The limits of legitimate interest as a legal basis for employers profiling their employees – Cyprus regulator imposed a fine on a company for using a 'Bradford Factor' tool for scoring employees' sick leave.
The employer is entitled to supervise the frequency of sick leaves and the validity of sick leaves certificates. However, the regulator decided that the employer was not able to establish that its legitimate interest (to profile employees' sick leave) overrides the interests, rights, and freedoms of its employees. Additionally, none of the provisions of GDPR would apply to enable the employer to process health data.
Companies tend to rely on legitimate interests as a legal basis because it may initially seem more straightforward to implement than other legal bases or because there is no other viable option. In reality, it is not always the case. Such a basis puts more responsibility on the company to justify the processing and the impact on employees. It requires a risk assessment based on the circumstances to demonstrate that the processing is appropriate. And finally, such an evaluation can determine that this processing is unlawful.
Hozzászólások