The General Directorate of Taxes has been declared the main "culprit" for the scandal of leaking salaries and personal data of 637,000 citizens of Cyprus and has been fined 3 million ALL or 25,000 euros.
The Commissioner for the Protection of Personal Data has undertaken a prolonged investigation regarding the public disclosure of sensitive data of citizens and issued a decision on November 24, 2022, where 6 legal violations from taxes for which they are established and the corresponding administrative measures.
According to the decision revealed by scan tv, during the investigation it was found that " There are no specific norms that regulate the storage, protection and security of personal data, during the processing processes carried out by the Controller, in the fulfillment of functional tasks. Also, no standardized and periodic monitoring processes have been established according to the regulations designed for the protection of assets and information, for the storage, integrity, availability and confidentiality of data .
Also, it results that " the General Directorate of Taxation has not undertaken concrete measures within the framework of the training of employees who have access to and process personal data related to the legislation in force for the protection of personal data." It results in non-fulfillment of obligations related to the establishment, administration and maintenance of the Information Security Management System (ISMS) regarding the protection of personal data" .
The decision also states that, the Controller has demonstrated a partially uncooperative approach, which, coupled with the non-addressing of the requests submitted regarding the provision of documentation and enabling access/demonstration of the operation of the "eTaxation" system, according to the requirements of the investigation group , has prevented the extensive development of the administrative investigation, contrary to the law.
Meanwhile, the main recommendation to the Tax Directorate is to clearly define the databases to which it is legitimate to have access and the categories of data that must be accessed in each database, as well as to take immediate measures in the direction of the prohibition of illegal access to those databases, the access to which is in excess of the data sufficiency principle.