CYPRUS Law and Practice Contributed by: Stelios Christophides and Vasilis Charalambous, George Z Georgiou & Associates LLC
the data subjects, in which case consent must be obtained first. In all instances, call centres will need to inform the data subjects regarding the details of the processing. Data subjects should be informed beforehand regard - ing the details of the controller, the purpose of the call, the recipients, and their rights according to Article 11 (1) of the GDPR, and be provided with the means for the exercise of their right to refuse to receive calls in the future as well as in the continuation of the current call. 6.3 Text Messaging Direct marketing includes text messages (SMS) and emails that a customer receives from a service. 6.4 Targeted/Interest-Based Advertising Depending on the specific circumstances, the availa - ble legal grounds for targeted advertising are consent and legitimate interests. According to recent guidance published by the European Data Protection Board (EDPB) in order for the ground of “legitimate interests” to apply, the following conditions should be satisfied: • there is a legitimate interest pursued by the con - troller or a third party; • it is necessary (prior examination is needed as to whether less invasive methods are available); and • a balancing test is applied examining whether the act is proportional, ensuring that the legitimate interest is not overridden by the individual’s funda - mental rights and freedoms. When marketeers resort to the marketing methods of profiling and tracking across various websites, devices and locations, they should consider consent as being the most appropriate legal basis. However, the use of consent should not be considered as an all-round solution, and will not be deemed to be valid grounds for any disproportionate or unfair processing of personal data. According to the E-Privacy Directive (EC 2002/58/E), consent, as opposed to legitimate interests, is the applicable legal basis for the use of Cookies, pixels and tags. It should be further noted that the use of pre-ticked boxes or scrolling through a website would
not suffice as valid consent, and that any subsequent processing of personal information must also rely on consent. In accordance with Article 26 (2) of the GDPR, control - lers who wish to resort to targeted advertising meth - ods must inform the data subjects beforehand about any agreements with other controllers, be transparent about all aspects of their processing activities, and provide the means to the data subjects to exercise their rights. Τhe Cyprus Personal Data Commissioner may impose a fine for infringements of up to EUR20 million, or 4% of annual global turnover, whichever is greater. Furthermore, according to the Digital Services Act, users will need to receive more information when an According to the Children’s Law (CAP 352), a child is a person under the age of 18 years. There are specific provisions which apply with respect to marketing of goods/services to children, in industry-specific legis - lation and in CARO’s Code. Personal data is defined in the GDPR and the defini - tion which is adopted in the Cypriot Personal Data Law 125 (I)/2018 means any information relating to an identified or identifiable natural person, in particular by reference to an identifier such as a name, an identi - fication number, location data, an online identifier, or to one or more factors specific to the physical, physi - ological, genetic, mental, economic, cultural, or social identity of that natural person. The GDPR and the Cypriot Personal Data Law have specific provisions relating to the conditions which need to be satisfied in order to obtain a child’s con - sent in relation to information society services. The GDPR prescribes that the age threshold for obtaining the valid consent of a child is 16, whereas the Cyp - riot Personal Data Law provides that, in order for the processing of the personal data of a child under the age of 14 to be lawful, the consent of their custodian or legal representative is needed. ad targets them specifically. 6.5 Marketing to Children
78 CHAMBERS.COM
Powered by FlippingBook