Personal Data Protection: A Preeminent EU Right for the Cypriot Legal System

Abstract

Data protection plays a key role in the European Union (EU) edifice. It is an invaluable tool in ensuring the mandated free movement of goods, services, capital, and persons in the internal market. Harmonisation of data protection rules between Member States (MS) was a vital step to ensure uniform implementation of this fundamental EU competence. A first attempt—Directive 95/46/EC—proved to be incomplete but was followed by the General Data Protection Regulation (GDPR), a regulatory necessity in the digital age. Although Regulations are far more coherent legislative instruments than Directives, MS are afforded some leeway when adopting national rules in certain fields. Cyprus could hardly be the exception; having integrated the GDPR into domestic law, it maintained certain ‘national peculiarities’, especially in the fields of court proceedings, public interest, children’s consent, genetic and biometric data, and the combination of large-scale filing systems. However, some aspects of the national provisions continue to clash with the principles governing the processing of personal data (Article 5 of the GDPR). On a practical level, the Cyprus Commissioner for personal data protection should be able to reconcile such shortcomings; however, this has not been the case. This may be ascribed to either the downgrading of their role by other institutions, lack of expertise (given that the position does not require qualifications or experience in data protection), or even to the cultural attitude towards privacy in Cyprus. Despite the national peculiarities and the Commissioner’s downgraded role, Cyprus’ participation in the EU acquis undoubtedly ensures more effective personal data protection.