[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fl1JNS-RiKxZC7US1VKqALHxYGkcACQ20fKIZRWFcTEo":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":51},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"afaecb05-6fde-4b1a-a376-353d4d9341bb","ΔΔΚ - 688\u002F2022","688-2022-d6d8a7","Minor amendement to 2nd paragraph of facts ← Older revision Revision as of 08:05, 17 June 2026 (One intermediate revision by the same user not shown) Line 75: Line 75: === Facts === === Facts === On 13 March 2019, Sigma, a Cypriot TV channel belonging to Ekdotikos Oikos Dias Dimosia Ltd, a Cypriot media group (the controller), published a report disclosing financial information concerning a public figure in Cyprus (the data subject). The publication was part of reporting on whether there had been favourable treatment of a politically exposed person. On 13 March 2019, Sigma, a Cypriot TV channel operated within DIAS Media Group (ΕΚΔΟΤΙΚΟΣ ΟΙΚΟΣ ΔΗΜΟΣΙΑ ΔΙΑΣ ΛΙΜΙΤΕΔ), published a report disclosing financial information concerning a public figure in Cyprus (the data subject). The DPA treated DIAS Media Group as the controller responsible for the publication. The report formed part of coverage on whether there had been favourable treatment of a politically exposed person. On 15 April 2019, the data subject lodged a complaint with the Cypriot DPA concerning the disclosure of their financial personal data by media outlets belonging to the controller’s group. On 15 April 2019, the data subject lodged a complaint with the Cypriot DPA concerning the disclosure of their financial personal data by Sigma and other media outlets belonging to the controller’s group. The DPA found that the controller had failed to properly balance the journalistic interest in publication against the data subject’s rights to privacy and data protection. In particular, the DPA considered that the controller had failed to demonstrate that it had taken into account certain balancing criteria, including whether the processing was carried out exclusively for journalistic purposes, whether it was strictly necessary to ensure the right to information on matters of public interest, whether the information was accurate and truthful, and whether there had been prior contact with the data subject. The DPA found that the controller had failed to properly balance the journalistic interest in publication against the data subject’s rights to privacy and data protection. In particular, the DPA considered that the controller had failed to demonstrate that it had taken into account certain balancing criteria, including whether the processing was carried out exclusively for journalistic purposes, whether it was strictly necessary to ensure the right to information on matters of public interest, whether the information was accurate and truthful, and whether there had been prior contact with the data subject.","A Cypriot court has upheld a €10,000 fine against DIAS Media Group for violating data protection laws. The media group published a TV report disclosing a public figure's financial data, failing to properly balance journalistic interest with the individual's privacy rights. The court agreed with the DPA that the company did not adequately consider criteria such as necessity, accuracy, and prior contact with the data subject.","Cyprus court upholds €10,000 fine against media company for privacy violation.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=%CE%94%CE%94%CE%9A_-_688\u002F2022&diff=51899&oldid=51895","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-06-17T08:05:49+00:00","2026-06-17T10:00:11.63713+00:00",7,[17,20],{"name":18,"type":19},"DIAS Media Group","vendor",{"name":21,"type":22},"Sigma","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18,21],{"controls":49,"vendors":50},[],[],{"slug":52,"title":53,"body":54,"framework_refs":55,"framework_notes":67},"cypriot-media-firm-fined-10000-for-unlawful-disclosure-of-personal-financial-data","Cypriot Media Firm Fined €10,000 for Unlawful Disclosure of Personal Financial Data","DIAS Media Group broadcast a TV report that exposed a public figure's financial information without adequately balancing journalistic interest against the individual's right to privacy. The court upheld the Data Protection Authority's finding that the company failed to apply core data protection principles — necessity, accuracy, and prior contact with the data subject — before publishing sensitive personal data. This case illustrates that even journalistic entities are not exempt from data protection obligations and must conduct a proportionality assessment before disclosing personal information. Failing to embed these checks into editorial workflows exposes organisations to regulatory sanctions, reputational harm, and legal liability.",[56,57,58,59,60,61,62,63,64,65,66],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 5(1)(b) – Purpose limitation","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 5(1)(d) – Accuracy","GDPR Article 85 – Processing for journalistic, academic, artistic or literary expression","GDPR Article 9 – Processing of special categories of personal data","NIST SP 800-53 PT-2 (Privacy Impact and Risk Assessment)","NIST SP 800-53 PM-25 (Minimization of Personally Identifiable Information)","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 Annex A 5.34 – Privacy and protection of PII","ITIL Service Value Chain – Continual Improvement (policy review cycles)",{}]