In July 2021, the Cypriot legal framework governing advertising practices has experienced an extensive overhaul whereby consumer protection legislation, legislation governing unlawful commercial practices and legislation controlling misleading and comparative advertisements has been consolidated in the Consumer Protection Law 2021 (CP Law 2021). The enactment of this legislation has further harmonised the Cypriot national legislation with the corresponding European legislation, which is the primary source of advertising legislation.

Industry-Specific Legislation/Self-Regulation

Please refer to 1.4 Self-Regulation and 1.5 Private Right of Actions for details of industry-specific legislation, which provides for additional requirements and prerequisites when advertising goods/services in the sectors mentioned below. 

Additionally, there is an Advertising Ethics Code which has been published by Cyprus’s principal self-regulatory organisation (see 1.4 Self-Regulation) which, inter alia, includes guidance notes on the topics of alcohol, food and advertising addressed to children.

There are various regulatory authorities which oversee advertising practices depending on the industry sector in which the trader is engaged. However, the main authorities are set out below.

Consumer Protection Service

The primary agency responsible for monitoring unfair commercial practices – which includes, inter alia, false and misleading advertising – is the Consumer Protection Service (CPS), which constitutes one of departments of the Ministry of Energy, Commerce and Industry. The CPS is entrusted with observing compliance with the Consumer Protection Law, investigates commercial practices (either following a complaint or of its own motion), and commences enforcement actions against traders. Where the CPS has identified breaches of the relevant legislation it can take the following actions:

• order traders and third parties such as domain owners, internet service providers and in general anyone hosting or reproducing the infringing content in any medium to remove content, restrict access to it or place a written notice to consumers before accessing the content;
• apply for injunctive relief against infringing traders; and
• impose administrative fines up to 5% of the annual turnover of the advertiser during the preceding year or up to EUR500,000.

Cyprus Radio Television Authority

Additionally, there is the Cyprus Radio Television Authority (CRTA), which is the regulatory authority supervising the operation of private radio and television stations in the Republic of Cyprus. The CRTA has its own Broadcasting Code and, following an investigation of a complaint, it is able to take the following actions:

• impose administrative fines of up to EUR8,500;
• revoke a TV or radio station’s licence, either temporarily or permanently; and
• apply to court for injunctive relief.

According to well-established principles of Cypriot company law, companies have a separate legal personality from their owners/shareholders and therefore liability does not extend to these individuals if the company has engaged in deceptive advertising. 

However, the CP Law 2021 establishes that a "trader" for the purposes of the legislation includes not only the natural/legal entity engaged in the trading practice but also anyone acting on behalf of the trader. Consequently, consumers may file an action against directors or other officers of the legal entity which is responsible for deceptive advertising seeking the remedies identified below (please refer to 1.5 Private Right of Action).

Criminal Offences

According to Article 64 of the CP Law 2021 any person who takes any action that may hinder or delay the work of the CPS whilst investigating any complaint – ie, by providing false or inaccurate information – commits a criminal offence which is punishable with up to six months imprisonment or a fine of up to EUR100,000 or both of these penalties, and this extends to the directors of a legal person as well.

Third Parties

Where third parties are involved, such as domain owners, internet service providers and in general anyone hosting or reproducing the advertisement in any medium, the failure to comply with the instructions of the CPS will have the effect that the third party and its directors will have committed a criminal offence.

The Cypriot Advertising Regulation Organisation (CARO) is the principal self-regulatory non-profit organisation in Cyprus for all mediums and for all industry sectors. It is a member of the European Advertising Standards Alliance and it has published its own Advertising Ethics Code which is analogous to the code of the International Chamber of Commerce. A substantial number of Cypriot TV stations, radio stations, newspapers and advertising agencies are members of CARO and have committed to adhere to its Code.

Procedure and Remedies

Any consumer can file a complaint with CARO with respect to an advertisement which the consumer considers to be misleading or contrary to CARO’s code. CARO operates a fast-track procedure in which the views of both parties (the complainant and the advertiser) are considered before a decision is reached within two weeks. CARO has established a two-tier system for examining complaints and both are able to provide the following remedies:

• requesting a withdrawal of the offensive advertisement; and
• ordering an amendment of the advertisement to render it compliant with its Code.

