EU will not intervene over alleged mass data leak in north

The European Commission plans to take no action over allegations that the personal data of more than 350,000 people was leaked after a file belonging to the Turkish Cypriot ‘health ministry’ was reportedly leaked on the dark web.

A commission spokesperson told the Cyprus Mail that “due to the suspension of the acquis in the non-government-controlled areas of Cyprus, the GDPR does not apply there”. As such, rules regarding personal data and its handling to not apply in the north, and the EU will not intervene.

Nonetheless, the spokesperson said that the EU has “clear rules on data protection”, and stressed that under the bloc’s general data protection regulation (GDPR), “organisations are required to secure personal data through appropriate technical and organisational measures”.

“The monitoring and enforcement of the application of the GDPR, as well as investigation into data leaks, falls under the exclusive competence of national authorities,” they added.

In line with this, an intervention would, under normal circumstances, be made by the national government of the place where a data leak occurred. However, in Cyprus, with the Turkish Cypriot community having been unable to enter government since 1963, this, too, is not possible.

The data leak was first reported by newspaper Yeniduzen last month.

The newspaper said that “highly sensitive data” belonging to 364,036 people, including names, surnames, identity card numbers, passport numbers, dates of birth, places of birth, addresses, parents’ names, telephone numbers, and vaccination records had all been leaked onto the dark web on January 8.

It quoted “cybersecurity experts” in the Netherlands who spoke on the condition of anonymity as having said that the file containing the data is “easily accessible on the dark web”, and that the data “can be used for many crimes, such as fraud, identity theft … blackmail, [and] stalking”.

“This is not an ordinary data breach, but a high-level security crisis which could directly affect the lives of hundreds of thousands of people,” it quoted the experts as having said.

Later, it reported that the source of the data leak was the “Adapass”, the Turkish Cypriot authorities’ Covid-19 vaccine certificate. The cards’ data was stored on a local database, which produced scannable QR codes on both digital and physical cards used by Turkish Cypriots to prove Covid-19 vaccination status.

In the absence of EU legislation, the Turkish Cypriot authorities’ own legislation will be enforced, with the existing legislation on the matter having been introduced in 2007, under the administration of Ferdi Sabit Soyer, and never having been updated since.

That legislation foresaw the protection of a personal data protection law, though this was only established in 2019, under the administration of Tufan Erhurman, who is now Turkish Cypriot leader. The board has 11 members, of which one, its chairman Kaan Kutlay, is a full-time employee.

Its function is to monitor the implementation of the Turkish Cypriot authorities’ personal data laws, though its power to enforce is limited, given that the penalties for breaches, like the rest of the legislation, have not been updated since 2007.

The maximum fine the board can unilaterally issue is 3,000TL, which, given the depreciation of the value of the Turkish Lira in the last two decades, is now worth €55.13.

Should the board wish to take the matter to court following an adequately serious data breach, courts have the power to issue fines amounting to 15,000TL (€275.63) and sentence those responsible to up to five years in prison.

The north’s ‘public works minister’ Erhan Arikli said last month that the Turkish Cypriot authorities were investigating the matter.

He added that the Turkish Cypriot authorities are “subjected to attacks from time to time”, and that the north’s telecommunications department “largely prevents these things without publicising them too much”.