# Cyprus court annuls DPA order granting access to ongoing academic promotion reviewer

- Type: Case Law
- Source: Administrative Court of Cyprus
- Date: 2025-12-08
- Original: https://gdprhub.eu/index.php?title=ΔΔΚ_-_1181/18
- Canonical: https://overview.legal/posts/353979

## Summary

Facts — An assistant professor (the data subject) requested access to the content of evaluation reports by independent reviewers and letters of recommendation prepared during the academic promotion procedure from the University of Cyprus (the controller). The controller refused access during the ongoing promotion process, relying on their internal regulations and long-standing academic practice requiring confidentiality and anonymity of external reviewers to protect objectivity and impartiality. They indicated, however, that access could be granted after completion of the procedure, with the reviewers’ identities redacted. The data subject filed a complaint with the Commissioner, the Cypriot DPA. The DPA held that the controller had violated the right of access to personal data under Article 12 of Cypriot data protection law and issued a formal decision ordering the controller to ensure access, suggesting anonymization of reviewers’ names. The controller then appealed that decision before the Administrative Court. Holding — The Administrative Court annulled the DPA’s decision. It held that the DPA had failed to properly balance the data subject’s right of access under Article 15 GDPR against the legitimate interests of the controller in preserving confidentiality and procedural integrity during an ongoing promotion process. The Court emphasized that the timing of the access request was crucial and that temporary restrictions could be justified where disclosure might affect the fairness and objectivity of a complex administrative procedure. The Court further found that the DPA had focused too narrowly on anonymization and had not adequately considered whether deferring access until the conclusion of the promotion process would constitute a proportionate limitation of the right of access. The controller’s position was not to deny access permanently, rather, it indicated that access could be provided after the final decision, with reviewers’ names redacted.

## Full text

CYPRUS BAR ASSOCIATION Search - List of Administrative Court Decisions - Show References (Noteup on) - Remove Underlining ADMINISTRATIVE COURT PERSONAL Applicant __________________________________ A. Christou (Ms), for Ioannidis Dimitriou D.E.P.E., attorneys for the applicant. B. Christoforou (Ms), Attorney of the First Republic, attorney for the defendants of the application. DECISION KELEPESII, D.D.D.: With this appeal, the applicant seeks the following remedy: "Declaration of the Court that the act and/or decision of the Defendants Application dated 12.6.2018 which was notified to the Applicant on 15.6.2018 (Annex "A") and by which it was held that the Defendants' Application refusal of the Applicant to satisfy the request of the complainant Ms. A.P. for access to the content of the evaluations of independent judges and letters of recommendation, within the deadlines given, constitutes a violation of the provisions of article 12 of the Personal Data Processing (Protection of Individuals) Law no. 138(1)/2001, is invalid and/or devoid of any legal effect.” The essential facts surrounding the present case are as follows: On 19.6.2017, a complaint was submitted to the Commissioner for Personal Data Protection (hereinafter “the Commissioner”) by an Assistant Professor of the University of Cyprus against the University for its refusal to provide the complainant with access to the content of independent reviewer evaluations. In her letter, the complainant attached, among other things, a copy of an internal memo dated 16.2.2017 from the Director of Administration and Finance of the University, informing the complainant of the Senate's decision not to communicate to candidates, as stipulated in Regulation 9(7) of the University of Cyprus (Election and Promotion of Academic Staff) Regulations 1996 to 2015, the evaluation letters of independent reviewers and letters of recommendation submitted to the Special Committee during the evaluation process, which was received in the context of a previous corresponding complaint submitted by the complainant to the Commissioner for Administration and Protection of Human Rights. As explained in the Senate decision, which was also attached to the complaint in question, this: "is the practice followed over time in academic reviews and developments and it is deemed necessary to ensure the anonymity of the reviewers, in order to ensure their objectivity. In particular, the Senate believes that, based on international practice, evaluation letters and letters of recommendation are more reliable and are based on the data of the candidate's work instead of on networks of relationships of specialized scientific cooperation within each community, when they are managed confidentially, they are not communicated to the candidate and do not leak to the scientific community that treats the corresponding subject." The University was informed of the submission of the said complaint by a letter from the Commissioner dated 10.7.2017, which noted the Commissioner's prima facie view that the University could satisfy the complainant's request, as it is obliged by article 12 of the Processing of Personal Data (Protection of Individuals) Law of 2001, Law 138(1)/2001 (hereinafter "the Law"), which concerns the right of access, by providing a copy of the independent reviewer's evaluation and by outlining/blacking out his name and other identifying information, in a manner that preserves his anonymity. Therefore, the University's views on the above suggestion were requested by 31.7.2017. This was followed, on 21.7.2017, by a letter from the Director of Administration and Finance on behalf of the University, informing the Commissioner that the issue in question would be put for examination at the next Senate meeting scheduled for 6.9.2017. On 12.9.2017, a reminder letter was sent by the Commissioner to the applicant, requesting that the University expedite its response. By letter dated 25.9.2017, the University informed the Commissioner that the Senate had decided to request a legal opinion and subsequently examine the issue at its next meeting. On 14.11.2017, the Commissioner, by letter of the same date, called on the University to submit its positions by 30.11.2017, otherwise, as noted, she would proceed to issue a Decision based on the information before her. By letter dated 30.11.2017, the University responded that the Senate had re-examined the issue and decided that, due to its seriousness, its discussion should continue in subsequent sessions in order to make a final decision. By letter dated 24.1.2018, the Commissioner informed the University that she considers that there are no grounds for further extension of the matter for discussion at subsequent Senate meetings and called on it to satisfy the complainant's request by 31.1.2018, informing it that otherwise she will proceed to issue a Decision by sending a Warning to the University with an exclusive deadline for the removal of the ongoing violation. This was followed by the letter of the Rector of the University dated 30.1.2018, informing the Commissioner that the Senate, following the Commissioner's suggestions, did not complete the discussion of the issue, while noting that in the event that the Senate decides to adopt the Commissioner's suggestions, i.e. to allow access to the reports of the independent reviewers by hiding/shadowing their names, then the relevant University legislation should be amended, which clearly prohibits access to reports of independent reviewers, during the evaluation process of candidates for promotion. The same letter also stated that the complainant filed an Appeal before the Administrative Court against the University's decision not to proceed with her application and that, within the framework of the judicial proceedings, she has the right to inspect the administrative file of the case, which also includes the reports of the independent reviewers with blacked out names, and therefore, it concluded, that the complaint in question became irrelevant. Subsequently, the Commissioner, by letter dated 21.5.2018, informed the University that its refusal to satisfy the complainant's request for access to the content of the independent reviewers' evaluations and letters of recommendation, prima facie, violates the provisions of article 12 of the Law. He noted, among other things: “even if I accept that hiding/shadowing the names is not a viable solution because in very small scientific communities, it is easy for the reviewer to be recognized by the reviewee, I am of the opinion that there is an easy remedy for this issue, e.g. by giving clear instructions to the reviewer to avoid including personal references in the report that could reveal his identity.” Therefore, the University was requested to submit its positions by 29.5.2018, within the framework of the right to be heard. Following a relevant request from the University, an extension was granted for the submission of its positions until 8.6.2018, the date on which they were submitted by a relevant letter from the Rector. On 12.6.2018, the Commissioner issued her decision by which, after referring to the history of the complaint and the provisions of article 12 of the Law, she ruled that the University's refusal to satisfy the complainant's request for access to the content of independent reviewers' evaluations and letters of recommendation, within the deadlines given, constituted a violation of the provisions of article 12 of the Law. Furthermore, and based on her authority granted by article 25 of the Law, the Commissioner issued a strict warning to the University to adopt internal procedures that will allow, in accordance with the Law, the satisfaction of requests by members of the academic staff for access to evaluations and letters of recommendation of independent reviewers that concern them. In this regard, the Commissioner called on the University to inform her by 29.6.2018 of the actions it would take to comply. It is appropriate to quote the reasoning on which the Commissioner based her conclusion: “Rationale 3.1. The right of access constitutes the quintessence of the Law since, from it, other rights arise, namely the rights of objection, rectification and deletion, under the conditions set by the Law. The right of access concerns only personal data concerning the data subject. The satisfaction of this right cannot result in the disclosure of data concerning another person. In Recital 63 of Regulation (EU) 2016/679, which entered into force on 25 May 2016, inter alia, it is stated that: “This right should not adversely affect the rights or freedoms of others, such as professional secrecy or intellectual property rights and, in particular, the copyright protecting software. However, these factors should not result in the refusal to provide any information to the data subject." 