A complaint was filed with the Office of the Personal Data
Protection Commissioner against one of the major Banking
Institutions in Cyprus and its associated insurance company, by an
individual, who had requested a copy of his insurance policy, but
despite the relevant investigation, it was not possible to locate
it. According to the Bank, the client's account had been
transferred to another city many years ago and the original
contract had been filed somewhere where it was difficult and time
consuming to locate. For that reason, the Bank suggested to the
client to cancel the contract.
Nevertheless, based on the data of the investigation, it was
clear that the insurance company, as a separate controller, did not
illegally process the personal data of the complainant. On the
other hand, it was found that the Bank did not notify the
Commissioner of a breach of contract in relation to the loss of the
contract, as required by Article 33 of the Law providing for
