The Office of the Commissioner for Personal Data Protection ('the Commissioner') published, on 14 July 2022, its decision, as issued on 11 May 2022, in which it fined the Cyprus Judo Federation €5,000 for violation of Article 31 of the General Data Protection Regulation ('GDPR'), following a complaint by a minor athlete's father against the minor's coach.

Background to the decision

In particular, the Commissioner detailed that the complaint concerned the publication of the athlete's audio-visual material on social media by the coach without the complainant's prior consent.

Findings of the Commissioner

Following investigation, the Commissioner found that the Cyprus Judo Federation did not cooperate adequately with the Commissioner, resulting in the violation of Article 31 of the GDPR.

Additionally, the Commissioner found that the Cyprus Judo Federation had previously sent a letter to all registered associations requesting that they obtain the consent of athletes' guardians prior the publication of their photos and auto-visual material on social media, which the coach failed to abide with, resulting in the violation of Article 6(1)(a) of the GDPR. However, the Commissioner took into account the fact that this violation only concerned one athlete who competes and thus, is exposed publicly, among other mitigating factors.

The Commissioner did not identify any mitigating factors for the Cyprus Judo Federation.

Outcomes

As a result, the Commissioner fined the Cyprus Judo Federation €5,000 and imposed a reprimand on the coach.

You can read the press release here, and the decisions here and here, all only available in Greek.