Polygraph Testing In Cyprus – A Focus On The Employment Context

Polygraph testing in Cyprus is the focus of a new article by members of the Enalian Consulting team, Michaella Pillakouri¹, Michalis Severis² and Rita Galides³, in collaboration with Said R. Khamzin⁴, published in the latest edition of the American Polygraph Association (APA) Magazine. Titled “Polygraph Testing in Cyprus – A Focus on the Employment Context,” the article examines the legal and regulatory framework governing the use of polygraph testing in Cyprus, while also drawing comparisons with the legal framework in the United States. It places particular emphasis on the use of polygraph examinations in employment relationships and recruitment processes.

The (not so common) use of polygraph testing in Cyprus: A controversial tool

Most of us have likely heard of a polygraph test at some point – perhaps during a conversation between friends, or while watching a movie, where characters are subjected to one, although most of the time we usually encounter the terminology as «Lie Detector test» rather than «Polygraph test».

Polygraph testing has increasingly drawn attention in Cyprus, especially as Cyprus is considered as a rising Tech-hub. While the Polygraph test is widely used in several countries across the globe for criminal investigations, pre-employment screening, and security clearance evaluations, its use in Cyprus remains limited, generally controversial and – to the extent that one could consider it to be within the framework of lawfulness (or even in cases where it is indeed within the limits of lawfulness), – legally non-binding.

What is a Polygraph test?

Experts in this field, generally acknowledge that polygraph test measures physiological responses – such as blood pressure, pulse, respiration, and skin conductivity, while a subject or an examinee – that is the person who undergoes the test – answers and consequently responds to a series of questions. The underlying assumption is that deceptive answers trigger psychophysiological responses that can be interpreted by a trained examiner. However, this assumption, i.e., that a trained and experienced examiner can interpret the responses, has been long debated, with critics arguing that the results are too unreliable – or to be more precise not as dependable as to be admissible in Courts.

The Situation in Cyprus

In Cyprus, polygraph tests appear not to be – or at least not yet – legally admissible as evidence in criminal or civil Courts. However, that does not mean they are not used at all. Polygraph experts are sometimes employed during investigations in the private sector. Private individuals or businesses may request a polygraph test to settle disputes or confirm suspicions, provided of course, that all relevant actions remain in the area of lawfulness. In other instances, companies dealing with internal theft or employee gross misconduct may express their desire to turn to polygraph tests to support their investigations. Similarly, relationship issues, infidelity accusations, or financial disputes may lead some to seek the service voluntarily.

The rapid global expansion of technology has transformed nearly every industry, with tech companies driving innovation through sophisticated software, algorithms and data-driven solutions. As the digital landscape evolves, the value of intellectual property – particularly in the form of proprietary code and algorithms – has surged, making its protection a critical priority for technology firms. In an era of intense technological competition, safeguarding intellectual property rights is essential, not only to preserve innovation but also to protect companies from cyber threats and industrial espionage.

Therefore, a simple – but important – question arises: Can Polygraph testing assist the efforts of private companies in Cyprus, either Tech-Companies or other private companies, to protect their intellectual property rights and safeguard their lawful interests?

In order to provide a valid answer to this question, it is necessary to initially focus on another underlying – but crucial – question: Is it legal and/or lawful – for private companies to use the Polygraph tests in the context of employment in order to protect and safeguard their best interest and their intellectual property?

The Legal Perspective in Cyprus – Polygraph in the employment context

In Cyprus, there is no specific legislation that directly governs the use of polygraph tests. Consequently, their use is primarily subject to data protection laws and principles that safeguard individual privacy. In particular, the processing of personal data in Cyprus is regulated by the General Data Protection Regulation (Regulation (EU) 2016/679) (hereinafter the “GDPR”), as well as the national Law on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of Such Data of 2018 (Law 125(I)/2018) (hereinafter the “LPNP”). As analyzed in detail above, polygraph tests measure psychophysiological responses to assess truthfulness through the collection and processing of personal health data, such as heart and respiration rates. GDPR and the LPNP mandate that any processing of personal data must adhere to the core principles of lawfulness, fairness, transparency, purpose limitation, and data minimization as well as to the fundamental human rights.

