LGS Handling Ltd – Court Ruling (Cyprus, 2024)

On 6 June 2018, a complaint was lodged against 3 controllers (LGS Handling Ltd, Louis Travel Ltd, Louis Aviation Ltd) regarding the implementation of an automated system for managing, monitoring and controlling the sick leave absences of their employees using a scoring tool known as the Bradford Factor. The Bradford factor is calculated based on the number of occasions of absence and the total number of days absent in a 52-week period. The Cypriot DPA ("Commissioner") indicated that the date of sick leave and the frequency of taking sick leave, insofar as the data subject’s identity is disclosed constitutes “special categories of personal data” as defined by Article 9(1) GDPR. Employers are entitled to exercise supervision over the frequency of sick leave and/or the validity of sick leave, however, this right must not be exercised within the limit set by the relevant legal framework and should therefore be limited to what is necessary. The Commissioner decided that the rating of statutory sick leave was beyond the competence of the employer and that the legitimate interest assessment was inconclusive. The decision also indicated that the legitimate interest assessment would have been valid if the automated system was simply counting the number of absences due to sick leave without multiplying with other factors such as frequency. The Commissioner therefore concluded that the controller had in fact breached Articles 6(1) and 9(2) GDPR and therefore imposed an administrative fine of €70, 000, €10,000 and €2,000 respectively. The controllers appealed this decision in front of the Cypriot Administrative Court on 25 October 2019. The appeal focused on whether the system they were using was investigated correctly. The administrative court decided that the Commissioner did not have the power nor the authority to impose on controllers whether or not to use a system because its power is limited to investigating whether the processing carried out is lawful. The a