Whilst CARO is not afforded with the authority to enforce its decisions or to order monetary relief against the advertiser, it is able to enforce its decisions indirectly by taking the following actions:

• publishing its decision on its website;
• informing media providers, in which the advertisement is exhibited, of CARO’s decision and requesting the immediate removal of the advertisement (the majority of media mediums have contractually agreed to comply with CARO’s decisions); and
• informing other agencies with extensive regulatory powers such as the CPS, the CRTA and the Press and Information Office of the Republic of Cyprus to take action against the advertiser.

The CPL Law 2021 has, for the first time, introduced a private cause of action in which any consumer whose economic interests have been negatively affected through any breach of the legislation may bring an action against any trader who has engaged in deceptive or misleading advertising practices.

The court is able to provide the following remedies to consumers:

• declare that the contract is illegal, thereby the consumer is no longer legally bound by it;
• order a price reduction of any good/service which is the subject matter of the contract;
• award the consumer damages which the court considers reasonable; and
• take any other any other remedy the court considers reasonable under the circumstances.

Additionally, consumers are able to seek interim and final measures pursuant to Article 62 of the law and a trader may be ordered, amongst other things, to:

• immediately terminate and/or refrain from repeating the infringing acts;
• take remedial action, at the discretion of the court with a view to remedying the unlawful behaviour; and
• publish all or part of the court judgment or publish a remedial statement with a view to rectifying the continuing effects of the breach.

Advertising of certain industries in the Republic of Cyprus is specifically regulated by sector-specific legislation. In this section some of the key regulated industries and their respective legislation are outlined.

• Whilst the advertising of alcohol is generally not prohibited, the Radio and Television Broadcasting Stations Law of 1998 (as amended) regulates, inter alia, the time intervals, duration and show category in which advertising and telemarketing of alcoholic drinks is permitted.
• Similarly, the Radio and Television Broadcasting Stations Law of 1998 contains provisions relating to the advertising of children’s toys.
• The Insurance industry is also a sector which is specifically regulated by the Insurance and Reinsurance Business and Other Related Issues Law of 2016, which prohibits an entity from advertising in the specific sector prior to obtaining a licence from the supervisory authority.
• The Health Protection (Control of Smoking) Law of 2017 imposes a complete ban in respect to tobacco advertising in any available medium.
• The Medicinal Products for Human Use (Control of Quality, Supply and Prices) Law (70(I)/2001) prohibits, inter alia, advertising of all medicines for which a medical practitioner’s prescription is necessary; there are also additional requirements for regulating over the counter pharmaceutical products.
• The advertising of gambling activities in Cyprus is regulated by a Code of Practice issued by the National Betting Authority pursuant to the Betting Law (Law 37(I)/2019); the code of practice offers a comprehensive guideline detailing the general principles that should govern advertising of gambling such as the protection of minors, specific broadcasting times and direct marketing.

It is advisable that advertisers also observe CARO’s Advertising Ethics Code and specific guidelines in relation to children, alcohol, edibles and other non-alcoholic drinks.

During 2020 the CPS has examined, inter alia, the following cases.

Black Friday Sales

Breach of the unfair practices’ legislation during the “Black Friday” sales whereby a retailer, through its advertisement, invited consumers to purchase products at a specified price without disclosing the existence of any reason for believing that he would not be able to offer for supply those products or equivalent products at that price for a period, and where it was reasonable to expect that sufficient quantities existed. The scale of advertising of the product and the price offered constituted “bait advertising” in circumstances where consumers were unable to purchase the advertised products. The CPS imposed an administrative fine of EUR50,000.

Misleading Consumers

Breach of the unfair practices legislation whereby the trader misled a consumer in the following manner:

• making statements to the effect that the product could be legally sold when in reality it could not; and
• omitted material information which was necessary for the average consumer in order to make an informed decision causing the consumer to take a decision they would not have taken otherwise.

In this case a property developer advertised the sale and construction of a residential property which was alleged to have the necessary licences/permits provided by Cypriot law. The developer failed to inform the buyer that the property was encumbered. An administrative fine of EUR70,000 was imposed which was reduced by EUR42,500 following judicial review proceedings.