Polygraph testing during the recruitment process and in the context of employment relations

The Commissioner for the Protection of Personal Data in Cyprus is the supervisory authority responsible for enforcing GDPR compliance (hereinafter referred to as the “Commissioner”). The Commissioner has established a more or less straight forward and clear position regarding the processing of personal data in the context of employment relations, key points of which are summarized below:

• Εmployers may only collect data relevant to the nature of the job and the specific duties of the position. Since polygraph tests process sensitive health data, their use in employment is prohibited under the Law and GDPR. The Commissioner deems polygraph testing in recruitment and employment illegal, even where consent has been obtained, as it constitutes a disproportionate and unjustified interference with employees’ rights due to the employer-employee power imbalance and violates the core principles of necessity, proportionality, and respect for private life. As a result, consent is generally not a valid legal basis for processing.
• Employers cannot justify polygraph use based on the legitimate interestthey may have in assessing the personality and honesty of individuals/candidates, as it infringes on employees’ privacy and dignity.
• The International Labour Organization (ILO) Code of Practice prohibits polygraphs in employment, and the Council of Europe allows psychological assessments only if they are legal and necessary for the type of activity that the employees will perform in the context of their work and only when such processing is carried out by specialized professionals, who are subject to medical confidentiality and provided that national law provides for appropriate guarantees.

In light of the above, the use of polygraph testing during the recruitment process and in the context of working relationships is prohibited in Cyprus even when carried out with the consent of the applicant/employee. This is due to the power-imbalance and that consent may be obtained as a result of fear of negative consequences such as the employee losing his/her job.

Take Aways

There are valid arguments on both sides of the debate over using polygraph tests in labor relations. Employers may support their use, bringing up security or trust concerns. On the other hand, critics emphasize the importance of protecting fundamental human rights, particularly for prospective employees and employees, who are – theoretically at least – in a weaker position. Polygraph use is undoubtedly a controversial and hot topic. Some may assert that truth must prevail and others would prefer to shed light to the potential misuse of this tool.

Because of the Commissioners restrictive interpretation of the GDPR to restrict employee polygraph testing, any private company that desires to use the polygraph in Cyprus in the context of employment relations, should certainly seek for a professional advice from legal experts on the field. It should be noted that the Commissioner can initiate investigations, issue fines, order corrective actions, and even suspend data processing activities when a GDPR breach is identified. It is very important to note that, under Article 83 of the GDPR, breaches can result in substantial fines, reaching up to €20 million or 4% of the company’s global annual turnover, whichever is higher (for more serious violations) and €10 million or 2% of the global annual turnover of the preceding financial year, whichever is higher (for less severe infringements). Also, under the LPNP, criminal sanctions may be imposed in case of a violation. The person liable of a criminal offense under the Law of Cyprus might be subject to imprisonments of up to 5 years or fine of up to EUR 50,000 or both. It is noted that criminal and civil liability may also arise in case of infringement of the constitutional rights (e.g., right to privacy).

When considering using polygraph tests in Cyprus, especially in the context of employment, one should be very cautious and seek for an expert’s legal advice.

The US example

We can observe the example of the United States for some useful insights as the use of polygraphs has been more extensively explored, debated and scrutinized providing a potential roadmap of the EU’s future approach towards the hot topic of polygraph testing.

In the United States polygraph use in the employment context is regulated by the Employee Polygraph Protection Act (EPPA) enacted by The United States Congress in 1988. EPPA was largely passed because of perceived widespread abuse of polygraph testing in the workplace. These abuses included but were not limited to polygraph testing by inadequately trained examiners, examination that did not follow accepted standards of practice, intrusive and improper pre-test and examination questions. Such practices led to vulgarization of the procedure.

The passage of EPPA was a watershed moment for the polygraph in the US. EPPA eliminated perhaps 90% of the polygraph testing in this country. It was greeted in the polygraph community with wailing and gnashing of teeth. It was seen as the end of polygraphy. Ironically, viewed from through the lens of time this restrictive legislation turned out to be for the betterment of the polygraph field in three important ways:

• EPPA virtually wiped out the quacks and frauds, the incompetent, the poorly untrained, and left behind those who tended to be professionals all along.
• Legislators appeared to be satisfied with the law, and in the subsequent 27 years there has been no other restrictive polygraph legislation. Regardless of what you may think of the EPPA law, it has forestalled any additional anti-polygraph legislation.
• By carving out exclusions in EPPA for police and government polygraph examiners, the government tacitly recognized the polygraph as a critical tool when properly used⁵.

