Student organisations are facing scrutiny from Cyprus' data protection authorities over allegations that they may have accessed and used the personal data of university entrants without a lawful basis.
A meeting involving the Ministry of Education, Data Protection Commissioner Maria Christofidou and representatives of the country's two public universities is scheduled for next Wednesday to examine complaints relating to the use of applicants' contact details following the publication of the Pancyprian Examinations results.
At the centre of the investigation is a long-standing practice whereby student groups contact successful candidates and their families shortly after results are announced, often inviting them to attend events or information sessions.
Complaints from parents
The issue gained public attention following remarks by Cypriot MEP Costas Mavrides, who alleged that hundreds of parents received telephone calls immediately after examination results were released.
According to Mavrides, callers would first congratulate students on their success before inviting them to events organised by student groups.
He said his own family also received a call from a withheld number linked to a specific student organisation.
Mavrides described the practice as a serious potential breach of data protection legislation, arguing that the General Data Protection Regulation (GDPR) gives the commissioner broad powers to investigate complaints and, where appropriate, refer cases to the police if evidence of systematic or deliberate violations emerges.
Commissioner confirms investigation
Christofidou confirmed that the matter is already under investigation following complaints submitted by parents and organised groups.
In a statement, the commissioner stressed that the publication of examination results does not grant third parties unrestricted access to applicants' personal information.
She noted that student organisations, associations or any other individuals contacting successful candidates or their parents must be able to demonstrate:
- The lawful source from which contact details were obtained.
- The legal basis for processing the data.
- The specific purpose for which the information is being used.
Possible consequences
The commissioner warned that if breaches are identified, her office will make use of all powers available under the law.
The investigation is expected to become the first major institutional examination of a practice that has been common for years following the announcement of university entrance results.
