DPA case 11.17.001.010.199 – Complaint Upheld (Cyprus, 2023)

An individual posted on Facebook sensitive personal data of another individual, without owning any legal basis to do so. The reference to sensitive personal data of the complainant was a subject matter health. The complainant was identifiable and the post was public. The DPA considered other factors before coming to a conclusion, such as the removal/deletion of the post containing the health issue of the of the complainant, the fact that the surname of the complainant was not disclosed, which makes the fact that the complainant's name has not been revealed makes it more difficult for the general public to identify the complainant, and the absence of any previous violations. By assessing the above factors that existed in relation to the incident and in light of the powers granted to me by section 58(2)(a) of the Regulation (EU) 2016/679, the DPA decided to issue a warning to refrain in future from any action contrary to the provisions of Regulation (EU) 2016/679 and that to exercise due diligence in relation to the provisions of Regulation (EU) 2016/679 with regard to the information a person uploads and/or posts on the Facebook platform and which constitute personal data of others and in particular with regard to special categories of data (data health).