Misleading Display of a Trade Mark

Breach of the unfair practices legislation whereby a trader continued to display trade marks of a prior affiliate at a time where no commercial relationship existed. The CPS concluded that the average consumer would be misled that products of the affiliate were sold at the premises of the trader or that there was an economic link or that products of the affiliate were sold at the premises of the trader with the approval of the affiliate. The CPS imposed an administrative fine of EUR4,000.

The COVID-19 pandemic has not directly impacted the existing advertising framework in Cyprus. However, through client feedback we have identified that there has been a significant shift by advertisers/traders towards digital advertising/social media as a result of the lockdowns and restrictions on movement imposed by the Cypriot government during 2020.

The policies of the current administration have not substantially impacted the regulation of advertising in Cyprus. The legislative overhaul described in 1.1 Source of Regulations is a direct result of transposing European Union directives in national legislation.

Law on Consumer Protection

As mentioned in 1.1 Source of Regulations, the CP Law 2021 regulates unfair commercial practices (Part II) as well as misleading and comparative advertising. The Law prohibits unfair commercial practices and defines an unfair commercial practice as one which is contrary to the requirements of professional diligence and/or distorts, or is likely to substantially distort, the purchasing behaviour of the average consumer, is misleading and/or is aggressive. 

More specifically, the Law lists certain practices that are considered as misleading under any circumstances, such as falsely claiming to be a signatory to a code of conduct; unauthorised use of a quality, certification or other similar mark; and claiming that a good can increase the chances of winning in games of chance.

Furthermore, the CP Law 2021 defines both misleading actions and misleading omissions which are both considered as unfair commercial practices and are therefore prohibited. 

A misleading action occurs when an advertising practice misleads through the information it contains, or it is presented in a manner which is likely to cause deception (even if the information is factually correct) and causes, or is likely to cause, the average consumer to take a different transactional decision.

A misleading omission occurs when a trader, taking into account any imitations as to the means of communication of the commercial practice, omits material information required for an informed decision and as a result, causes, or is likely to cause, the average consumer to take a different transactional decision. If the trader is hiding material information or is presenting that information in an unclear, unintelligible, ambiguous or untimely manner, or is not mentioning the commercial intention of the practice, if this is not already evident, and if this causes, or is likely to cause, the average consumer to take a different transactional decision, it is inferred that this omission is misleading.

Advertising Ethics Code

Similar considerations are stipulated in CARO’s Advertising Ethics Code (please refer to 1.4 Self-Regulation) whereby all marketing communications must be truthful and not misleading. Marketing communications should not contain any statement, or claim which, directly or by implication, omission, ambiguity or exaggeration, is likely to mislead the consumer, with regard to:

• material characteristics of the product such as nature, composition, method and date of manufacture, range of use, efficiency and performance;
• the value of the product and the total price to be paid by the consumer;
• terms for the delivery, return, repair and maintenance of the product;
• intellectual property rights such as patents, trade-marks, designs and models and trade names; and
• official recognition or approval, or awards such as medals, prizes and diplomas.

All advertising claims are subject to regulation to the extent that they constitute unfair commercial practices or are contrary to the provisions of the CP Law 2021 subject to an express exception. Specifically, the CP Law 2021 provides that a statement which was obviously untrue so that it was not intended to be believed would not be considered as unfair commercial practice. There is no absolute requirement that empirical evidence is necessary before implied claims are determined by the courts/regulators, albeit such evidence will carry extensive persuasiveness. The courts/regulator adopt an approach whereby the advertisement is examined based on what the average consumer would understand such a claim to mean. 

According to the CP Law 2021, it is a requirement for advertisers to be able to substantiate advertising claims when they are investigated by the Consumer Protection Service and for this purpose, they must have in their possession such documentary evidence as required to prove that a claim is true and accurate. This is aligned with the obligation that advertising claims are honest and do not mislead consumers. There is no distinction as to the type of substantiation necessary based on the nature of the claim.

Similarly, CARO’s Advertising Code of Ethics stipulates that advertisers should be able to substantiate any claims made in their advertisements and where testimonials are used these must be genuine and based on personal experience. In respect to claims for goods falling in the foods and beverage categories all nutritional and health-benefit information should be supported by a sound scientific basis.

There are no specific standards that generally apply to testing conducted to support advertising claims. However, certain industries (discussed further in 2.6 Regulated Claims) impose their own requirements for making specific advertising which provide for scientific substantiation before making specific advertising claims.