3.2. Therefore, I suggested to the University that the names of the independent reviewers be redacted. The University failed to explain the reasons why it considered my suggestion to be unfounded. 3.3. The University was obliged to grant the complainant’s request for access within four weeks of the submission of the request or to inform her of the reasons for its rejection. After informing her of the reasons for the rejection of the request, the complainant exercised her right of appeal before me. Despite the fact that the University was given sufficient time to comply with my suggestions, the complainant’s request was not granted within the time limits given to it. 3.4. The University considered that the complainant's request became irrelevant when, following her appeal, it granted the complainant access to the administrative file of the developments, which also contained copies of her evaluations. However, the University, by this act, fulfilled its obligations arising from the administrative appeal procedure and not its obligations arising from article 12 of the Law. The right of access may be exercised at any time and its satisfaction has no relation to access to documents provided in an administrative appeal procedure.” The legality of the above decision, which was notified to the University on 15.6.2018, also constitutes the subject of this Appeal. It is noted that the University, in its subsequent letter dated 29.6.2018 to the Commissioner, noted, among other things, that a basic principle for the desired policy that it will draw up regarding access is that the right of access can only be satisfied after the completion of the development process and the adoption of a final decision by the collective bodies of the University in order to preserve the objectivity and impartiality of the final decision. With its written submissions, the applicant's side advances a series of grounds for annulment of the contested act, arguing that the contested decision is the product of error, incomplete research, contradictory and insufficient reasoning, as well as that it was issued in violation of the principle of proportionality and the principles of good faith and good administration. In particular and among other things, the applicant claims that the Commissioner failed to take into account and consider essential facts and legal parameters such as that the only document that could be provided during the process of evaluating the complainant for promotion or not was, in accordance with the regulatory framework governing the process, the report of the Special Committee, which was provided to her for the purpose of submitting comments before the Electoral College made a decision. The Commissioner did not take into account, the applicant's side continues, the fact that the evaluations of the Independent Judges could not be provided to the complainant, pending her promotion process, something which, as it emphasizes, is expressly prohibited by Regulation 9(7) of the University of Cyprus (Selection, Evaluation and Promotion of Academic Staff) Regulations. Most importantly, however, the applicant suggests, the Commissioner did not examine and evaluate the "specific reason" for which the applicant could not provide access to the reviews of the reviewers during the procedure and, in particular, whether the restriction on the right of access was justified for the purposes of protecting other purposes. In this regard, he suggests that what the Senate stated and was before the Commissioner regarding the need to preserve the confidentiality of the reviews of the independent reviewers and the need for confidential management and their non-leakage to the scientific community was ignored. And of course, the applicant submits, this case does not concern the right of access to a personal file and is in no way related to circular number 181/2017 "Policy for the Retention, Organization and Management of Personal Personnel Files", which the complainant attached when submitting her complaint, since the evaluations of the independent reviewers constitute part of the administrative promotion file and not the personal file. In this regard, it is submitted that the Commissioner failed to examine whether the right of access had ultimately been satisfied through the provision of the Special Committee Report, which also includes the evaluations of the independent judges, as well as whether the evaluations of the independent judges constitute personal data that concern only the complainant, given that they concern the opinion of a third party, and therefore it should have been examined whether the consent of the third party should have been obtained, as per the Directive that the Commissioner herself issued within the framework of the Law, or whether the disclosure of data constitutes a breach of trust of a third party. Nor did the Commissioner concern himself, the applicant continues, that the right of access is necessary in order to exercise the right of rectification and the right to delete data, and the evaluations of the judges could neither be corrected nor deleted. The applicant side emphasizes, with extensive references to the principle of proportionality, that