[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faivy7w6jIvn5doPoNMkUDwMDNuSVMhYvVUCnu44RBs0":3},{"article":4,"iocs":44,"watch_terms":45,"solutions":46,"lesson":49},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"b3ffd27e-1721-478e-b335-d13fd6973025","Commissioner (Cyprus) - Online Platform “Agora”","commissioner-cyprus-online-platform-agora-36e5cb","← Older revision Revision as of 08:23, 28 September 2026 Line 96: Line 96: }} }} The Cypriot DPA fined an MEP €6,000 for failing to cooperate with the supervisory authority under [[Article 31 GDPR]], after he refused to fully comply with repeated requests to temporarily suspend the operations of his online platform \"Agora\". The DPA fined an MEP €6,000 for failing to cooperate with the supervisory authority under [[Article 31 GDPR]], particularly, after he refused to fully comply with repeated requests to temporarily suspend the operations of his online platform \"Agora\". == English Summary == == English Summary ==","The Cypriot Data Protection Authority (DPA) fined a Member of the European Parliament (MEP) €6,000 for failing to cooperate with its investigation into his online platform, \"Agora\". The MEP refused repeated requests to suspend the platform's operations, which involved processing sensitive data like political opinions and biometric information, and submitted an incomplete Data Protection Impact Assessment (DPIA). The DPA emphasized that cooperation with supervisory authorities is an autonomous obligation.","Cyprus DPA fines MEP €6,000 for non-cooperation regarding online platform 'Agora'.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Commissioner_(Cyprus)_-_Online_Platform_%E2%80%9CAgora%E2%80%9D&diff=53194&oldid=53192","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F53\u002FLogoCY.jpg","2026-09-28T08:23:26+00:00","2026-09-28T10:00:18.311759+00:00",7,[17,20],{"name":18,"type":19},"Agora","product",{"name":21,"type":22},"Commissioner (Cyprus)","vendor","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[21,18],{"controls":47,"vendors":48},[],[],{"slug":50,"title":51,"body":52,"framework_refs":53,"framework_notes":63},"mep-fined-for-failing-to-cooperate-with-dpa-investigation-into-data-heavy-platform","MEP Fined for Failing to Cooperate with DPA Investigation into Data-Heavy Platform","The core failure here was a deliberate refusal to cooperate with a supervisory authority and an inadequate Data Protection Impact Assessment (DPIA) for a platform processing highly sensitive data including political opinions and biometric information. Under GDPR, conducting a thorough DPIA before processing high-risk data is mandatory, not optional, and cooperation with Data Protection Authorities (DPAs) is an independent legal obligation regardless of the data controller's status or position. Submitting an incomplete DPIA signals a fundamental gap in privacy-by-design practices and risk management culture. This case matters because it demonstrates that no individual or organization—regardless of political standing—is exempt from GDPR obligations, and non-cooperation compounds regulatory penalties significantly.",[54,55,56,57,58,59,60,61,62],"GDPR Article 5(2) – Accountability principle","GDPR Article 9 – Processing of special categories of personal data","GDPR Article 31 – Cooperation with the supervisory authority","GDPR Article 35 – Data Protection Impact Assessment","GDPR Article 36 – Prior consultation with supervisory authority","NIST Privacy Framework: GOVERN-P, COMMUNICATE-P","CIS Control 3 – Data Protection","ISO\u002FIEC 27701 – Privacy Information Management","NIST SP 800-53 PT-2 – Authority to Process Personally Identifiable Information",{}]