Human clinical studies are impliedly necessary for making advertising claims, as a result of the provisions of the Medicinal Products for Human Use Law 70(I)/2001, whereby no medicinal or cosmetic product can be advertised without having obtained a marketing authorisation first from the Cypriot Pharmaceutical Authorities.

There are certain advertising claims which are specifically regulated, especially in relation to the following industries.

Food

Any claim made in relation to nutritional elements of food products must comply with the requirements of Regulation (EC) No 1924/2006. For example, when claiming that a product is high in fibre, certain information must be provided to the consumer in that regard. Furthermore, Regulation (EU) 1169/2011 regulates food information to be provided to consumers, and establishes general principles to be followed, particularly as regards labelling.

Food Supplements

Secondary legislation, namely Order 449/2004 which implements Directive 2002/46/EC, provides that no person is allowed, without the prior permission of the Director of the Public Health Service of the Ministry of Health, to publish any advertisement that is intended to promote food supplements in the consumer market.

Any advertisement for food supplements shall not contain any claim that a balanced diet cannot be a source of suitable nutrients in general. It is prohibited in any advertisement that promotes food products relating to weight loss, to make any reference to the time required or range of weight that can be lost due to the use of such product or any reference claiming that this food product can lead to reduced hunger pains.

Medicinal Products

Law 70/2001, which transposes Directive 2001/83/EC, prohibits certain claims to consumers in relation to medicinal products in the context of advertising, such as suggesting that the effects are guaranteed, without any adverse reactions or that they are better and more effective when compared to other treatments or products.

Other

Any labelling of organic products must be in accordance with Regulation (EC) No 834/2007. As regards protected designations of origin, protected geographical indications and traditional specialties the provisions of Regulation (EU) No 1151/2012 shall be followed.

In Cyprus, comparative advertising is permissible in accordance with the provisions of the CP Law 2021 which permits the identifying of a competitor. We note that statements must not be misleading, nor defamatory for the products or services of a competitor. In addition, an advertisement must not create confusion between the products, trade marks, trade names and other distinguishing marks of the advertiser and a competitor. Products or services being compared must meet the same needs or be intended for the same purpose.

A comparative advertisement must objectively compare one or more characteristics which are material, relevant, verifiable and representative of the said products or services, and price can also be one of these characteristics. Finally, for products with designation of origin, the advertisement must relate to products with the same designation.

Please refer to 3.1 General Requirements.

Advertisers may choose to challenge claims made by competitors in the following three ways.

Civil Action

An advertiser may commence a civil court action seeking interim and final relief and a trader may be ordered, amongst other things, to:

• immediately terminate and/or refrain from repeating the infringing acts;
• take remedial action, at the discretion of the court; and
• publish all or part of the court judgment or publish a remedial statement with a view to rectifying the continuing effects of the breach.

Complaint before the Consumer Protection Service

An advertiser may file a complaint with the Consumer Protection Service which may in turn order the competitor to take remedial actions such as to amend the advertisement or prohibit the publication of the advertisement. It may also impose fines in case of non-compliance or even initiate proceedings for court measures against the competitor, including injunctions. 

Nonetheless, according to CP Law 2021, the Consumer Protection Service, before examining any complaint for comparative advertising, may ask the advertiser to indicate whether any other available mechanisms such as self-regulation have been utilised and whether the complaint had been dealt with effectively under such mechanisms.

Complaint before CARO

An advertiser may file a complaint before CARO in relation to any claim made by a competitor. Where CARO agrees with the complainant it may request that the advertisement is either withdrawn or modified. (See 1.4 Self-Regulation for further discussion of the effectiveness of CARO’s remedies.)

The CP Law 2021 has enabled advertisers to directly seek court remedies in respect to comparative advertisements. We expect that in the coming years advertisers may seek to utilise these remedies more frequently.

Cyprus does not, at present, have legislation or guidelines addressing advertising via social media and, therefore, the advertising bodies responsible for monitoring advertising legislation as described in 1.1 Source of Regulations do not differentiate their approach. Consequently, advertisers engaged in social media advertising should adhere to the regulation and principles described in 1. Legal/Regulatory Framework, including CARO’s Advertising Ethics Code.

In addition to observing Consumer Protection legislation (see 2.1 General Standards), advertisers who choose to advertise on social media should consider the following.

