Nicosia, Cyprus. The European Commission said it will not intervene over reports that personal data belonging to more than 350,000 people was leaked from a file linked to the Turkish Cypriot ‘health ministry’ and posted on the dark web.
Commission position
A Commission spokesperson told the Cyprus Mail that, because the acquis is suspended in Cyprus’ non-government-controlled areas, the General Data Protection Regulation does not apply there.
The spokesperson said the European Union has clear data protection rules and that organisations subject to the GDPR must secure personal data through appropriate technical and organisational measures.
Monitoring and enforcement of the GDPR, including investigations into data leaks, fall under the exclusive competence of national authorities, the spokesperson added.
Under normal circumstances, authorities in the location where a leak occurred would intervene. However, the Turkish Cypriot community has not participated in the Republic of Cyprus government since 1963.
Reported data breach
The leak was first reported last month by newspaper Yeniduzen, which said highly sensitive information concerning 364,036 people had appeared on the dark web on January 8.
The reported data included names, surnames, identity card and passport numbers, dates and places of birth, addresses, parents’ names, telephone numbers and vaccination records.
Yeniduzen quoted anonymous cybersecurity experts in the Netherlands as saying the file was easily accessible on the dark web and could be used for fraud, identity theft, blackmail and stalking.
Adapass database
The newspaper later reported that the data had originated from Adapass, the Turkish Cypriot authorities’ Covid-19 vaccine certificate system.
Information for the certificates was stored on a local database that generated scannable QR codes for digital and physical cards used to confirm Covid-19 vaccination status.