the restriction placed on the right of access was reasonable, necessary and proportionate to the purpose it pursues, namely the need to preserve the confidentiality of the independent judges and their objective and impartial judgment as well as the preservation of the objectivity and impartiality of the final decision on whether or not to promote the candidate. It is further submitted that the Commissioner mistakenly proceeded to examine a complaint, which no longer existed at the material time of the decision, because the complainant had every right to inspect the evaluations of the independent judges and their recommendations, with blacked out names, in the context of Appeal 24/2018 that she registered against the decision not to promote her. The defendants' side of the application, supporting the legality of the contested decision, countered that the contested decision is duly justified and that it was taken after due investigation and without any error having been committed in its taking. It is noted that the two preliminary objections that had been raised with the written statement of the defendants' application regarding the lack of legal interest of the applicant and regarding the application of the doctrine of the prohibition of approval and disapproval, were withdrawn - and rightly so of course - by the learned counsel for the defendants' application during the clarification stage. I have carefully examined the positions of the learned counsel on both sides in connection with the content of the administrative file of the case. The appeal should have a successful outcome. First of all, it is appropriate to recall that the Processing of Personal Data (Protection of Individuals) Law of 2001, L.138(I)/2001, as it was in force at the time of the contested decision and therefore Article 12 of the Law, as it was contained therein, has been repealed by the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of such Data Law of 2018, L. 125(I)/18. It is noted that on 28.5.2018, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), entered into force. Hence, and for the purposes of effective implementation of certain provisions of the aforementioned Regulation, Law 125(I)/18 entered into force on 31.7.2018, as stated in its preamble. Article 12 of the repealed Law 138 (I)/2001, as it was in force at the material time, contained the following: "Right of access 12.—(1) Everyone has the right to know whether personal data concerning him or her are or have been the subject of processing. To this end, the controller is obliged to respond in writing and provide a copy of his or her personal data upon request by the data subject, where this does not involve a disproportionate effort. (2) The data subject shall have the right to request and obtain from the controller, without undue delay and without undue expense- (a) Information concerning- (i) All personal data concerning him or her which have been processed, as well as available information on their origin; (ii) the purposes of the processing, the recipients or categories of recipients, as well as the categories of data which are or will be processed; (iii) the progress of the processing for the period since the previous information or notification; (iv) the logic underlying any automated processing of data relating to him or her, in the cases of decisions taken pursuant to Article 16(1). (b) The rectification, erasure or blocking of data which have not been processed in accordance with the provisions of this Law, in particular due to inaccuracies or incompleteness. (c) The communication to third parties to whom the data have been disclosed of any rectification, erasure or blocking carried out pursuant to paragraph (b), unless this proves impossible or involves disproportionate effort. (3) If the controller does not respond within four weeks of the submission of the request or if his response is unsatisfactory, the data subject shall have the right to lodge a complaint with the Commissioner. (4) By decision of the Commissioner, upon request of the controller, the obligation to provide information in accordance with subsections (1) and (2) may be waived, in whole or in part, if the processing of personal data is carried out for reasons of national needs or national security needs of the Republic or for the prevention, investigation, detection and prosecution of criminal offences or for reasons of important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and tax matters. (5) The right of access may be exercised by the data subject with the assistance of a specialist. (6) Data concerning health shall be communicated to the data subject through a doctor. (7) The right of access shall be exercised by submitting the relevant application to the controller and the simultaneous payment of a sum of money, the amount of which, the method of payment and any other relevant issue shall be regulated by Regulations. This amount shall be refunded to the applicant if his request for correction or deletion of the data is deemed valid either by the controller or by the Commissioner, in the event of his recourse to the latter. In the latter case, the controller shall be obliged to provide the applicant, without delay, free of charge and in an intelligible language, with a copy of the corrected part of the processing concerning him. As has already been recalled, at the time of the adoption of the contested decision, Regulation (EU) 2016/679 