One of the most prominent issues handled by the Office of the Commissioner for Personal Data Protection in 2024 was the widespread use of surveillance cameras in both public and private spaces, including shopping centres, apartment buildings, private homes monitoring public roads, and even medical clinics.
According to the Office’s 2024 Annual Report, this was a key concern throughout the year. The report is the final one under Commissioner Irini Loizidou Nicolaidou, who was not reappointed. It highlights the privacy risks associated with surveillance technologies and the importance of compliance with data protection regulations.
The complaints reflect a growing use of monitoring systems in citizens’ everyday environments, raising questions around the balance between security and individual privacy.
In total, 120 complaints were submitted in 2024 regarding unsolicited advertising messages. The Commissioner issued 69 decisions following investigations, inspections, and ex officio inquiries, along with 19 decisions related to data breach notifications.
State health services fined
The State Health Services Organisation (OKYPY) reported 13 personal data breach incidents in 2024 — 10involving the loss of patient medical records and 3 relating to missing emergency department registration forms. Each case involved a different individual.
Investigations revealed that no effective measures were in place to prevent the loss of such sensitive documents, nor did the existing file management procedures prove sufficient to safeguard the data.
As a result, the Commissioner imposed:
-
€5,000 fines for each of the 9 substantiated medical file loss cases (total: €45,000), along with formal reprimands.
-
€500 fines for each of the 3 emergency form losses (total: €1,500).
Total administrative fine to OKYPY: €46,500.
Data protection checks at polling stations
During the June 9, 2024 European Parliament and local elections, the Commissioner’s Office conducted checks at 104 polling stations to ensure compliance with the data protection guidelines issued on June 3.
The inspections verified:
-
That electoral lists provided to parties and candidates did not include ID numbers, birth dates, or fathers’ names of voters.
-
That ID numbers were not announced aloud during voting, to prevent disclosure to unauthorised persons.
The report confirms that electoral procedures and data privacy instructions were followed as outlined.