GDPR Compliance

The primary source for protecting personal data in the European Union is the General Data Protection Regulation (GDPR). The provisions of the GDPR are applicable to operators of social media. Additionally, Cyprus has adopted national legislation in order to better implement and enhance its effectiveness. The focus of this section is the criminal offences that can be committed by controllers in circumstances where:

• a controller has provided false, or misleading information to the Data Commissioner, or fails to cooperate with the Commissioner; and 
• a controller does not notify the Commissioner of a personal data breach, or does not carry out an impact assessment.

The ECJ has ruled (Case No. C-210/16 and C-40/17) that website owners who use tools such as cookies or plug-ins to optimise their advertising on social media platforms are considered joint controllers with the social media platform for the purposes of the GDPR.

Accordingly, as a result of the ECJ case law and the criminal offences created by Cypriot domestic legislation, operators should be vigilant in collecting personal data.

The Digital Services Act (DSA)

In the near future it is understood that the Digital Services Act (DSA) will come into force in the European Union. We will focus on the two areas of the legislation which have an impact over social media advertising.

Content moderation – intermediaries

At present companies hosting data and other material in the EU are not liable for the content generated by its users. Whilst the existing rule will remain in place following the passing of the DSA, an exception is created whereby intermediaries will be required to remove content deemed illegal once they have been notified of this.

Transparency obligations

The DSA, in its current form, includes provisions which directly relate to online advertisements and which will render advertisements more transparent. Generally, advertisements in online platforms and more specifically on social media will have to provide users with information allowing them, inter alia, to appreciate that they are viewing an ad, why this ad has been displayed and on whose behalf the ad is presented.

The liability of advertisers for user-generated content has not been explicitly examined by the Cypriot courts.

However, the approach of the Cypriot courts in considering the liability of website owners in respect to defamatory content may be useful. In the first instance case Christos Clerides a.o v Arktinos Publishings Ltd 5208/2010, dated 31 January 2017, the court assessed the responsibility of the host in respect to user-generated content by reference to the degree of control over the user-generated content, the actions taken once it became aware of a complaint in relation to the content and the nature of the content itself.

At present there are no exceptions to disclosure requirements for advertising on social media notwithstanding any space limitations. However, we would recommend including at the beginning of the advertisement the characters "#AD" irrespective of the social media platform.

There is no specific set of rules and regulations which apply for major social media platforms in Cyprus. However, the upcoming DSA legislation will impose special obligations to major online platforms (those with 45 million members or more) which, inter alia, will include enhanced transparency, auditing requirements, advertising restrictions, data sharing with the relevant authorities, and the appointment of a specific compliance officer.

There are no special rules applicable to native advertising apart from the general advertising legislation and the industry-specific legislation identified in 1.1 Source of Regulations.

During the last decade, influencer marketing has become an increasingly important marketing resource in Cyprus, as in the rest of the world. The majority of the main social media platforms are used, with Instagram being the principal one on which influencer advertising is conducted. Whilst Cyprus has yet to publish guidance notes in respect of influencer advertising it is expected that, in the coming years, Cyprus will follow the global trend and adopt provisions enhancing transparency in influencer campaigns with a view to strengthening consumer protection.

Cyprus does not, at present, have legislation or guidelines tackling the use of influencers in advertising campaigns and is, similarly to social media, (see 4.1 General Requirements) largely unregulated. However, the DSA (see 4.2 Key Legal Issues) and the enhanced disclosure obligations are expected to impact the use of influencers in advertising campaigns.

It is recommended that the general rules and regulations regarding misleading advertising in Cyprus (see 1. Legal/Regulatory Framework above) should be observed and influencers should disclose whether there is a material relationship with a brand or advertising agency.

The CP Law 2021 encompasses an extensive definition of the word “trader” which includes …” and any person acting on behalf of the trader”. Whilst the application of this provision has yet to be tested by the Cypriot courts it is possible that an influencer may fall within the ambit of this definition and accordingly liability may extend to the advertiser itself. Consequently, it is advised that advertisers should actively monitor their influencers and ensure that the necessary contractual safeguards are in place to limit their liability.