had already entered into force, Article 15 of which provides for the right of access. What is first observed is that the Commissioner was right to draw attention to recital 63 of the Regulation in question, in the light of which the right of access must be interpreted. This is because a series of CJEU decisions indicate that, based on the principle of proportionality and as expressly provided for in that recital, the right of access should not adversely affect the rights or freedoms of others. In the very recent judgment of the CJEU (on a preliminary ruling) of 27.2.2025 in case C203/22, the following was said in this regard: “53 As regards, in particular, the right of access provided for in Article 15 of the GDPR, it follows from the case-law of the Court that that right must enable the data subject to ascertain that the personal data concerning him are accurate and that they are processed lawfully (judgments of 4 May 2023, sterreichische Datenschutzbehrde and CRIF, C487/21, EU:C:2023:369, paragraph 34, and of 26 October 2023, FT (Copies of medical records), C307/22, EU:C:2023:811, paragraph 73). 54 The right of access is necessary in order for the data subject to be able to exercise, where appropriate, the right to rectification, the right to erasure (‘right to be forgotten’) and the right to restriction of processing, which are conferred on him, respectively, by Articles 16, 17 and 18 of the GDPR, the right to object to the processing of personal data concerning him, provided for in Article 21 of the GDPR, and the right to bring an action and the right to compensation, provided for in Articles 79 and 82 of the GDPR, respectively (see, to that effect, judgment of 4 May 2023, sterreichische Datenschutzbehrde and CRIF, C-487/21, EU:C:2023:369, paragraph 35).[..] 68 In that regard, it should be noted at the outset that, according to recital 4 of the GDPR, the right to the protection of personal data is not an absolute right and must be balanced against other fundamental rights, in accordance with the principle of proportionality. The GDPR therefore respects all fundamental rights and observes the freedoms and principles recognised by the Charter and enshrined in the Treaties (judgment of 26 October 2023, FT (Copies of medical file), C307/22, EU:C:2023:811, paragraph 59 and the case-law cited). 69 In addition, according to recital 63 of the GDPR, the right of each data subject to access to personal data collected and concerning him or her should not adversely affect the rights or freedoms of others, including professional secrecy or intellectual property rights and, in particular, copyright protecting software. 70 However, the above factors should not result in the refusal to provide any information to the data subject. In particular, Article 23(1)(i) of the GDPR provides, in essence, that a restriction on the content of the obligations and rights provided for, inter alia, in Article 15 of the GDPR is possible only where it respects the essence of the fundamental rights and freedoms and constitutes a necessary and proportionate measure in a democratic society to ensure the protection of the rights and freedoms of third parties. 71 As regards the related right to obtain a copy, enshrined in Article 15(4) of the GDPR, the Court has already stated that its application must not prejudice the rights and freedoms of third parties, including professional secrecy or intellectual property, in particular the copyright protecting software (see judgment of 4 May 2023, sterreichische Datenschutzbehrde and CRIF, C487/21, EU:C:2023:369, paragraph 43). 72 In that context, the Court has stated that, in the event of a conflict between, on the one hand, the exercise of the right of full access to personal data and, on the other, the rights or freedoms of third parties, a balancing of the conflicting rights and freedoms must be carried out. Whenever possible, means of communication of personal data should be chosen which do not infringe the rights or freedoms of third parties, taking into account, however, that, as follows from recital 63 of the GDPR, such factors should not “have the effect of denying the data subject any information” (judgment of 4 May 2023, sterreichische Datenschutzbehrde and CRIF, C487/21, EU:C:2023:369, paragraph 44).” Therefore, what is observed is that the Commissioner rightly drew attention to recital 63 of the Regulation, but not comprehensively. In this case, the Commissioner limited herself to finding that the University failed to explain the reasons why she considered her suggestion to conceal/black out the names of the independent reviewers to be unfounded. However, the issue did not end there. This is because the blackout of the names in order to preserve the anonymity of the independent judges was only one of the parameters and did not cover all the data and the emerging conflicting interests that the Commissioner was required to balance (CNP CYPRIALIFE LTD and the Commissioner for Personal Data Protection (E.D.D. no. 81/16, dated 26/7/23) and especially as these had been placed before her with the applicant's representations. In this case, the University itself explicitly submitted in its representations that during the evaluation process for the promotion or not of the candidate, it could not provide such access before the final decision was made. In this regard, it is considered appropriate to quote what the University itself noted, emphasizing its readiness to comply with the Commissioner's suggestion and provide access to the reports of the independent judges. reviewers in view of the fact that, now, the final decision resulting from the evaluation process had already been taken: "1. The specific request for access to the reports of the independent reviewers was submitted by the complainant to the University, in the middle of her evaluation process for promotion before the final decision was taken. The University of Cyprus did not allow the complainant access to the evaluation reports of the independent reviewers while the said evaluation process was still pending. 