[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQ8anu5HkEYU_9AszT_To8ziI1AZ3HoFjRp2KK1g8kXY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"dceaf9ed-fe83-47d9-9c77-d8e493e9b2fc","cypriot-media-firm-fined-10000-for-unlawful-disclosure-of-personal-financial-data","afaecb05-6fde-4b1a-a376-353d4d9341bb","Cypriot Media Firm Fined €10,000 for Unlawful Disclosure of Personal Financial Data","DIAS Media Group broadcast a TV report that exposed a public figure's financial information without adequately balancing journalistic interest against the individual's right to privacy. The court upheld the Data Protection Authority's finding that the company failed to apply core data protection principles — necessity, accuracy, and prior contact with the data subject — before publishing sensitive personal data. This case illustrates that even journalistic entities are not exempt from data protection obligations and must conduct a proportionality assessment before disclosing personal information. Failing to embed these checks into editorial workflows exposes organisations to regulatory sanctions, reputational harm, and legal liability.","**Immediate actions:**\n- Establish a mandatory pre-publication data protection review checklist for any report involving personal or financial data.\n- Require editorial staff to document the legal basis and necessity assessment before broadcasting or publishing sensitive personal information.\n\n**Policy & governance improvements:**\n- Develop and enforce a written data protection policy tailored to journalistic activities, including criteria for balancing public interest against individual privacy rights.\n- Appoint or designate a Data Protection Officer (DPO) to provide guidance on borderline editorial decisions involving personal data.\n- Implement a formal prior-contact protocol requiring journalists to seek comment or notification from data subjects before publishing sensitive disclosures.\n\n**Training & awareness measures:**\n- Deliver regular GDPR and data protection training to all editorial, production, and management staff.\n- Conduct periodic mock-review exercises on past broadcasts to identify gaps in proportionality assessments and reinforce correct practice.",[12,13,14,15,16,17,18,19,20,21,22],"GDPR Article 5(1)(a) – Lawfulness, fairness, and transparency","GDPR Article 5(1)(b) – Purpose limitation","GDPR Article 5(1)(c) – Data minimisation","GDPR Article 5(1)(d) – Accuracy","GDPR Article 85 – Processing for journalistic, academic, artistic or literary expression","GDPR Article 9 – Processing of special categories of personal data","NIST SP 800-53 PT-2 (Privacy Impact and Risk Assessment)","NIST SP 800-53 PM-25 (Minimization of Personally Identifiable Information)","CIS Control 3 – Data Protection","ISO\u002FIEC 27001:2022 Annex A 5.34 – Privacy and protection of PII","ITIL Service Value Chain – Continual Improvement (policy review cycles)",{},"published","2026-06-17T11:20:21.184613+00:00","2026-06-17T11:20:20.814+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=%CE%94%CE%94%CE%9A_-_688\u002F2022&diff=51899&oldid=51895","688-2022-d6d8a7","ΔΔΚ - 688\u002F2022",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":39,"name":40,"slug":41,"description":42,"color":43},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":45,"name":46,"slug":47,"description":48,"color":49},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]