such as shipping, insurance, advertising and hotels with respect to European and Cyprus Data Protection law compliance and investigations. |
|
|
Christos Malikkidis |
|
Associate, Chrysses Demetriades & Co. Christos is an active member of the Data Protection team of Chrysses Demetriades & Co. LLC and is regularly involved in the preparation of privacy policies, relevant data protection agreements and consent forms. He also provides e-privacy and direct marketing advice and assists clients with data breach incidents and international data transfers. |
|
Other chapters
- Foreword and issue-by-issue comparison
- Country-by-country guides:
———
See also:
Our Global Data, Privacy & Cybersecurity Practice »
GDPR Handbook: Unlocking the EU General Data Protection Regulation »
———
This publication is provided for your convenience and does not constitute legal advice. This publication is protected by copyright.
© 2019 White & Case LLP