2. In view of the fact that the evaluation process of the complainant has been completed and a final decision has been taken (which decision, in any case, she challenges before the Administrative Court and therefore she may at any time wish to inspect the administrative file of her promotion process and which includes the reports of the independent reviewers), the University complies with your decision and allows the exercise of the right of access to the relevant documents as they are filed in the file of the promotion process (i.e. with the names of the independent judges shaded, as was also your suggestion in your above letter). 3. In general, it is noted that the decision for promotion constitutes a complex administrative act, with the final decision being taken by the University Council, following a decision by the Senate and the Electoral College and a proposal by the Special Committee. Access to information concerning the evaluation process of a candidate before the final decision is made cannot, nor should it, be given. The only document given to the candidate under consideration during his/her evaluation process is the report of the special committee in order for the candidate to submit any comments before a decision is made by the Electoral College, which is part of the evaluation process as defined in the relevant legislation, thus simultaneously exercising the candidate's right to a prior hearing before an executive administrative decision is made concerning him/her." The above does not seem to have concerned the Commissioner, especially since it was an intermediate stage of the procedure and the evaluation process was in progress, so that, as the applicant suggests, other issues were potentially at stake, such as the need to preserve the confidentiality of the independent reviewers and their objective and impartial judgment, as well as the preservation of the objectivity and impartiality of the entire procedure until the final decision on the promotion or not of the candidate was made. Moreover, it is recalled that in addition to what had been indicated in the context of the University's representations, the Senate itself had previously justified the reasons for which it was necessary to maintain the confidential management and non-leakage of the evaluations, positions which were before the Commissioner. I note that I have not lost sight of what is stated in recital 63 itself, namely that other factors (for example, professional secrecy) should not result in the refusal to provide any information to the data subject. However, the University did not dispute in its representations that the complainant had a right of access. In other words, the University did not generally deny the non-satisfaction of the complainant's request for access but refused such access during the procedure in compliance with the requirements of Regulation 9 (7) of the relevant Regulations on the prohibition of communication to the candidate of the evaluations of the independent judges and the communication to him only of the report of the Special Committee before the examination of the issue of his promotion by the electoral body. In this case, the Commissioner does not seem to have turned her attention to whether these more specific circumstances, given the position submitted by the University regarding a complex administrative action that was in progress, would justify, as the University submitted, any variation in the time for compliance with the Commissioner's suggestion for granting the complainant a right of access. Therefore, the time for compliance was an element that should have been taken into account and weighed up, but this did not particularly concern the Commissioner, who was content to state that the right of access can be exercised at any time. And of course, it is not up to the Court to proceed primarily with such a process and to substitute its judgment for the missing investigation and judgment of the competent body. On the contrary, this is the exclusive task of the administration to exercise a comprehensive judgment in light of all the elements and parameters (Melis v Demokratias (2013) 3 AAD 703). Consequently, and on the basis of the above findings, the possibility of an error in the reasoning of the defendant in the application cannot be ruled out (Konstantinou v. Council of Viticultural Products (1992) 3 AAD 228 and Demokratias v. Mavrommatis et al. (1991) 3 AAD 543). Given the above findings, it is unnecessary for the Court to deal with the remaining grounds for annulment advanced by the applicant. Consequently, the appeal succeeds and the contested decision is annulled. Costs of €1800 plus VAT are awarded in favour of the applicant and against the defendants.

---
Generated by overview.legal · https://overview.legal/posts/353979 · 2026-09-16