Commissioner discusses the challenges for data protection in the digital era

Critical challenges as regards the protection of personal data in the digital era, with emphasis on the rapidly evolving artificial intelligence and the increasing use of social media, among other issues, have been analysed by the Commissioner for Personal Data Protection and Information of the Republic of Cyprus, Irene Loizidou-Nikolaidou.

Speaking in a recent interview with the Cyprus News Agency (CNA), on the occasion of European Data Protection Day on 28 January, Loizidou-Nikolaidou pointed out the need for continuous education and raising awareness, starting from primary schools. She underlined the importance of the careful management of personal data online, to protect citizens and their privacy from possible violations and abuses by third parties.

Loizidou-Nikolaidou also outlined the challenges and priorities of her Office for 2025 and, in her capacity as Information Commissioner, announced the forthcoming publication of a new Code of Practice aimed at the more effective implementation of the law on the provision of information by public authorities. 

Loizidou-Nikolaidou stated that the Council of Europe had established 28 January as the International Data Protection Day in 2006, noting that in this context she recently participated in a conference in Brussels representing the European Data Protection Board, of which she is Vice-President, elected in May 2023 for a five-year term of office.

Responding to a question about the type of cases her Office handles, Loizidou-Nikolaidou pointed out that citizens are not limited to filing complaints but also raise questions and express concerns. She noted that a large percentage of the complaints received concern unwanted messages (spam), explaining that "these are the messages that we receive without our consent and the well-known stop SMS in the message."

The Commissioner indicated that the imposition of administrative sanctions, ranging from warnings to fines, has proven effective in preventing repeat violations.

Data collection violations

At the same time, Loizidou also referred to cases in which organisations collect data in violation of the proportionality principle, without a legal basis or the consent of citizens. She added that her Office conducts regular and ex-officio checks on premises to ensure the legal operation of closed-circuit video surveillance systems.

In response to a question about the volume of cases investigated by her Office, the Commissioner provided an overview of her Office's activity. In particular, she said that on an annual basis around 500 cases are registered and investigated, while an equal number of citizens' enquiries, mainly for clarification or guidance, are answered directly. She pointed out that there is a notable upward trend in both the number of enquiries and the number of decisions issued.

Elaborating on the main challenges facing her Office, the Commissioner focused on the complexity of implementing new legislative and regulatory frameworks, with particular emphasis on the rapidly developing field of artificial intelligence.

A key issue, according to her, is the balancing of the newly introduced Regulations and European Directives with the existing General Data Protection Regulation. The challenge, as she explained, is to strike a delicate balance between, on the one hand, ensuring the effective functioning of organisations and businesses without infringing the privacy of individuals, and on the other hand, fully exploiting the potential of modern technology, including artificial intelligence, while keeping the protection of personal data intact.

Asked about her Office's priorities for 2025, Loizidou-Nikolaidou emphasized the need to adapt to new challenges arising from developments in the field of artificial intelligence and other regulatory frameworks. She also underlined the need to deepen technical expertise and strengthening of the human resources of her Office.

Personal data and cyber-attacks

Referring to the connection between personal data and cyber-attacks, the Commissioner for Personal Data Protection highlighted the frequency of relevant incidents reported to her Office. She clarified that the focus of the checks "is not the existence of cyber-attacks themselves, but the assessment of the organisations' preparedness against such threats."

Loizidou-Nikolaidou stressed the vital importance of fostering a culture of privacy awareness, with a particular emphasis on starting this process from primary education. She added that her Office has undertaken initiatives such as organising experiential workshops in schools, as it recognises that children's familiarity with technology starts at an increasingly young age.

The Commissioner made particular reference to the personal responsibility of citizens, noting that they often expose their data through the careless use of applications or τηε acceptance of cookies without fully understanding the consequences. She stressed the importance of carefully reading the terms of use and giving informed consent.

Responding to a question on the legislation governing the provision of information by public authorities to citizens and journalists, Loizidou-Nikolaidou recalled that the law came into force in December 2020. She also said that in order to implement the law more effectively, the Commissioner's Office has proceeded with the preparation of a Code of Practice, enriched with examples, which is expected to be published soon for use by the general public, especially journalists.

The Commissioner emphasized the importance of correctly implementing the law, describing it as a valuable tool "to enhance transparency and accountability."

(Source: CNA)