REPUBLIC OF CYPRUS OFFICE OF THE COMMISSIONER FOR PERSONAL DATA PROTECTION Our ref. 11.17.001.006.014 10 October 2019 Data Protection Officer SEA CHEFS CRUISES LTD Limassol, Cyprus Subject: Result of the investigation – complaint of M.C. against SEA CHEFS CRUISES LTD about an erasure request under the GDPR Dear Madam, Further to the exchange of communications between the Commissioner and Sea Chefs Cruises Ltd concerning a complaint involving Sea Chefs Cruises Ltd, we hereby inform you that after assessment the information gathered in relation to this complaint, the Commissioner is of the view that the company did not infringe any provisions of the GDPR. Case summary The data subject submitted an erasure request to the company on 13.11.2018, where he was previously employed. On 12.12.2018 the HR Department of the company, replied that some of his data were deleted and some other data will be kept in order: (
- a)To comply with the legal obligation of the company for tax and VAT purposes (
- b)To safeguard the companies legitimates interests in case of legal claims in accordance with the time limits provided for in law 66(I)/2012. The data subject lodged a complaint to the Commissioner requesting that all data kept by the controller be deleted. The controller has its headquarters in Cyprus, and therefore the Commissioner for Personal Data Protection (hereafter “the Commissioner”) is acting as the lead authority in this matter. The Commissioner requested from the company, to provide information on: the complete list of all the personal data of the complainant which were not deleted the legal basis for keeping each of the data pursuant to article 17 paragraph
(3), The Commissioner received the requested information, within the set timeframe. Sea Chefs Cruises Ltd response During the investigation, you provided the following information: The Company keeps a copy of the employee’s contract of employment to which a copy of his passport is attached. You explained that the copy of the passport is kept for data subject identity verification purposes. You further explained that this information is stored on the company’s HR System where you maintain crew data and that it is protected by the various security mechanisms, detailed in your reply (Server/Database security, Workstation security and Network/Communication security). You provided a complete list of all the personal data of the complainant, which were not deleted. 1 Iasonos str., P.O. Box 23378, 1682 NICOSIA, CYPRUS Tel.: +357 22818456, Fax:+357 22304565 E-mail: commissioner@dataprotection.gov.cy ,Website: http://www.dataprotection.gov.cy The legal basis to keep personal data provided in the list, is the compliance with legal obligations according to national law: (
- a)social insurance contributions and social insurance law (Law 59(I)/2010) (
- b)tax audit and tax records (Law 4/1978) (
- c)requirement for retention of supporting documents for verification of identity, employment and salary for social insurance, tax and vat investigations (up to 7 years according to national Law 95(I)/2000) and for establishing, exercising or defending legal claims (up to 6 years according to national law 66(Ι)/2012) The salary information, employment contract and passport copy will be deleted after expiration of 7 years, from the date of termination of employment. The company keeps a copy of the Master’s Hearing record, containing the Master’s Hearing form, Report to Master, Performance Opportunity Log and Shipboard Crew 45-day appraisal, Security Incident Statements for establishing, exercising or defending legal claims. This information on the data subject’s dismissal records will be deleted after the expiration of 6 years from the date of termination, which is the expiration of time to initiate legal claims according to national law. This information is necessary in case the data subject initiates legal claims against the employer. Commissioner’s views After assessment the information gathered, the Commissioner is of the view that the company complied with its data protection obligations in relation to the issues at stake. In line with Article 17
(1)(b) of the GDPR, the right to erasure does not apply in this case because “the processing is necessary for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. Namely, on the basis of article 30
(2)of the law on Assessment and Collection of Taxes (national Law 4/1978) “books and records shall be kept for a period of at least six years from the end of the tax year to which they refer, unless the Director of the Tax Authority requests a longer period’. The national Value Added Tax law (national Law 95(I)/2000), obliges every person (natural or legal) who is subject to the VAT, to keep records and evidences of all expenses, including salaries, for a period of seven years from the date of the expense (article 5
(3)of the law). Therefore, information such as passport information, employment contract and salary information (including overtime, bonus and vacation payment) shall be kept for a period of seven years. Article 7
(1)of Limitation of Legal Proceedings act (Law 66(Ι)/2012) allows a period of six years from the date on which the grounds of the legal claim is based, to any person who intends to engage in legal proceeding in relation a contract agreement, such as employment contract. In light of the above, the Commissioner concluded that the data subject’s dismissal records should be kept for a period of six years, as the data subject may appeal the decision of the company to the relevant court, six years after the dismissal. Based on the above-mentioned explanations, the Commissioner did not identify any infringements of the obligations set out in the GDPR by Sea Chefs Cruises Ltd. Best regards, Commissioner for Personal Data Protection