The General Data Protection Regulation (EU) 2016/679 (GDPR) and the Cyprus Personal Data Law (Law 125(I)/2018), which implemented certain provisions of the GDPR and repealed the Processing of Personal Data (Protection of Individuals) Law 138 (I)/ 2001, are the two main pieces of legislation that regulate personal data processing in Cyprus. Under the GDPR, an entity that uses direct marketing, and specifically email marketing methods, will first need a legal basis in order to proceed and process personal data. In these circumstances, consent is the appropriate legal basis, while there are several exceptions determining whether it’s allowed to send emails to customers without asking for their consent.

E-Privacy Directive

Email marketing that is considered as a direct marketing method is regulated under the E-Privacy Directive, which requires an opt-in consent before processing a data subject’s personal data. However, if the data subject’s information was collected during the provision of services in the past and the individual was given the ability to opt out, emails may be sent on an opt-out basis, as long as the marketing relates to similar products/services for which the data subject’s details were originally collected. It should be mentioned that consent of a data subject refers to both a natural and a legal person.

Τhe Cyprus Personal Data Commissioner may impose a fine for infringements of up to EUR20 million or 4% of annual global turnover, whichever is greater.

Under the Radio and Television Broadcasting Stations Law of 1998 (as amended), which regulates telemarketing activities, it is clearly stated that the transmission of telemarketing messages is prohibited during children's programmes. The sale of pharmaceutical drugs through telemarketing is also prohibited.

In relation to the sale of alcoholic beverages through telemarketing methods the Law stipulates, inter alia, that interested companies shall ensure that their promotion is not directed towards minors, does not depict minors consuming such beverages, does not encourage the excessive consumption of alcoholic beverages and does not provide a negative impression of abstinence from consumption or their measured consumption.

A violation of the above provisions may result in a fine of EUR8,500 for every day that the violation takes place by the Cyprus Radio Television Authority.

According to the guidance published by the Cypriot Data Protection Commissioner, call centres can use the numbers listed in the telephone directories or random dialling of telephone numbers systems, without the consent of the data subject, when this does not entail a promotional action for a specific product or other advertising purpose. This is not the case when the activities of call centres entail advertising or when there is a need to store the personal data of the data subjects, where they will need to obtain their consent first.

In all instances, call centres will need to inform the data subjects regarding the details of the processing. Data subjects should be informed beforehand regarding the details of the controller, the purpose of the call, the recipients and their rights according to Article 11(1) of the GDPR and provide means for the exercise of their right to refuse to receive calls in the future as well as the continuation of the current call.

Direct marketing includes text messages (SMS) and emails that a customer receives from a service (see 6.1 Email Marketing).

Please see the guidance at 6.1 Email Marketing, which applies equally to internet-based advertising.

Depending on the specific circumstances, the available legal grounds for targeted advertising are consent and legitimate interests. According to recent guidance published by the European Data Protection Board (EDPB), in order for the ground of “legitimate interest” to apply the following conditions should be satisfied:

• there is a legitimate interest pursued by the controller or a third party;
• it is necessary (prior examination is needed regarding whether less invasive methods are available); and
• a balancing test needs to be applied, examining whether the act is proportional and ensuring that the legitimate interest is not overridden by the individual’s fundamental rights and freedoms.

When marketeers resort to marketing methods of profiling and tracking across various websites, devices and locations, they should consider consent as being the most appropriate legal basis. However, the use of consent should not be considered as a panacea and will not be deemed as a valid ground for any disproportionate or unfair processing of personal data.

According to the E-Privacy Directive (EC 2002/58/E), consent, as opposed to legitimate interest, is the applicable legal basis for the use of cookies, pixels and tags. It should be further noted that the use of pre-ticked boxes or scrolling through a website would not suffice as a valid consent and that any subsequent processing of personal information must also rely on consent.

In accordance with Article 26(2) of the GDPR controllers who wish to resort to targeted advertising methods will have to inform the data subjects beforehand about any agreements with other controllers, be transparent about all aspects of their processing activities, and provide the means to the data subjects to exercise their rights.

Τhe Cyprus Personal Data Commissioner may impose a fine for infringements of up to EUR20 million or 4% of annual global turnover, whichever is greater.

According to the Children’s Law (CAP 352), a child is a person under the age of 18 years. There are specific provisions which apply in respect to the marketing of goods/services to children in industry-specific legislation and in the Advertising Code published by CARO (see 1.4 Self-Regulation).

