[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwdHInvAov77H-S6dQ6P9tVN9kVHJENBX91891ee3AQo":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":52},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"a395447b-c138-487f-8998-0eb99c56185c","ΔΔΚ - 1181\u002F18","1181-18-14a6bc","Fixed link ← Older revision Revision as of 07:12, 16 September 2026 Line 7: Line 7: |Court_Original_Name=Διοικητικό Δικαστήριο της Κύπρου |Court_Original_Name=Διοικητικό Δικαστήριο της Κύπρου |Court_English_Name=Administrative Court of Cyprus |Court_English_Name=Administrative Court of Cyprus |Court_With_Country=ΔΔΚ (Cyprus) |Court_With_Country=Διοικητικού Δικαστηρίου (Cyprus) |Case_Number_Name=1181\u002F18 |Case_Number_Name=1181\u002F18","The Administrative Court of Cyprus annulled a DPA decision, ruling that a university could temporarily restrict an assistant professor's access to evaluation reports during an ongoing promotion procedure. The court found that the DPA failed to balance the data subject's right of access under GDPR against the university's legitimate interest in preserving confidentiality and procedural integrity.","Cyprus court allows temporary restriction of access to evaluation reports during promotion.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=%CE%94%CE%94%CE%9A_-_1181\u002F18&diff=53061&oldid=51350","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-09-16T07:12:13+00:00","2026-09-16T08:00:14.726099+00:00",7,[17,20,23],{"name":18,"type":19},"GDPR","product",{"name":21,"type":22},"University of Cyprus","vendor",{"name":24,"type":19},"Data Protection Law","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,35,40,45],{"category":32},{"id":33,"icon":27,"name":18,"slug":34},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":36},{"id":37,"icon":27,"name":38,"slug":39},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":41},{"id":42,"icon":27,"name":43,"slug":44},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":46},{"id":25,"icon":27,"name":28,"slug":29},[],[21,18,24],{"controls":50,"vendors":51},[],[],{"slug":53,"title":54,"body":55,"framework_refs":56,"framework_notes":66},"court-overturns-dpa-ruling-balancing-gdpr-access-rights-against-legitimate-institutional-interests","Court Overturns DPA Ruling: Balancing GDPR Access Rights Against Legitimate Institutional Interests","The Administrative Court of Cyprus found that the Data Protection Authority failed to properly weigh competing legal interests when ordering a university to grant an assistant professor unrestricted access to confidential evaluation reports during an active promotion procedure. GDPR Article 15 (right of access) is not absolute — it must be balanced against legitimate interests such as protecting third-party confidentiality and procedural integrity. This case highlights that DPAs and organizations alike must conduct structured balancing tests before making access decisions, rather than applying data subject rights mechanically. Failure to document and justify such balancing decisions exposes both regulators and institutions to legal challenge and reputational harm.",[57,58,59,60,61,62,63,64,65],"GDPR Article 15 (Right of Access)","GDPR Article 23 (Restrictions on Data Subject Rights)","GDPR Recital 63 (Balancing Access Rights)","NIST SP 800-53 AC-3 (Access Enforcement)","NIST SP 800-53 AC-22 (Publicly Accessible Content)","CIS Control 3 (Data Protection)","CIS Control 6 (Access Control Management)","ISO\u002FIEC 29101 (Privacy Architecture Framework)","ITIL Service Management – Request Fulfilment (Access Request Handling)",{}]