Annita orders investigation after parliament data leak

House speaker Annita Demetriou ordered on Wednesday an investigation into how the House services published personal data of MPs’ family members. Demetriou asked the services to prepare a report of facts on exactly what happened and to comply strictly with all that the relevant legislation requires. The mistake saw information that should never have been posted appear on the Parliament website alongside the annual asset declarations (pothen esches), with the issue expected to be discussed by the House institutions committee. Disy MP George Pamboridis, who topped the published ranking with declared net assets of €3.37 million, raised the prospect of criminal liability. Speaking on CyBC, he said that when Parliament releases information whose disclosure by any other party would be an offence, “it is still a criminal offence”. “Criminal offences do not distinguish between who commits them and who does not.” Pamboridis said the aim was not to punish individuals but to establish procedures that serve the public interest. He called for an investigation to examine the data and said that if it was found to breach the law, the attorney-general’s office should bring a prosecution. He also criticised the way politicians’ declarations are presented, calling it “populism” that “feeds gossip and nothing more”. Alma MP Irene Charalambides wrote to Demetriou stating that the House had breached its own legislation. According to her letter, the website carried parts of declarations that the law expressly bars from publication, including personal data of spouses and reconciliation statements submitted to the tax commission. Despite Parliament’s announcement that the declarations had been withdrawn, they remained online until late on Tuesday. Charalambides said the law was passed by the same House “to serve transparency without sacrificing the rights of third parties”. She rejected any claim of oversight or time pressure, saying the deadlines and procedures were known. The issue is not technical. It is a question of accountability,” she wrote, adding that “a simple apology would not close the matter”. She also asked that those affected be told in writing what was made public, that the data protection commission be informed and that steps be taken to limit further spread of the data. The personal data protection authority has since intervened, having contacted the House and asked for the disputed data and links to be removed from websites where they remained accessible. It is awaiting formal notification of the breach under Article 33 of the General Data Protection Regulation (GDPR), which requires this without undue delay and, where feasible, within 72 hours of the controller becoming aware of the incident. The authority said it would assess the extent of the violation and the measures taken before deciding on any action. The data fall outside publication under the 2024 law governing the submission and audit of asset declarations by the President, ministers and MPs.