Fidias to fight €6,000 data fine over Agora app in court

Direct Democracy leader Fidias Panayiotou is taking Data Protection Commissioner Maria Christofidou to the administrative court, disputing a €6,000 fine imposed over his handling of the Agora platform. Responding to the commission’s ruling on Wednesday, the party insists the decision does not find any leak of personal data occurred, and instead rests on Panayiotou’s dealings with the regulator itself. “We disagree with the decision and have already contacted our lawyer,” the party said in a statement, assuring that it would pursue “the legal means at our disposal” by appealing to have the decision annulled. It said the case had been under scrutiny since this February and was “not a new incident”, and that no further comment would follow until its lawyer issues a formal position. The dispute traces back to the launch of Agora on February 19, before the data protection assessment required under GDPR and prior consultation with the authority had been completed. The regulator had already been in extended correspondence with Panayiotou and his legal advisers after learning the platform was due to go live, raising concerns over user registration, identification, profile creation and voting features. Panayiotou’s side argued at the time that compliance measures were in place, that the assessment process had progressed substantially and that several of the flagged functions did not pose the level of risk that would require prior consultation. He also raised arguments concerning the legal basis for processing user data, the proportionality of the measures sought and his cooperation with the regulator. Christofidou, rejected that account, for she described the €6,000 penalty as “reasonable and proportionate” for a breach of the prior consultation requirements. She found that Panayiotou, named in the decision as the platform’s data controller, had failed to meet the authority’s request to temporarily suspend Agora’s operations while personal data continued to be collected and processed, and that his conduct towards the regulator amounted to a breach of his obligation to cooperate. Christofidou cited a series of aggravating factors in reaching that figure. She said Panayiotou’s compliance with repeated and explicit requests to investigate the platform’s data processing was “fragmentary, incomplete and not responsive to the authority’s request in its entirety”. She further insisted that platform’s collection of personal data remained active during the authority’s audit despite a clear request for a full suspension. She added that information and assurances Panayiotou submitted did not, in light of the authority’s later findings, fully and accurately reflect how the platform was actually operating, which she said hindered a thorough assessment of the case. His public statements insisting the platform had not been disrupted were also weighed against him, taken by the authority as evidence of an unwillingness to comply. The commissioner said Panayiotou’s degree of responsibility as data controller required him to respond fully, clearly and promptly to her office’s requests, and that he had fallen short of that standard from the outset. Panayiotou has previously framed the investigation, first made public ahead of May’s parliamentary elections, as politically motivated. Christofidou rejected that characterisation, saying “the data protection authority is independent, and we do not operate politically,” with the authority having acted “solely to protect the public’s rights under GDPR and national law”.