[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPyqPFT5WFRR-RP3bXXsvq81lsE9tcesKRy7QoNj1HwQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"16b5cb57-4ec2-49f6-b79a-560cfd6f67d9","cyprus-court-upholds-10000-fine-against-media-group-for-unlawful-disclosure-of-financial-data","bae4470f-dc1f-49e4-8c59-563c3ba94b6b","Cyprus Court Upholds €10,000 Fine Against Media Group for Unlawful Disclosure of Financial Data","DIAS Media Group published a public figure's financial data without sufficiently balancing journalistic freedom against data protection obligations, resulting in a €10,000 fine upheld by the Administrative Court of Cyprus. The core failure was a lack of internal editorial and legal review processes to assess the accuracy, necessity, and proportionality of publishing sensitive personal data. This case illustrates that even journalistic entities are not exempt from GDPR-aligned data protection laws and must demonstrate a lawful basis for processing sensitive information. The ruling serves as a critical reminder that publishing personal financial data without rigorous justification exposes organizations to significant legal and financial liability.","**Immediate actions:**\n- Establish a mandatory pre-publication legal review process for any content involving personal or financial data of identifiable individuals.\n- Conduct a Data Protection Impact Assessment (DPIA) before publishing sensitive personal information to evaluate necessity and proportionality.\n\n**Policy & Governance improvements:**\n- Develop and enforce a formal editorial data protection policy that defines lawful bases for processing personal data in journalistic contexts.\n- Appoint or engage a Data Protection Officer (DPO) to advise editorial staff on compliance obligations under GDPR and local data protection law.\n- Create a documented balancing test procedure to weigh public interest against individuals' privacy rights before publication.\n\n**Training & Awareness measures:**\n- Deliver regular data protection training tailored to editorial and journalism staff covering GDPR principles, accuracy requirements, and minimisation obligations.\n- Implement a clear escalation path for staff to flag potentially non-compliant content before it is published.",[12,13,14,15,16,17,18,19,20],"GDPR Article 5 – Principles relating to processing of personal data (accuracy, data minimisation)","GDPR Article 6 – Lawfulness of processing","GDPR Article 85 – Processing and freedom of expression and information (journalistic exemption limits)","GDPR Article 35 – Data Protection Impact Assessment (DPIA)","NIST SP 800-53 AR-4 – Privacy Monitoring and Auditing","NIST SP 800-53 IP-1 – Consent","CIS Control 3 – Data Protection","ISO\u002FIEC 27001 Annex A.18.1 – Compliance with legal and contractual requirements","ITIL Service Design – Information Security Management",{},"published","2026-09-16T09:21:20.201558+00:00","2026-09-16T09:21:20.097+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=%CE%94%CE%94%CE%9A_-_688\u002F2022&diff=53063&oldid=52022","688-2022-51ab6d","ΔΔΚ - 688\u002F2022",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":43,"name":44,"slug":45,"description":46,"color":47},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]