Newsroom
Fidias Panayiotou has been fined €6,000 after Cyprus’ privacy watchdog found that parts of his Agora platform continued collecting or processing personal information despite repeated instructions to temporarily shut them down.
The fine was imposed on Panayiotou personally in his role as the platform’s “data controller”—the person legally responsible for deciding how users’ information is collected and used.
Agora was created as an online direct-democracy platform, allowing people to register, create profiles, and participate in political votes and discussions. But behind the promise of letting citizens have their say lies a less exciting, though equally important, responsibility: protecting all the personal information users hand over when they sign up.
Personal Data Protection Commissioner Maria Christofidou said Panayiotou failed to fully comply with repeated requests to temporarily suspend all platform functions that collected or processed personal data while her office examined the system.
According to the 28-page decision, his compliance was “fragmentary” and incomplete, while some functions remained active despite the watchdog’s request for the entire platform to pause.
The Commissioner also said information and assurances submitted to her office did not fully or accurately reflect the platform’s actual operating status. That, she found, made it more difficult for the authority to properly investigate the case.
In everyday terms, the regulator’s message is straightforward: When the privacy watchdog asks exactly what an app is doing with people’s data, and tells its operator to pause while that is checked, partial answers and a partial shutdown are not enough.
The penalty concerns Article 31 of the EU’s General Data Protection Regulation, or GDPR, which requires those responsible for processing personal information to cooperate with supervisory authorities.
It is important to be clear about what the €6,000 fine covers. The penalty was imposed for failing to cooperate fully with the investigation, not simply because Agora existed or because the Commissioner had conclusively found that every use of personal data on the platform was unlawful.
Christofidou listed several aggravating factors, including what she described as incomplete and inconsistent responses, the continued operation of data-processing functions, and Panayiotou’s public insistence that Agora would not be taken offline.
She said those statements reinforced the impression that there was no substantial willingness to comply or cooperate with the authority.
Panayiotou had previously described the attempted suspension as a political attack and said he was prepared to take the dispute to European courts if necessary. His side also argued that compliance measures had been taken and that the correspondence and documents supplied to the authority demonstrated cooperation.
The Commissioner disagreed, saying an exchange of letters and the submission of some information did not satisfy the legal obligation if the responses were not complete, clear and timely.
She did, however, accept as a mitigating factor that there was no evidence Panayiotou had acted deliberately. After weighing that against the seriousness and duration of the violation, she described the €6,000 penalty as reasonable and proportionate.
