DPA case 11.17.001.010.007 – Complaint Upheld (Cyprus, 2023)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A person requested their personal data from Technius Ltd, but the company asked for ID to process the request, even though the person denied having an account. This matters because individuals should be able to access their data without unnecessary hurdles. Companies must make it easy for users to exercise their rights under privacy laws.
What happened
Technius Ltd required an ID from a person who requested access to their personal data, despite the person claiming they never created an account.
Who was affected
The individual who requested their personal data from Technius Ltd.
What the authority found
The Cypriot DPA found that Technius Ltd did not facilitate the individual's right to access their personal data properly.
Why this matters
This ruling stresses that companies must simplify the process for individuals to access their personal data and ensure they are informed about data breaches.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
No issues were reported by that automated check.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A data subject requested a copy of the personal data about them under Article 15(3) GDPR to Technius Ltd, the controller, which operates the website stripchat.com, after being informed by the media that the company had suffered a data breach. The data subject also denied ever creating an account on the website and claimed that someone else must have done so using his e-mail address. The controller replied stating that the only data they processed was the data subject's IP address and username collected upon registration and that the data subject needed to provide an ID for the controller to identify him and proceed with the access request. The data subject replied stating that the ID was not necessary as he was using his e-mail address. The data subject also complained about the fact that he was not informed about the data breach but found out in the media. The controller then answered to the data subject saying that his account would be deleted as it was created fraudulently and referred him to the data breach notification on their website. The data subject filed a complaint. The complaint was initially filed with the Dutch DPA and then transferred to the Cypriot DPA ('DPC'), as the lead supervisory authority in the case under Article 56 GDPR. The DPC started a cooperation procedure under Article 60 GDPR and opened an investigation. In its submissions, the controller stated that they did not inform users individually about the data breach because they had no indication of who was affected by it and given the high amount of users, it would have taken them too long to inform all of them via email. Further, the controller stated that they required an ID for data subjects’ access requests in order to protect users from unauthorized disclosures and this is in line with Recital 64 GDPR. The controller also claimed to have complied with the access request. Upon hearing the views of the concerned supervisory authorities, the DPC issued a preliminary decision to the c
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 11.17.001.010.007 in CY
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 11.17.001.010.007 - Cyprus (2023). Retrieved from cookiefines.eu
Last updated: