Cyprus Association of Automotive Engineer Assessors – Complaint Upheld (Cyprus, 2021)

A data subject (X) was working as a professional assessor for the Pancyprian Association for Automotive Engineers Assessors (hereinafter AAEA). Following the rescission of X's membership, AAEA sent a letter to several insurance companies, informing them of the fact that X was no longer one of their members, without however obtaining the prior consent of X. X decided to file a complaint with the Cypriot DPA (the 'Commissioner') against AAEA, considering that they should not have shared such information with the concerned insurance companies, and had therefore unlawfully processed his personal data. After hearing X on the subject, the Commissioner required information from AAEA with respect to the processing of X's personal data. AAEA however did not reply to the Commissioner. The Commissioner considered that, by sending a letter to insurance companies regarding the rescission of X's membership, AAEA had violated Article 5(1)(a) GDPR, Article 6(1) GDPR and Article 9(1) GDPR. The Commissioner therefore decided to impose a Reprimand on AAEA, as the latter had failed to substantiate and/or prove the lawfulness of the relevant processing act. For reaching this decision, the Commissioner took into account, among others, the fact that compliance by AAEA with its Code of Professional Ethics was not demonstrated, but also the fact that AAEA is not a regulated or institutionalized supervisory authority (cf. there is no Cypriot law specifically regulating the profession of automotive engineer assessors). The Commissioner also considered that by failing to reply to its requests for information in the course of the procedure, AAEA had not complied with its obligation to cooperate under Article 31 GDPR. The Commissioner stressed that the requested information was not complex, and that AAEA ought to have responded in due time. However, since, in the end, AAEA provided answers to the Commissioner, the Commissioner decided to impose a warning rather than a fine.