ΔΔΚ - 1181/18
Cyprus court allows temporary restriction of access to evaluation reports during promotion.
The Administrative Court of Cyprus annulled a DPA decision, ruling that a university could temporarily restrict an assistant professor's access to evaluation reports during an ongoing promotion procedure. The court found that the DPA failed to balance the data subject's right of access under GDPR against the university's legitimate interest in preserving confidentiality and procedural integrity.
AI summary of the linked source. Not reviewed by an editor. How this works
Run University of Cyprus?
Get an email when a new story names University of Cyprus, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Administrative Court of Cyprus found that the Data Protection Authority failed to properly weigh competing legal interests when ordering a university to grant an assistant professor unrestricted access to confidential evaluation reports during an active promotion procedure. GDPR Article 15 (right of access) is not absolute — it must be balanced against legitimate interests such as protecting third-party confidentiality and procedural integrity. This case highlights that DPAs and organizations alike must conduct structured balancing tests before making access decisions, rather than applying data subject rights mechanically. Failure to document and justify such balancing decisions exposes both regulators and institutions to legal challenge and reputational harm.