C029-49 Cyprus Football Association

Cyprus DPA found a violation of Article 44 GDPR since the controller could not ensure a level of protection guaranteed by the GDPR. DPA did fine the controller or ordered the prohibition or suspention of the transfer to Google LLC. The Cyprus DPA held that Google LLC does not have to comply with Chapter V of the GDPR. The Cyprus DPA ordered the controller to ensure that the transfer takes place on basis of the new EU-US Data Protection Framework or on basis of an appropriate guarantee under Article 46 GDPR.

In respect of your complaint, Cyprus DPA acts as the lead supervisory authority under the GDPR. As part of the investigation, the Controller was asked a number of questions in relation to the issues raised in your complaint. Following the responses to the initial inquiries, Cyprus DPA followed up with additional questions, in order to further investigate the matters raised in your complaint. All responses are still being assessed and the investigation is still undergoing.

DSB replied that complaint is still being investigated, without providing any news.

DSB informed us that the complaint continues to be under investigation and that it is being handled in close cooperation with other concerned DPAs in order to esure a uniform approach.

DSB forwarded us a letter by the Cyprus DPA, which just states that they have commenced an investigation.