**Title: EU Will Not Intervene Over Alleged Mass Data Leak in Northern Cyprus**
The European Commission has announced that it will not take action regarding a significant data leak involving the personal information of over 350,000 individuals in the northern part of Cyprus. This decision follows reports that a file belonging to the Turkish Cypriot 'health ministry' was leaked onto the dark web, raising serious concerns about data security and privacy.
A spokesperson for the European Commission clarified that the General Data Protection Regulation (GDPR), which outlines strict rules for data protection within the EU, does not apply to the non-government-controlled areas of Cyprus. The spokesperson stated, “Due to the suspension of the acquis in the non-government-controlled areas of Cyprus, the GDPR does not apply there.” This means that the EU will not intervene in the matter, as the regulations governing personal data handling are not enforceable in the region.
Despite the lack of EU jurisdiction, the spokesperson emphasized that the EU maintains stringent rules on data protection. Under normal circumstances, the responsibility for monitoring and enforcing GDPR compliance, as well as investigating data breaches, lies with national authorities. However, the unique political situation in Cyprus complicates this framework. Since the Turkish Cypriot community has not participated in the government since 1963, there is no national authority available to address the data leak.
The data breach was initially reported by the newspaper Yeniduzen, which revealed that the leaked file contained highly sensitive information, including names, identity card numbers, passport numbers, dates and places of birth, addresses, and vaccination records of 364,036 individuals. Cybersecurity experts from the Netherlands, who requested anonymity, indicated that the data is readily accessible on the dark web and could be exploited for various criminal activities, including fraud, identity theft, blackmail, and stalking. They described the incident as a "high-level security crisis" that could significantly impact the lives of many individuals.
Further investigation by Yeniduzen identified the source of the leak as the "Adapass," a Covid-19 vaccine certificate issued by the Turkish Cypriot authorities. The data was stored in a local database that generated scannable QR codes for both digital and physical vaccination cards used by Turkish Cypriots.
In the absence of EU regulations, the Turkish Cypriot authorities are expected to enforce their own legislation regarding data protection. However, this legislation, which was first introduced in 2007 during the administration of Ferdi Sabit Soyer, has not been updated since. Although a personal data protection law was established in 2019 under Tufan Erhurman’s administration, the enforcement capabilities of the relevant board remain limited. The board, consisting of 11 members, including one full-time employee, is tasked with monitoring the implementation of data protection laws. However, the penalties for breaches have not been revised since 2007, with the maximum fine that can be unilaterally issued being 3,000 Turkish Lira (approximately €55.13).
Should the board choose to escalate a serious data breach to the courts, the judicial system has the authority to impose fines of up to 15,000 Turkish Lira (€275.63) and can impose prison sentences of up to five years on those found responsible.
In response to the data leak, Erhan Arikli, the 'public works minister' of the Turkish Cypriot authorities, stated that an investigation is currently underway. He noted that the Turkish Cypriot authorities often face cyberattacks but asserted that their telecommunications department is effective in preventing such incidents, albeit without publicizing them extensively.
As the investigation continues, the implications of the data leak remain a pressing concern for the Turkish Cypriot community, highlighting the need for robust data protection measures and updated legislative frameworks to safeguard personal information in the region.