MEP Fined for Refusing to Cooperate with GDPR Investigation into Sensitive Data Platform
Written by AI from the linked story. Not reviewed by an editor. How this works
A Member of the European Parliament was fined €6,000 by the Cyprus DPA for failing to cooperate with a regulatory investigation into his 'Agora' platform, which processed highly sensitive data including political opinions and biometric information. The case highlights that GDPR obligations extend beyond data handling practices — organizations and controllers must actively engage with supervisory authorities when requested. Refusal to suspend operations or cooperate with investigations is itself a punishable violation under Article 31 of the GDPR, independent of any underlying substantive breach. This matters because non-cooperation undermines the entire regulatory framework designed to protect individuals' fundamental rights, and authorities will pursue enforcement even when the primary infringement is procedural.
Tactical Insight
Immediate actions
- Establish a designated Data Protection Officer (DPO) or legal point of contact empowered to respond to regulatory inquiries within mandated timeframes.
- Conduct an urgent data audit of any platform processing special category data (biometric, political opinions, health) to assess GDPR compliance status before regulators intervene.
Organizational policy improvements
- Develop and rehearse a Supervisory Authority Response Procedure that outlines escalation paths, required documentation, and cooperation obligations under GDPR Article 31.
- Train leadership and executives on the legal duty to cooperate with DPAs, emphasizing that non-cooperation itself constitutes a sanctionable offense.
- Implement a formal Data Protection Impact Assessment (DPIA) process mandated for all platforms handling special category data prior to launch.
Governance and oversight
- Maintain an up-to-date Record of Processing Activities (RoPA) under GDPR Article 30 to enable rapid, accurate responses to regulatory requests.
- Establish a legal review gate requiring compliance sign-off before any platform processing sensitive personal data goes live or continues operating under scrutiny.