Not named in the source

What happened

In the context of an Article 60 GDPR procedure, the Cypriot DPA reprimanded a controller for unlawfully asking a data subject’s ID when addressing an access request and for failing to inform its users properly about a data breach.

Summary from GDPRhub (noyb), written by its volunteers, not by Fino. CC BY-NC-SA 4.0.

Rules involved

• Art. 5Principles relating to processing of personal data5(1)(c)Read →
• Art. 15Right of access by the data subject15(3)Read →
• Art. 34Communication of a personal data breach to the data subject34(1)Read →
• Art. 56Competence of the lead supervisory authorityRead →
• Art. 58Powers58(2)(b)Read →
• Art. 60Cooperation between the lead supervisory authority and the other supervisory authorities concernedRead →

• Data breach
• Data principles
• Data subject rights