- Enforcing jurisdiction
- Cyprus · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 11.17.001.008.029 – Complaint Upheld (Cyprus, 2020)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Cyprus Telecommunications Authority Employees Welfare Fund was found to have access to more personal data than necessary, including member photos. The DPA instructed the organization to improve its data security measures. This ruling shows the importance of limiting access to personal data.
What happened
The DPA found that TEY-CYTA accessed more personal data than needed for its purposes.
Who was affected
Members of the Cyprus Telecommunications Authority whose photos were accessed unnecessarily.
What the authority found
The DPA determined that TEY-CYTA violated GDPR by not implementing proper security measures to limit data access.
Why this matters
This decision highlights the need for organizations to restrict access to personal data. Businesses should review their data handling practices to avoid similar issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Archived or cached source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
It was found that the TEY-CYTA Association (Cyprus Telecommunications Authority Employees Welfare Fund) had access to personal data, more than was needed to satisfy the purposes, such as the photo of its members. The TEY-CYTA due to the fact that they couldn't separate the databases for employees and for members, was not able to respond as they should. The Commissioner held that CYTA violated articles 5 (1), 24 (1) and (2), 25 (1) and (2) and 32 of the GDPR and instructed CYTA to establish such security measures and practices, so that TEY-CYTA no longer has access to data disproportionate to the purpose, excluding access to the photo of its members. In this case, no fine was imposed.
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 11.17.001.008.029 in CY
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 11.17.001.008.029 - Cyprus (2020). Retrieved from cookiefines.eu
Last updated: