CyprusGDPR Articles 82-83 and ODPC Enforcement in Cyprus
Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Osterreichische Post AG, judgment of the Court of Justice of (Third Chamber) (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Law 125(I)/2018 Article 33 creates criminal offences layered on top of the Commissioner's administrative fine, covering a controller's or processor's failure to keep or update a record of processing activities or to cooperate with the Commissioner, failure to notify a personal data breach to the Commissioner or the data subject, failure to carry out a data protection impact assessment, obstructing a data protection officer, an unlawful third-country transfer, unauthorised interference with a personal data filing system (whether or not for profit), and obstructing the Commissioner's Article 58 GDPR powers. A person convicted of any of these offences (Article 33(1)(a) to (ib)) is liable to imprisonment not exceeding three years or a fine not exceeding EUR 30,000, or both. Where an offence of obstructing the data protection officer, of a certification body granting or failing to withdraw certification contrary to Article 42, or of an unlawful third-country transfer harms the interests of the Republic, endangers the unhindered functioning of the Government or threatens national security, the maximum rises to imprisonment not exceeding five years or a fine not exceeding EUR 50,000, or both (Article 33(4)). Two narrower offences (general non-compliance not otherwise criminalised by this article, and a public authority's unlawful large-scale combination of filing systems) carry a lesser maximum of one year's imprisonment or a EUR 10,000 fine, or both.
Penalty structure
GDPR Article 83(5) sets the higher administrative-fine tier the Commissioner applies, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher; Article 83(4) sets the narrower EUR 10,000,000 or 2 percent tier for the Article 25 to 39 obligations. Law 125(I)/2018 Article 32 gives the Commissioner the power to impose this fine and lets an unpaid fine be recovered as a civil debt owed to the Republic, and sets one national derogation: a fine imposed on a public authority or public body in respect of non-profit-making activities may not exceed EUR 200,000, regardless of what the GDPR ceiling would otherwise allow.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Commissioner for Personal Data Protection (Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Cyprus's supervisory authority under the GDPR and Law 125(I)/2018.
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300
- Case citation
- Case C-300/21 UI v Osterreichische Post AG, judgment of the Court of Justice of (Third Chamber)
- Open questions
- Which Cypriot rules on the extent of financial compensation apply to a claim under Article 82 of Regulation (EU) 2016/679, the question the Court of Justice's ruling in Case C-300/21 leaves to the domestic law of each Member State?
What it reaches
Obligation class
Governance
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not
- the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union
- the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to the monitoring of their behaviour as far as their behaviour takes place within the Union
What it makes you log
Logging duty
Article 82 gives a right to compensation for damage and Article 83 sets the conditions for administrative fines, with the ceiling for public bodies in Article 32(3) of the Law. None of them requires a log or a record.
- Kind
- None
- As of
What this law does
The Office of the Commissioner for Personal Data Protection (ODPC) is the supervisory authority and enforces General Data Protection Regulation (GDPR) Article 83 fines. Law 125(I)/2018 Article 32(3) narrows the ceiling only for a public authority or public body's non-profit-making activities, to EUR 200,000; no narrower Cyprus-specific ceiling applies to a private-sector controller or processor. GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .