Next Saturday, 27 September 2025, marks the end of the first term of the Commissioner for the Protection of Personal Data, Irene Loizidou Nicolaidou. On 6 August 2025, Nicolaidou sent a letter to the President of the Republic and to the justice minister.
The appointment is proposed by the justice minister due to the fact that personal data falls under the European Commissioner for Justice. In her lette, Nicolaidou expressed her wish to have her term renewed and drew attention to several significant issues affecting the institution.
Among other things, she noted that she was elected in May 2023, for five years (until 2028), as Vice‑President of the European Data Protection Board (EDPB). Because of that role, a High‑Level Meeting is scheduled for 21 January 2026 (in cooperation with the Cypriot EU Presidency), with the European Commissioner for Justice already officially invited by the President and Vice‑President of the EDPB. She pointed out that this period is critical for Cyprus in view of assuming the Presidency of the Council of the EU, due to preparations for participation/integration into the Schengen Area, as well as the implementation of EU digital instruments, the launching of significant actions during the Presidency, etc.
Christodoulides never replied to her letter.
An Appointment… out of the blue
On Wednesday, 17 September 2025, Maria Christofidou, provincial secretary of the women’s wing of the Democratic Rally (GODISY), daughter of Manolis Christofides, was appointed by President Nicos Christodoulides to the post of Commissioner for the Protection of Personal Data. Her name was not announced together with those of other commissioners whose terms are also expiring this period. She was appointed suddenly and on her own, five days after publicly criticising DISY, her party, in a Facebook post (Friday, 12 September 2025). In that post she claimed that, in order to avoid disturbing balances and quotas, she had been prevented from submitting a candidacy to be included in DISY’s ballot for the parliamentary elections of 24 May 2026. She even posted a photo of herself with Glafcos Clerides, accompanied by references to principles, truth, respect for democratic process, dedication, dignity.
Politis spoke with Christofidou, who said she first heard of her appointment on Monday, 15 September 2025 — the President himself had called her to ask whether she accepted the appointment. Justice Minister Marios Hartsios, simply congratulated her the following day. On 9 September 2025, Christofidou had not expressed interest in being a DISY candidate, although she had the right and could have done so (one cannot appoint someone as MP — one must contest the election). About fourteen months ago, in the double elections of June 2024 (9 June 2024), Christofidou stood as a municipal council candidate in Nicosia on the DISY ticket — she was not elected.
Experience
Regarding the post of Commissioner for Personal Data Protection, the following apply:
Under the EU General Data Protection Regulation (GDPR), Article 53(2), members of supervisory authorities — and the relevant commissioner — must be appointed on the basis of qualifications, experience and skills, particularly in the field of personal data protection, to ensure independence and effective performance of their duties.
Cyprus’s Law 125(I)/2018, which transposes and complements the GDPR, provides that the commissioner is appointed by the Council of Ministers following a proposal by the Minister of Justice. The law requires that the appointee be capable of carrying out the duties, and that they have the required experience and competence in data protection matters. The law does not formally specify exact academic or professional criteria, but emphasises necessary experience and proficiency. (Also, the EU Regulation has supremacy over the national law in this domain.)
European regulation
Specifically:
-
Article 52.1 GDPR requires that each supervisory authority performs its duties and exercises its powers with full independence.
-
Article 53.1 states that members of supervisory authorities must be appointed by means of a transparent procedureby one of the following: their parliament; their government; their head of state; or an independent body assigned by national law.
-
Article 53.2 requires that each appointee have the qualifications, experience and skills in personal data protection needed for the duties.
Independent from… party office?
Thus:
(a) The Authority must be independent.
(b) There must be a transparent procedure for this appointment (public call, declaration of interest, justified selection).
(c) There must be experience in data protection matters.
So, what does it say about the independence of the new commissioner when the person moves directly from being a provincial secretary of DISY to an “independent” official? With respect to the procedure and transparency as required by the GDPR, everyone has seen how this unfolded — not even the Minister of Justice, who proposes the person, was aware of who would replace the commissioner.
