Administrative Court - 14/2020

Administrative Court - 14/2020
Court:	Διοικητικού Δικαστηρίου (Cyprus)
Jurisdiction:	Cyprus
Relevant Law:	Article 6(1)(f) GDPR
Decided:	23.01.2024
Published:
Parties:	LGS Handling Ltd Louis Travel Ltd Louis Aviation Ltd
National Case Number/Name:	14/2020
European Case Law Identifier:
Appeal from:
Appeal to:
Original Language(s):	Greek
Original Source:	CyLaw (in Greek)
Initial Contributor:	nzm

A Cypriot Court annulled a decision considering the Cypriot DPA did not investigate a case appropriately.

English Summary

Facts

On 6 June 2018, a complaint was lodged against 3 controllers (LGS Handling Ltd, Louis Travel Ltd, Louis Aviation Ltd) regarding the implementation of an automated system for managing, monitoring and controlling the sick leave absences of their employees using a scoring tool known as the Bradford Factor. The Bradford factor is calculated based on the number of occasions of absence and the total number of days absent in a 52-week period.

The Cypriot DPA ("Commissioner") indicated that the date of sick leave and the frequency of taking sick leave, insofar as the data subject’s identity is disclosed constitutes “special categories of personal data” as defined by Article 9(1) GDPR. Employers are entitled to exercise supervision over the frequency of sick leave and/or the validity of sick leave, however, this right must not be exercised within the limit set by the relevant legal framework and should therefore be limited to what is necessary.

The Commissioner decided that the rating of statutory sick leave was beyond the competence of the employer and that the legitimate interest assessment was inconclusive. The decision also indicated that the legitimate interest assessment would have been valid if the automated system was simply counting the number of absences due to sick leave without multiplying with other factors such as frequency. The Commissioner therefore concluded that the controller had in fact breached Articles 6(1) and 9(2) GDPR and therefore imposed an administrative fine of €70, 000, €10,000 and €2,000 respectively.

The controllers appealed this decision in front of the Cypriot Administrative Court on 25 October 2019.

Holding

The appeal focused on whether the system they were using was investigated correctly.

The administrative court decided that the Commissioner did not have the power nor the authority to impose on controllers whether or not to use a system because its power is limited to investigating whether the processing carried out is lawful.

The administrative court also indicated that the Commissioner did not take into account the fact that the controllers and their consultants submitted two different calculating methods for the Bradford Factor. This shows there was an error and a lack of investigation from the DPA. Before reaching its final decision, the Commissioner should have clarified the contradictory positions in order to clarify the actual circumstances in which the processing was carried out.

Therefore, the administrative court decided that the appeal succeeded and annulled the contested decision.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Greek original. Please refer to the Greek original for more details.

