Phase
The Processing of Personal Data (Protection of Individuals) Law of 2001 (138(I)/2001) (annulled); the Law on the Protection of Natural Persons Against the Processing of Personal Data and the Free Movement of such Data (125(I)/2018) of 2018
Native name
Ο Περί Επεξεργασίας Δεδομένων Προσωπικού Χαρακτήρα (Προστασία του Ατόμου) Νόμος του 2001 (138(I)/2001) (καταργημένος); Ο περί της Προστασίας των Φυσικών Προσώπων Έναντι της Επεξεργασίας των Δεδομένων Προσωπικού Χαρακτήρα και της Ελεύθερης Κυκλοφορίας των Δεδομένων αυτών Νόμος του 2018 (125(I)/2018) ()
Type
Employee monitoring and surveillance
Added to database
25 October 2023

Article

Article 16 of the Processing of Personal Data (Protection of Individuals) Law of 2001 (138(I)/2001) (annulled).


Description

Until 2018 Cyprus had a law [the Processing of Personal Data (Protection of Individuals) Law] which included certain provisions regarding employment. However, this law was annulled in 2018, and replaced with a new one (the Law on the Protection of Natural Persons Against the Processing of Personal Data and the Free Movement of such Data), which made no reference to employment.


Commentary

Regarding this issue, during a relevant seminar organised by the Cyprus Bar Association and the Office of the Commissioner for Personal Data Protection of Cyprus, Cyprus' Commissioner for Personal Data Protection stated that at present the matter is largely dependent upon the specific facts of each independent incident. Examined, as such, on a case-by case basis, the resolution of relevant issues in an employment relationship on the one hand requires compliance with national and European Union law, and on the other hand it is highly dependent on the discretion of the Commissioner.

Recognising the understandable confusion, the Commissioner provided the following guidelines, aiming to avoid any kind of violation of human rights and the law, while also to provide necessary information both to the employer as well as to the employee regarding their duties and rights respectively:

1) The company/employer should have a handbook referring to its established policy with exact precision on the regulation of data protection at the workplace and whether such company/employer allows the possibility to use their email account for personal or work use only.

2) In the cases where there is such an employment dispute/issue, it will be taken into account whether the employer is the owner of the computer and the email account while also whether the email account was solely used for work purposes. If a company’s policy indicates clearly that any email accounts (in the workplace) shall be solely and strictly used for work purposes and that employees or use it for any other private purpose, then this will weigh in favour of the employer.

3) In cases where there are suspicions of criminal or unlawful use of the email, the employer has an obligation to inform the employee about accessing their email and in such a case the employee must be present. If the employee does not consent and/or approve such an act, then the employer may need to go to court in order to obtain a court order for accessing the email account.


Additional metadata

Cost covered by
Not available
Involved actors other than national government
Other
Involvement (others)
Office of the Commissioner for Personal Data Protection of Cyprus
Thresholds
Affected employees: No, applicable in all circumstances
Company size: No, applicable in all circumstances
Additional information: No, applicable in all circumstances

Citation

Eurofound (2023), Cyprus: Employee monitoring and surveillance, Restructuring legislation database, Dublin, https://apps.eurofound.europa.eu/legislationdb/employee-monitoring-and-surveillance/cyprus

Download as PDF