Cyprus Court Upholds €10,000 Fine Against Media Group for Unlawful Disclosure of Financial Data

Written by AI from the linked story. Not reviewed by an editor. How this works

DIAS Media Group published a public figure's financial data without sufficiently balancing journalistic freedom against data protection obligations, resulting in a €10,000 fine upheld by the Administrative Court of Cyprus. The core failure was a lack of internal editorial and legal review processes to assess the accuracy, necessity, and proportionality of publishing sensitive personal data. This case illustrates that even journalistic entities are not exempt from GDPR-aligned data protection laws and must demonstrate a lawful basis for processing sensitive information. The ruling serves as a critical reminder that publishing personal financial data without rigorous justification exposes organizations to significant legal and financial liability.

Tactical Insight

Immediate actions

Establish a mandatory pre-publication legal review process for any content involving personal or financial data of identifiable individuals.
Conduct a Data Protection Impact Assessment (DPIA) before publishing sensitive personal information to evaluate necessity and proportionality.

Policy & Governance improvements

Develop and enforce a formal editorial data protection policy that defines lawful bases for processing personal data in journalistic contexts.
Appoint or engage a Data Protection Officer (DPO) to advise editorial staff on compliance obligations under GDPR and local data protection law.
Create a documented balancing test procedure to weigh public interest against individuals' privacy rights before publication.

Training & Awareness measures

Deliver regular data protection training tailored to editorial and journalism staff covering GDPR principles, accuracy requirements, and minimisation obligations.
Implement a clear escalation path for staff to flag potentially non-compliant content before it is published.