ALL CYPRUS BAR ASSOCIATION Search - List of Administrative Court Decisions - Display References (Noteup on) - Remove Underlines ADMINISTRATIVE COURT (Case No. 14/2020) January 23, 2024 [E. MICHAEL, DDD] Between 1. LGS HANDLING LTD 2. LOUIS TRAVEL LTD 3. LOUIS AVIATION LTD Applicants AND THE REPUBLIC OF CYPRUS THROUGH THE COMMISSIONER FOR PROTECTION OF PERSONAL DATA Per Application .......... Anna Christou (Ms) for Ioannidis Dimitriou D.E.P.E., for the applicants. Irini Neofytou (Ms) for Attorney General, for the defendant the application. TO MICHAEL, DDD: The appeal of the applicants is directed against the decision of the respective application dated 25.10.2019 by which it was judged that the applicants violated the provisions of Articles 6(1) and 9(2) of the EU Regulation 2016 and imposed on them an administrative fine of €70,000, €10,000 and €2,000 respectively. On 6.6.2018, a complaint was submitted to the applicant by the Independent Labor Union of Private Employees, SEK, in relation to the application of an automated system by the applicants for the management, monitoring and control of the absences of their employers due to illness. After an investigation, each application concluded that there is a prima facie violation of the applicants' obligations as they arise from Articles 6(1) and 9(2) of EU Regulation 2016/679 and requested the applicants to submit the their positions so that an administrative fine is not imposed on them. The applicants submitted their positions on 2.9.2019 and on 25.10.2019 the contested decision was issued. The grounds for annulment put forward by the applicants concern, in summary, a mistake of law and facts, misleading and incorrect reasoning, violation of the rules of natural justice due to deprivation of the right to submit mitigating circumstances and violation of the principle of equality. As mentioned in the contested decision, the object of the complaint was the following: "1.1. On 06.06.2018, I received a complaint from the Free Trade Union of Private Employees SEK against the Louis Companies, which implement an automated system for the purpose of managing, monitoring and controlling employee absences due to illness, using a scoring tool known as " the Bradford Factor" (Bradford Factor). Said system is also accessible on the intranet of the Louis Companies." On pages 26 - 27 of the contested decision, the following is stated: "4.1 The date of sick leave and the frequency of receiving sick leave concerning a living natural person, insofar as his identity is immediately or indirectly revealed, constitute "special categories of personal data ", according to the definition given in Article 9(1) of the Regulation. The automated system used constitutes a "filing system" under the definition in Article 4(6) of the Regulation. Feeding an automated system with the above personal data, grading them using the "Bradford Coefficient" and subsequently compiling profiles of natural persons, based on the results produced/extracted, constitute processing of personal data, within the meaning of Article 4(2) of Regulation. Louis Companies is responsible for processing (Article 4(7) of the Regulation). Data subjects are the employees of the Louis Companies (Article 4(1) of the Regulation). 4.2 The Louis Companies, as employers, have the right to exercise supervision over the frequency of sick leave and/or the validity of sick leave certificates. However, such a right should not be exercised abusively and should also be exercised within the limits set by the relevant legislative framework. A processing to be lawful should be limited to what is necessary for the organization, control and processing of the company's turnover. The employer cannot exercise unlimited control and supervision over the employees, violating their personality. Scoring statutory sick leave is beyond the employer's remit, as it makes itself a doctor or health professional and "punishes" employees who take sick leave on certain days of the week/month and/or frequently and/or systematically. 4.3. Where the objective identified by the employer can be achieved in a less intrusive and burdensome manner, the employer should consider this option. In the case under consideration, the Louis Companies could invite to oral interviews/meetings the employees who are absent on certain days of the week/month and/or frequently and/or systematically due to illness and/or the employees who are suspected and/or complaint that they present false sick leave certificates. 4.4.1. In considering the question of grading sick leave, the employer should always bear in mind that, although employees have a right to a certain degree of personal protection in the workplace, this right must be balanced against their right to control the operation of his business and to be protected from actions of employees that may harm his legitimate interests, such as for example the legal liability of the employer for the actions of his employees. 4.4.2. In this context, the employer must carry out a Legitimate Interest Assessment." The parties do not seem to disagree that the processing carried out falls within the scope of Law 125(I)/2018 and Regulation (EU) 2016/679. Their dispute centers on the manner in which the Bradford factor used by the applicants is applied. Each application, as recorded on pages 30 and 42 of the decision, contends that: “Scaling sick leave, using the Bradford Coefficient, which squares (multiplies by itself) the number of cases taken the sick leave (frequency of taking leave) and, by extension, the possible measures taken against the employees based on the numerical result produced, for the purposes of satisfying their legal interests, as they are formulated in this Assessment. Overrides/Overrides the interests or fundamental rights and freedoms of employees (Article 6(1)(f) of the Regulation) and therefore, the processing in question (scoring of sick leave using the Bradford Index) cannot be based on provisions of article 6(1)(f) of the Regulation, which concerns the defense of their legal interests." At the same time, it concludes with an assessment of the method of use of the coefficient on page 30: "(iii) The Assessment of Legitimate Interest carried out by the Plaintiffs of the complaint could be correct/valid in the event that the automated System carried out a simple numbering of employee absences due to sick leave, without however multiplying the number of absences, i.e. the frequency, by itself. Based on the numerical result that would be produced, the right of the Louis Companies, as the employers, would still exist to take action against the employees, in accordance with the applicable labor law and therefore would be able to satisfy their legal interests as these are recorded in the Estimate.” Applicants focus in their written submission on whether the respective application properly and adequately investigated or misled the system they are using. However, what was mentioned by the respective application in relation to the origin of the specific system seems to be incidental references and not the essence of the matter. Furthermore, the application itself has neither the power nor the authority to dictate to applicants whether or not to use a system. Its authority is exhausted in investigating whether the processing carried out by the applicants of the specific personal data of their employees - whether using a specific system or not - is lawful. The main problem that seems to have been detected by each application during the processing carried out by the applicants is what is recorded in the above excerpts from the contested decision, that is, the recording of the number that an employee receives sick leave and its multiplication number it with itself (squared) instead of simply numbering the permissions. This finding of the respective application is recorded in the report entitled "Data Protection Impact Analysis" submitted to the respective application on 4.3.2019 by the applicants' advisers Grant Thornton on behalf of the applicants (see Appendix 9(b) of the objection of each application). Specifically, on page 8 of the report which describes the procedure followed, point 8 states the following: "8. The Bradford factor is calculated once the sick leave is submitted into Exelsys using the following formula: Bradford Factor = Total number of days being absent x Number of Occasions2 The lawyers of the applicants in their letter dated 2.9.2019 submitted as the representations on behalf of of applicants record a different calculation method which is the one they invoke in the context of the present procedure. In particular, they record the following on page 2: "It should be clear that the system only leads to a numerical performance of elements (points) which are a function exclusively of the number of days absent due to illness and cases of absence. [.] 2. Any "processing" through the Bradford Factor does not lead to any other result than a summation based on days of absence and cases of absence, i.e. based on indicators of a purely numerical and objective mechanical form, without intervening evaluation , exercise of discretionary power and there is not even a differentiation of the treatment of absence elements by increasing the numbers to be added or otherwise, e.g. due to frequency of absence, type of illness, absence on weekends, holidays, etc." The above reports of the applicants' lawyers do not seem to have concerned the respective application or to have troubled it, even in terms of the discrepancy between what the consultants sent on 4.3.2019 and what the lawyers recorded in the subsequent letter of 2.9. 2019. It is at this point that the fallacy of each application and the lack of proper research is found. Each application, before reaching its final decision, had to clarify the contradictory positions of the applicants in order to clarify the actual conditions of application of the processing. In view of the above conclusion, the examination of the remaining reasons for annulment becomes useless. For the reasons explained, the appeal succeeds and the contested decision is set aside. €2,000 costs plus VAT are awarded. in favor of the applicants and against the application itself. E. MICHAIL, DDDcylaw.org: From KINOP/CyLii for the Pancypriot Bar Association