GPS and worker monitoring in Cyprus: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Prior information to workers (art. 13) and the existence of a legal basis

  Yesrequired

  the worker must be informed before monitoring begins about the controller, purposes and legal basis; there is no specific Cypriot law on GPS, the GDPR framework and Law 125(I)/2018 apply.

  GDPR, art. 13 (informazione)

• Prior authorisation from an authority before installation

  Nonot required

  no prior authorisation from the Commissioner is needed; with the GDPR the old notification regime has been abolished.

  Eurofound, monitoraggio dei lavoratori a Cipro (Legge 125(I)/2018)

• Basis = legitimate interest with balancing, not consent

  Yesrequired

  in the employment relationship consent is not freely given; the usual basis is legitimate interest, with a documented balancing test that does not override the workers rights.

  GDPR, art. 13 (informazione)

• No continuous round-the-clock tracking; data minimisation (art. 5.1.c)

  Yesrequired

  continuous, always-on GPS tracking breaches data minimisation; it must be limited to what is necessary (working hours, actual risk).

  Regolamento UE 2016/679 (GDPR)

• Impact assessment (DPIA) for systematic monitoring of employees (art. 35)

  Yesrequired

  a DPIA is required when employee monitoring is systematic; the Commissioner assesses proportionality case by case.

  Eurofound, monitoraggio dei lavoratori a Cipro (Legge 125(I)/2018)

The procedure, step by step

1. 1

   Identify a valid legal basis (legitimate interest) and document the balancing test.

2. 2

   Inform workers before monitoring begins (art. 13).

3. 3

   Carry out the impact assessment (DPIA) for systematic monitoring.

4. 4

   Limit GPS to what is necessary: no continuous round-the-clock tracking.

5. 5

   Configure the system proportionately and check that the interest does not override the workers rights.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Eurofound, monitoraggio dei lavoratori a Cipro (Legge 125(I)/2018)
• GDPR, art. 13 (informazione)
• Garante cipriota, pagina ufficiale
• EDPB, sanzione del Garante cipriota al Gruppo Louis (strumento Bradford Factor)
• Regolamento UE 2016/679 (GDPR)