Personal data is defined in the GDPR and the definition which is adopted in the Cypriot Personal Data Law 125(I)/2018 means any information relating to an identified or identifiable natural person, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

The GDPR and the Cypriot Personal Data Law have specific provisions relating to the conditions which need to be satisfied in order to obtain a child's consent in relation to information society services. The GDPR prescribes that the age threshold for obtaining a valid consent of a child is 16 whereas the Cypriot Personal Data Law provides that in order for the processing of personal data of a child under the age of 14 to be lawful, the consent of their custodian or legal representative is needed.

The main criteria of whether a sweepstake or chance-based contest is permitted or not depends on whether a participation or registration fee is necessary. If the sweepstake requires any form of consideration to be paid by participants, this activity is likely to be classified as a lottery which is expressly prohibited pursuant to the Lotteries Law (Chapter 74).

Lotteries in general are not permitted under Cypriot Law, unless they fall under the following exceptions: 

• government lotteries;
• small lotteries in which the proceeds shall be allocated for charitable purposes; and
• private lotteries within organisations which are limited to the employees of those organisations.

Apart from the possibility of the chance-based contest being classified as a lottery, sweepstakes are to a large extent unregulated. Whilst sweepstakes are unregulated, the general advertising framework and provisions ensuring the protection of consumers should be followed. Additionally, any collection and processing of personal data should adhere to the GDPR and the Law Providing for the Protection of Natural Persons with Regard to the Processing of Personal Data of 2018. The purpose of using the data collected must be clearly defined and the consent requirements provided by the GDPR should be observed.

Cypriot legislation is silent with respect to games of skill. Absent any express legislation it is understood that games of skill are the opposite of games of chance (see 7.1 Sweepstakes). Whereas the winner of a chance-based game is determined by luck, skill-based games are those in which the winner is determined based on a physical or mental attribute and requires the active participation of the individual.

In circumstances where the winner is selected partly by a skill-based method and partly by a chance-based element this may constitute an infringement of the Lotteries Law provided that the word “lottery” is widely defined as any "scheme for distributing prizes by lot or chance". The same considerations regarding consumer and data protection in respect to sweepstakes will also apply to skill-based contest.

The present Cypriot legal framework does not provide rules mandating any government/regulatory body registration or pre-approvals in respect to skill-based contests.

As described above (see 7.1 Sweepstakes) almost all lotteries are unlawful. Therefore, any chance game which falls in the definition of lottery is prohibited. The exception permitted by law in respect to charitable raffles require an express permission from the Minister of Finance. 

There are no specific rules or regulations regarding loyalty programmes in the Republic of Cyprus. However, rules should be clear and unambiguous and comply with the general consumer protection legislation as well as data protection legislation where details of the owner of a personalised loyalty card are stored in a central database.   

An example of an unfair practice according to the CP Law 2021, is where a product is described as "gratis", "free", "without charge" or similar if the consumer has to pay anything other than the unavoidable cost of responding to the commercial practice and collecting or paying for delivery of the item.

According to Section 36 (7) of the CP Law 2021, a consumer may request an appropriate price reduction or withdraw from the contract if:

• neither repair nor replacement is possible;
• only repair is possible but it failed;
• the seller did not complete the repair within a reasonable time; or
• the seller did not complete the repair.

Pursuant to Section 45 of the Law, the seller who is selling at a discounted price shall ensure that:

• the current selling price; or
• the percentage of reduction,

has a general notice of the reduction which is clearly identifiable that is related to this product and is clear and sufficient.

Annex IV of the CP Law 2021 contains a non-exhaustive list of clauses that may be considered as being abusive. As an example, it is stated that a clause which “automatically extends the validity of a fixed-term contract, in the absence of a consumer declaration to the contrary, where the deadline for not extending the contract has been set at a date which is too remote in relation to the actual contract termination date” is abusive. Consequently, whilst such a contract is theoretically possible such a clause may breach the CP Law 2021.

Gambling Legislation

Sports betting or gambling in general in the Republic of Cyprus is not prohibited. The primary legislation which regulates "gambling" across the Republic of Cyprus is the Betting Law of 2019 (Law 37(I)/2019) as well as the Code of Practice Related to the Advertising of Betting Activities (RDA 350/2017), which has been amended very recently with the RDA 02/2021.

