[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-OBbjjU5JbWapJkylrMH1id3uowxTB4MVd93hsYaBa8":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":70},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"b9c5c5ad-3ec4-4875-a859-0dcfdae0c4f7","Commissioner (Cyprus) - Online Platform “Agora”","commissioner-cyprus-online-platform-agora-c6529f","← Older revision Revision as of 08:50, 28 September 2026 Line 103: Line 103: In October 2025, the DPA initiated an ex officio investigation after discovering that the digital platform\u002Fapplication \"Agora\" was launched under the responsibility of an MEP, the controller. The platform offered user participation in opinion polls, expression of political opinions, and applications for parliamentary candidacy. It also required user identification through ID cards and biometric data analysis. In October 2025, the DPA initiated an ex officio investigation after discovering that the digital platform\u002Fapplication \"Agora\" was launched under the responsibility of an MEP, the controller. The platform offered user participation in opinion polls, expression of political opinions, and applications for parliamentary candidacy. It also required user identification through ID cards and biometric data analysis. Because of large-scale processing and the involvement of special categories of data (political opinions), the DPA requested that the controller submit a Data Protection Impact Assessment (DPIA) for prior consultation under Articles 35 and 36 GDPR. The DPA also repeatedly requested the controller to temporarily suspend the platform's operation until the consultation process was concluded. Because of large-scale processing and the involvement of special categories of data (political opinions), the DPA requested that the controller submit a Data Protection Impact Assessment (DPIA) for prior consultation under [[Article 35 GDPR|Articles 35]] and [[Article 36 GDPR|36 GDPR]]. The DPA also repeatedly requested the controller to temporarily suspend the platform's operation until the consultation process was concluded. Subsequently, the controller submitted an incomplete DPIA with pending mitigation measures and only partially suspended certain features (such as voting mechanisms and candidate data collection). However, on 23 February 2026, the DPA found that personal data processing was still ongoing, including user registration, identity verification, and access to candidate profiles. On the same day, the controller publicly stated in a livestream that there was \"no chance\" he would take down the app. Subsequently, the controller submitted an incomplete DPIA with pending mitigation measures and only partially suspended certain features (such as voting mechanisms and candidate data collection). However, on 23 February 2026, the DPA found that personal data processing was still ongoing, including user registration, identity verification, and access to candidate profiles. On the same day, the controller publicly stated in a livestream that there was \"no chance\" he would take down the app. Line 109: Line 109: The DPA stressed that the controller’s obligation to cooperate with the supervisory authority is autonomous. An infringement does not require a prior determination of substantive non-compliance (e.g., regarding legal basis or security measures) or proof of actual harm to data subjects. The DPA stressed that the controller’s obligation to cooperate with the supervisory authority is autonomous. An infringement does not require a prior determination of substantive non-compliance (e.g., regarding legal basis or security measures) or proof of actual harm to data subjects. Following, the DPA held that the controller violated his obligation to cooperate with the supervisory authority under [[Article 31 GDPR]] and imposed an administrative fine of €6,000 under Article 58(2)(i) and [[Article 83 GDPR|Article 83(4)(a) GDPR]]. Following, the DPA held that the controller violated his obligation to cooperate with the supervisory authority under [[Article 31 GDPR]] and imposed an administrative fine of €6,000 under [[Article 58 GDPR|Article 58(2)(i)]] and [[Article 83 GDPR|Article 83(4)(a) GDPR]]. == Comment == == Comment == ''Share your comments here!'' ''Share your comments here!''","The Cyprus Data Protection Authority (DPA) has fined a Member of the European Parliament (MEP) €6,000 for failing to cooperate with an investigation into his digital platform, \"Agora.\" The platform processed sensitive data, including political opinions and biometric information, and the MEP initially refused to suspend its operation despite requests. The DPA found the MEP violated his obligation to cooperate under Article 31 of the GDPR, even without a prior determination of substantive non-compliance.","Cyprus DPA fines MEP €6,000 for violating GDPR cooperation obligations.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Commissioner_(Cyprus)_-_Online_Platform_%E2%80%9CAgora%E2%80%9D&diff=53195&oldid=53194","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F5\u002F53\u002FLogoCY.jpg","2026-09-28T08:50:54+00:00","2026-09-28T10:00:18.311759+00:00",7,[17,20,23],{"name":18,"type":19},"Agora","product",{"name":21,"type":22},"biometric data analysis","technology",{"name":24,"type":22},"opinion polls","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,41,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":37},{"id":38,"icon":27,"name":39,"slug":40},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":42},{"id":25,"icon":27,"name":28,"slug":29},{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[],[18],{"controls":51,"vendors":69},[52],{"slug":53,"name":54,"problem":55,"products":56},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[57,63],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":58,"product_name":59,"url":61,"description":62},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":64,"product_name":65,"url":67,"description":68},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",[],{"slug":71,"title":72,"body":73,"framework_refs":74,"framework_notes":84},"mep-fined-for-refusing-to-cooperate-with-gdpr-investigation-into-sensitive-data-platform","MEP Fined for Refusing to Cooperate with GDPR Investigation into Sensitive Data Platform","A Member of the European Parliament was fined €6,000 by the Cyprus DPA for failing to cooperate with a regulatory investigation into his 'Agora' platform, which processed highly sensitive data including political opinions and biometric information. The case highlights that GDPR obligations extend beyond data handling practices — organizations and controllers must actively engage with supervisory authorities when requested. Refusal to suspend operations or cooperate with investigations is itself a punishable violation under Article 31 of the GDPR, independent of any underlying substantive breach. This matters because non-cooperation undermines the entire regulatory framework designed to protect individuals' fundamental rights, and authorities will pursue enforcement even when the primary infringement is procedural.",[75,76,77,78,79,80,81,82,83],"GDPR Article 31 — Cooperation with the supervisory authority","GDPR Article 9 — Processing of special categories of personal data","GDPR Article 35 — Data Protection Impact Assessment (DPIA)","GDPR Article 30 — Records of processing activities","GDPR Article 83(4) — Administrative fines for Article 31 violations","NIST Privacy Framework PR.PO-P1 — Policies and procedures","CIS Control 18 — Penetration Testing and Application Security","ISO\u002FIEC 27701:2019 — Privacy Information Management System","ITIL Service Management — Compliance and regulatory engagement processes",{}]