Public ‘should not be forced’ to have email to access state services

Amidst efforts to modernise the civil service, Cypriots should not be forced to have an email address to receive a service since some lack the necessary digital skills or internet access, the personal data protection commissioner said on Wednesday.

Irene Loizidou-Nicolaidou noted that her office supports technological development, but those solutions must be in line with the GDPR.

“If citizens are forced to give another person’s email address, for example to receive or pay a utility bill, this violates the GDPR. Also, citizens cannot be required to have an email address in order to receive a service. After all, some citizens do not have the appropriate skills and some, even a small number, do not even have internet in their homes.”

The commissioner instead proposed that some alternative solutions should also be offered.

E-government is expected to be fully online by 2027 and as part of the project free digital skills courses have been offered in all districts last year for people aged 55 and older.

In her statement, Nicolaidou also referred to a number of actions taken by her office on topical issues relating to the protection of personal data.

She said the processing of personal data by a private company in the context of traffic checks with mobile cameras does not violate the GDPR. “Any controller, in this case the director of traffic, within the framework of its legitimate activities, may entrust the performance of processing operations to a processor, in this case the contractor company.”

The only requirement is a written Processing Assignment Contract committing the contractor company to take appropriate security measures to protect citizens’ data.

“Other examples of outsourcing processing to private parties include airport controls and the issuing of driving licences,” she said.

Regarding reports that petrol station owners will take measures to curb the supply of fuel from the north, Nicolaidou said that if those involve processing of personal data, her office should be consulted first.

“To date, nothing has been brought before me,” she noted.

In relation to a recent cyber-attack on the Open University, she notes that her office has received the final report, adding that some clarifications were requested, which she has received and is evaluating.

With regard to the cyber-attacks on the University of Cyprus and the Land Registry, the commissioner states that “initial and interim disclosures have been received, which are also being assessed”, adding that “final disclosures are pending”.

“These incidents are still under investigation and we are in communication with other relevant authorities who are conducting parallel investigations,” she said.

Furthermore, she said that some reports refer to the creation of an application that users can download on their devices to be informed about services provided to Persons with Disabilities, such as locations where there are parking spaces and accessible buildings.

The commissioner said her office is in contact with the company that designed the app to assess, among other things, how it works, the legal basis and the information that will be requested from users.

“Even if the legal basis is consent, the security of users’ data should be ensured,” she said.