Furthermore, looking at the new commissioner’s biography, some raise questions about her knowledge of the field (and her direct professional experience), since Christofidou doesn’t appear to have prior work or studies specifically in personal data protection. She is a lawyer with a Master’s in European Law and head of a law firm that handles a broad range of civil, commercial and public law cases. She is a member of the Anti‑Corruption Committee and the Committee for Modernisation of Public Service Procedures under the Cyprus Bar Association, member and coordinator of Committees of the National Mechanism for Women’s Rights, as well as active in Women’s Indian Chamber of Commerce and Industry (WICCI) and G100 – Wing of Political Leadership. She has been on the board of the state broadcaster (RIK) for some years, and chaired the Management Committee of the RIK Staff Provident Fund. She is provincial secretary of GODISY in Nicosia. When asked why she accepted the appointment, given her political party affiliation, Christofidou said: “I accepted the appointment because I want to serve my country, both nationally and at European level. My guiding principle is exclusively the public interest and the safeguarding of citizens’ rights. For me, this role is above parties and factions — it concerns respect for institutions and for our society.”
Regulation vs directive
It is useful to note that the difference between an EU Regulation and a Directive is fundamental:
-
A Regulation is binding in its entirety, has direct effect in all Member States as soon as it is enacted, and requires no national implementation — it applies automatically.
-
A Directive binds Member States as to the result to be achieved but leaves them freedom about the form and method of implementation — they must transpose it into national law, resulting in possible differences in how states implement it.
In the case of the Commissioner for Personal Data Protection, Cyprus is bound by the EU Regulation (GDPR) itself.
Divide and rule
Irene Loizidou Nicolaidou was notified that her term would not be renewed only minutes before journalists were informed — until that moment she had been receiving messages that only her name was under consideration (i.e. for reappointment). She was called by the Minister of Justice & Public Order, during a meeting of the Council of Ministers on Wednesday, 17 September 2025 — he left the room to call her — and told that it appeared she would not be reappointed, and was informed “so that she would not learn it from the media”! Up until last weekend, the minister had not known about any change in person for the Commissioner for Personal Data, and was asking if anyone knew who his (own) future would be as minister.
It should be noted that the High‑Level Meeting in Cyprus this coming January with the European Commissioner for Justice has been cancelled, precisely because Nicolaidou was elected in her personal capacity as vice‑president of the EDPB, and she will lose that position immediately upon her replacement — something that has happened also in another country. The Brussels institutions must now be notified so that the position is properly filled. According to “P”’s information, the “Hill” (i.e. the presidency) is now, ex post, asking why this January meeting is cancelled duringCyprus’s Presidency of the Council of the EU… Then what? Why did the President of the Republic rush to appoint a commissioner from the opposition, especially while that person had publicly criticised his party? And why someone who is not independent in appearance, but has party ties? And why someone not from a party which allegedly supports the government coalition? And with a process lacking transparency and explanation? What else could be happening beyond serving the personal ambitions of the President — a second term, re‑election in 2028?
Prince or leader?
Finally, political ethics of each individual should matter to, and be judged by, society. Machiavelli’s The Prince(1469‑1527) holds that a ruler must appear to have all virtues, even if they must be discarded when circumstances demand it. That is, to seem virtuous — not necessarily to be. To appear compassionate, just, trustworthy — but not hesitate to act oppositely if state interest demands. The appearance of morality is more important than virtue itself. Also, the ruler “must be fox to recognise traps and lion to scare wolves”: combining cunning (as the fox) and strength (as the lion). The fox stands for diplomacy, deceit, flexibility; the lion for strength, power and fear.
Aristotle’s idea of the Leader is different: the virtuous citizen who governs for the common good, not for personal advantage. Calm judgement and moral excellence are essential in a proper leader. Only someone with these traits can make right decisions for the city, distinguish justice from injustice. Such a person has proper education, moral and spiritual cultivation, experience in public affairs. One who knows how to govern because they have also been governed — this helps them understand citizens’ needs, because authority is responsibility, not privilege.