- Enforcing jurisdiction
- Cyprus · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 11.17.001.008.042 – Violation Found (Cyprus, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The DPA in Cyprus ruled that Sea Chefs Cruises Ltd improperly required employees to consent to share their health data. The authority found that employees felt pressured to give consent, which violates data protection rules. This ruling is important for ensuring that employee consent is truly voluntary.
What happened
Sea Chefs Cruises Ltd required employees to consent to the processing of their health data as a condition of employment.
Who was affected
Employees of Sea Chefs Cruises Ltd who were asked to provide consent for their health data processing.
What the authority found
The DPA ordered the company to stop processing health data based on consent due to the imbalance of power in the employer-employee relationship.
Why this matters
This decision highlights that consent must be freely given and not coerced in employment situations. Companies should review their practices to ensure compliance with data protection laws.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
In this particular case, the employee had no possibility to refuse or withdraw such consent without negative consequences, because without consent a person would not have been offered employment. In addition, the DPA considered that, in principle, consent should not be used as a basis for data processing in the relationship with the employee due to the imbalance of the parties. An employer should explore the specific exceptions in Article 9(2)(b) GDPR to Article 9(2)(j) GDPR to lawfully process health-related data of employees. An employee who worked for the company Sea Chefs Cruises Ltd (the controller) lodged a complaint in Germany against the company. The complaint was transmitted to the Commissioner for Personal Data Protection (Cyprus SA), which was acting as the lead authority in this matter. The complainant considered a document named “Authorization for release of medical records" as violating the GDPR provisions. The above document is required by the company from its employees before beginning work on a ship to have access to their medical records to be able to assist the employees with medical care, arrange any associated travel and handle any medical claim, in the event of a medical incident taking place onboard. The information provided by the company concerning the requirement to sign an authorization indicates that a person may refuse to give authorization, but it would then not be possible to employ that person on the ship due to the company's inability to fulfil its obligations under the collective agreement, to provide medical assistance if necessary, or to establish that the person is fit to work. Does the processing of employee’s health-related data by Sea chefs Cruises Ltd based on consent violate the GDPR? The DPA ordered the controller: a) to cease the processing of health data of employees based on consent, b) to bring the processing operations into compliance with the provisions of the GDPR and in particular to take actions as to proces
Outcome
Violation Found
The DPA found a violation but did not impose a fine.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 11.17.001.008.042 in CY
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 11.17.001.008.042 - Cyprus (2021). Retrieved from cookiefines.eu
Last updated: