Housing Finance Corporation – €10,000 Fine (Cyprus, 2025)

The controller is ‘Housing Finance Corporation’ (Οργανισμός Χρηματοδοτήσεως Στέγης), a bank specialised in the provision of long-term loans relating to housing, education, and health. In 2023, the data subject filed an application to the controller for a loan (third loan). The data subject was informed by letter that his application had been rejected due to a non-performing loan he had received several years ago (first loan). The letter also mentioned that, according to the controller’s system, a previous loan application dated in 2020 that had been rejected for the same reason (second loan). The data subject filed a complaint before the DPA (Commissioner for Personal Data Protection). He stated that he had settled the alleged non-performing loan in 2020, as demonstrated from the database of the credit information agency ‘Artemis’. This loan should not have been included in the data maintained by the controller. He also claimed that the data about the second loan application shouldn’t have been retained for more that 6 months, as described in the controller’s privacy policy. The controller informed the DPA that, with regard to the electronic registration of applications and the process of deleting information and electronic attachments, there was no automated setting in the system and, in such cases, any action had to be performed by an official who had access to the application system for each document/item individually. It maintained that the serious shortage of human resources made this task more difficult. It also claimed that this created a time-consuming process that was prone to human error. Regarding the retention of the data about the rejection of the second loan application, the controller claimed that it did not keep the data, instead, the members of its credits committee remembered this information and took it into consideration for the rejection of the third loan application. Finally, it claimed that a reference to the rejection of the second loan a