ΚΕΟ PLC – Complaint Upheld (Cyprus, 2020)

KEO PLC decided to upgrade its ERP system, whose upgrade was configured with the module of recording when an employee started and ended their work. Until then, the card-swipe terminal only recorded an ID number, as well as arriving and departing times, to and from the premises of the Company. The new terminal included a tiny camera as a measure of the employees who swiped their colleagues' cards too. Grounded on the concerns of the principle of proportionality, the right of privacy, as well as the right of public life, two trade unions submitted a complaint against KEO PLC and before the Cypriot DPA. The main questioning was if the particular data-processing is reasonable and consists of a minimised processing under the meaning of what is absolutely necessary in order to achieve the aim pursued. Starting with the Complainant, they argued on an enlarged general line of argument and points of law. Firstly, they claimed that there was documentation for the impending upgrade system including the privacy policy and specific information on the changes between the old and new ERP system. Secondly, they were of the opinion that before any changes, the Company should have sought less intrusive methods of employee time tracking. Thirdly, The Complainers stated that the resolution of the camera is irrelevant; it's enough that data produced an identifiable natural person. KEO Public Company alleges that upon receiving legal advice, they expanded the duration of processing and storage of these data which are tracked, inputted to, or created by the new terminal. KEO's intension of regarding change was the harmonisation with the limitation period for bringing an action to the court. Also, KEO Public Company claimed that under the GDPR, there is no right that a trade union can exercise. They thought that the justiciability of GDPR is limited only to the natural persons who are the direct possessor of the personal data. Cypriot DPA totally dismisses the argument that the durati