On November 27, 2023, the Office of the Commissioner for Personal Data Protection (the Commissioner) announced that it had issued an administrative fine of €45,000 and a mandate to the Open University of Cyprus for violations of the General Data Protection Regulation (GDPR), following a data breach.

Background to the decision

The Commissioner highlighted that it had received a breach notification in March 2023 following a cyber-attack on the University.

As a result of the cyber-attack, 11 complaints were submitted to the Commissioner, which it confirmed were taken into account when examining the same.

Findings of the Commissioner

Following its investigation, the Commissioner concluded that the University did not apply appropriate security measures and had violated the principle of accountability as provided for in Articles 5(2) and 32 of the GDPR. Taking into consideration the technical and organizational measures taken by the University prior to the attack, mitigating factors cited by the University, and the fact that the University is part of the wider public sector.

Outcomes

The Commissioner imposed an administrative fine of €45,000. In addition, the Commissioner issued a mandate to the University requiring, within six months, that the University appoint a security officer including a temporary or substitute officer, to supervise the implementation of security measures and inform the Commissioner about the implementation progress.

You can read the press release, only available in Greek, here.