Online Platform “Agora”

Facts — In October 2025, the DPA initiated an ex officio investigation after discovering that the digital platform/application "Agora" was launched under the responsibility of an MEP, the controller. The platform offered user participation in opinion polls, expression of political opinions, and applications for parliamentary candidacy. It also required user identification through ID cards and biometric data analysis. Because of large-scale processing and the involvement of special categories of data (political opinions), the DPA requested that the controller submit a Data Protection Impact Assessment (DPIA) for prior consultation under Articles 35 and 36 GDPR. The DPA also repeatedly requested the controller to temporarily suspend the platform's operation until the consultation process was concluded. Subsequently, the controller submitted an incomplete DPIA with pending mitigation measures and only partially suspended certain features (such as voting mechanisms and candidate data collection). However, on 23 February 2026, the DPA found that personal data processing was still ongoing, including user registration, identity verification, and access to candidate profiles. On the same day, the controller publicly stated in a livestream that there was "no chance" he would take down the app. Holding — The DPA stressed that the controller’s obligation to cooperate with the supervisory authority is autonomous. An infringement does not require a prior determination of substantive non-compliance (e.g., regarding legal basis or security measures) or proof of actual harm to data subjects. Following, the DPA held that the controller violated his obligation to cooperate with the supervisory authority under Article 31 GDPR and imposed an administrative fine of €6,000 under Article 58(2)(i) and Article 83(4)(a) GDPR. Holding — The DPA stressed that the controller’s obligation to cooperate with the supervisory authority is autonomous. An infringement does not require a prior determination of substantive non-compliance (e.g., regarding legal basis or security measures) or proof of actual harm to data subjects. Following, the DPA held that the controller violated his obligation to cooperate with the supervisory authority under Article 31 GDPR and imposed an administrative fine of €6,000 under Article 58(2)(i) and Article 83(4)(a) GDPR. Comment — Share your comments here!