Furthermore, the Law on Betting Houses, Gaming Houses and Prevention of Gambling (Chapter 151) regulates specific gambling activities and imposes criminal liability in regard to some types of gambling activities. The Law on the Establishment, Operation, Activity, Supervision and Control of Casinos (Law 124(I)/2015) as well as the Regulations Regarding the Operation and Control of Casinos (RDA 97/2016), which refers to the licensing as well as to the operation of this area in Cyprus.

The regulatory authority entrusted with overseeing betting activities is the National Betting Authority, whereas for casino gaming and relevant activities which are regulated under Law 124(I)/2015 the relevant authority is the National Gaming and Casino Supervision Authority.

The Betting Law of 2019 defines “sports event” to mean any sport which is performed by natural persons for which physical strength and skill is required.

Betting is defined as any type of betting as regards sports events where the participants are natural persons or any other type of event in which natural persons participate and these events are taking place, and under the condition that the award for each participant is determined by the person who organises the betting event, before or at the time of its execution, with reference to both the amount that each player paid for their participation in the betting and the specified odds of the specific betting.

Land-Based and Online Betting

Cyprus has established two main forms of legal betting which are land-based and online-based. Companies may apply and obtain the following licences for gambling activities pursuant to the Betting Law of 2019.

Class A

This licence regulates land-based betting. Land-based betting activities can take place in licensed premises.

However, as regards casino-related games these activities may take place within the licensed casino premises and the satellite casino facilities which have been previously approved by the National Gaming and Casino Supervision Authority for this purpose and for any use of slot machines.

Class B

This licence regulates online-based activities excluding slot machines, online casinos lotteries and horse races. This type of betting takes place remotely through the internet, tv, etc. In order to participate in such betting, each participant shall participate through an online account.

Applicants wishing to obtain one of the above licences must include detailed know-your-customer (KYC) documentation and the fee for obtaining a valid licence for a year is EURO30,000 either for Class A or Class B.

Sanctions

The National Betting Authority may impose the following sanctions where there is a breach of the legislation or the terms of the licences:

• suspension of licence;
• revocation of licence; and
• imposition of administrative fines of up to EUR100,000.

Additionally, offering unlicensed betting services or services in breach of the terms of an existing licence are also criminal offences carrying a sentence of imprisonment up to five years as well as fines up to EUR300,000.

Advertising and marketing of sports betting is expressly regulated through the Betting Law 2019, in addition to the provisions of the CP Law 2021. Specifically, Section 89 of the Betting Law stipulates that it is a criminal offence when an advertisement:

• implies that gambling is socially acceptable, improves personal or financial success;
• is endorsed by well-known personalities in a manner which implies that it is related to their success;
• influences minors to participate;
• promotes betting services provided unlicensed individuals; and/or
• exceeds the boundaries of decency and propriety.

Anyone found guilty is liable to imprisonment for a period not exceeding six months or a fine not exceeding EUR30,000, or both.

Furthermore, the National Betting Authority has established an industry specific Code of Practice RDA 02/2021, which is applicable to licensed entities. Specifically, the RDA 02/2021 offers guidance according to which advertisements should be designed in a socially responsible manner with an emphasis on the protection of minors and other vulnerable social groups. Advertisements must disclose, inter alia, the licensed person, their services, the regulatory body and that the participation of minors in betting is prohibited.

The RDA 02/2021 details prohibited advertising practices namely where:

• the advertisement promotes excessive betting;
• not participating in gambling activities is portrayed in a negative light;
• antisocial behaviour is promoted;
• excessive alcohol consumption is promoted; and/or
• the vulnerabilities of minors or other vulnerable persons are exploited.

At present, there is no specific regulation regarding the advertising of cryptocurrencies or NFTs. Further to the publication and approval of the National Strategy on Blockchain and Distributed Ledger Technology in 2019, which was drafted with the collaboration of government and non-government organisations, the Ministry of Finance published, on 06 September 2021, a proposed bill which will serve as umbrella legislation for other targeted secondary legislation. This secondary legislation is expected to provide clarifications regarding the marketing and advertising of cryptocurrencies.

Additionally, the European Commission’s proposed Regulation on Markets in Crypto-Assets (MiCa), which is expected to come into force by 2024, and aims to improve competition, reduce risks and protect users and investors, will also incorporate clauses that prohibit unlawful market influence through social media.