- Enforcing jurisdiction
- Cyprus · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 11.17.001.010.172 – Complaint Upheld (Cyprus, 2023)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Cypriot Data Protection Authority upheld a complaint against an online casino for not responding to a user's request for their personal data. This decision matters because it highlights the importance of timely responses to data access requests.
What happened
An online casino failed to respond to a user's request for their personal data within the required timeframe.
Who was affected
A registered user of the online casino who requested access to their personal information.
What the authority found
The authority ruled that the casino violated GDPR by not responding to the access request in time.
Why this matters
This ruling emphasizes that companies must have effective processes in place to handle data requests promptly, which is essential for maintaining user trust.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A complaint was lodged with the Maltese DPA against Brivio Limited (the controller) for a failure to respond to an access request under Article 15 GDPR. The data subject was a registered user on the online casino “icecasino.com” and contacted the controller, who is the operator of the website via email. The data subject requested his information regarding all personal data concerning him, payments made and casino games that he had participated in on the website under Article 15 GDPR. Allegedly the controller never responded, which led to the submission of his complaint after the expiry of the one month period to reply under Article 12(3) and (4) of the GDPR. The controller is registered in Cyprus. The complaint was therefore transferred to the Cypriot DPA under Article 56 GDPR with the Cypriot DPA acting as the Lead Supervisory Authority (LSA). The Cypriot DPA found a violation of Article 12(3) GDPR due to the delayed response to the access request. First, the DPA considered mitigating factors such as eventual compliance, corrective measures, and cooperation from the controller. The controller had failed to comply with the request because the the customer support team who received the request, failed to inform the data protection team. After the complaint was submitted the controller reached out to the data subject and fulfilled the request. The controller internally reviewed their internal procedure and a new technical flow was adopted in order to facilitate the cooperation between the customer support team and the data protection team. Extra training for staff had also been carried out. This was considered favouribly by the DPA. The DPA considered that the request could have been satisfied from the first instance if the appropriate organisational and technical measures were in place and the staff was properly trained in dealing with GDPR requests in a timely manner. Moreover. the controller’s data protection team only became aware of the access request afte
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 11.17.001.010.172 in CY
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 11.17.001.010.172 - Cyprus (2023). Retrieved from cookiefines.eu
Last updated: