Sanction RGPD Cypriot Data Protection Commissioner — Electricity Authority of Cyprus : 40 k€ (2021)
- Autorité de contrôle
- Cypriot Data Protection Commissioner
- Pays
- Chypre
- Entreprise / secteur
- Electricity Authority of Cyprus
- Montant de l'amende
- 40 k€
- Date de la décision
- 3 mars 2021
- Fondement juridique
- Art. 6 (1), Art. 9 (2)
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Cypriot DPA imposed a fine of EUR 40,000 on the Electricity Authority of Cyprus. The controller used an automated system based on the so-called Brad-Factor to manage, monitor and control employee absences due to illness using a tool assessment. The DPA found that such an assessment mechanism was not covered by Cypriot labor law and had therefore been used unlawfully. Furthermore, an option for data subjects not to consent to such automated processing of their personal data should have been provided.