EPPA prohibits or severely restricts polygraph practices for most private employers. According to the Act, absent an express exception, private employers cannot; require, request, suggest, or cause any employee or job applicant to take a polygraph test; use, accept, or refer to the results of any polygraph test in making any employment related decisions; or, take any adverse employment action (like hiring, firing, disciplining, or denying promotion) based on refusal to take a polygraph test.

Permitted Use

EPPA does not apply to government use of polygraph. This includes federal, state and local governments.

EPPA allows private polygraph testing only in very limited circumstances, such as:
– Pharmaceutical manufacturers/distributors with access to controlled substances.
– Government contractors in certain high security positions.
– Certain security firms (e.g., armored cars, alarm, or guard services).
– Ongoing investigations of specific economic loss or injury to the employer (e.g. theft), but only under strict conditions.

To justify an economic loss polygraph, an employer’s suspicions must not be based on whimsical or arbitrary factors, such as the race or ethnicity of the employee. Information from a co-worker, or information derived from an employee’s behavior, demeanor, or conduct, may be factors in forming a “reasonable suspicion.” Additionally, inconsistencies between facts, claims or statements that surface during an investigation can serve as a basis for “reasonable suspicion.” The watchword is “reasonable” and so long as the employer can describe and articulate a reasonable basis for his suspicions, this requirement will ordinarily be satisfied. There are four general requirements under the ongoing employment investigations exemption to be noted before scheduling the test:

1. Economic loss or injury to the employer’s business & ongoing investigation

The test must be administered in connection with an ongoing investigation involving economic loss or injury to the employer’s business, such as, theft, embezzlement, misappropriation, an act of unlawful industrial espionage or sabotage, check kiting, money laundering, or the misappropriation of confidential or trade secret information. Further, the economic loss must result from intentional wrongdoing, and not unintentional or accidental losses. It is the business of the employer that must suffer the economic loss or injury. Thus, according to the Department of Labor, a theft committed by one employee against another employee of the same employer does not satisfy the requirement. The ongoing investigation exemption does not allow a polygraph test to be used to determine whether an employee has used drugs or alcohol or has engaged in misconduct other than misconduct causing economic loss or injury to the employer’s business.

2. Access

Only employees who have access to the property that is the subject of the investigation may be polygraphed. The term “access,” however, includes more than direct or physical contact during the course of employment. Generally, all employees who have the ability to divert possession or otherwise affect the disposition of the property that is the subject of the investigation, will be deemed to have “access” under the ongoing investigation exemption.

3. Reasonable Suspicion

In addition to access, there must be a basis for “reasonable suspicion” that the employee to be polygraphed was involved in the incident or activity under investigation. The phrase “reasonable suspicion” simply means that the employer must have an articulable basis to believe that the employee was involved in or responsible for the economic loss or injury. The employer’s suspicions must not be based on whimsical or arbitrary factors, such as the race or ethnicity of the employee. Information
from a co-worker, or information derived from an employee’s behavior, demeanor, or conduct, may be factors in forming a “reasonable suspicion.”

4. Special 48-Hour Notice

Before an employer may administer a polygraph examination to an employee under the ongoing investigations exemption, the employer must execute a statement that sets forth with particularity the specific incident being investigated, indicates that the employee has access to the property that is the subject of the investigation, and describes the basis of the employer’s reasonable suspicion that the employee was involved in the incident or activity under investigation. This statement must be provided to the examinee at least 48-hours before the test; it must be signed by any person legally authorized to bind the employer; and it must be retained by the employer for at least three years.

The U.S. Department of Labor enforces the EPPA. Employers who violate the law can face civil penalties (up to $10,000 per violation), lawsuits from employees, including compensation for lost wages, legal fees, and equitable relief.

Because of these strict requirements and penalties for improper economic loss polygraphs, U.S. employers are often reluctant to conduct them without attorney guidance.

Watching the Horizon

Revisiting the example of Cyprus, the question is whether the United States’ approach will serve as a guiding lighthouse for European jurisdictions, Cyprus among them. In an era defined by rapid transformation and relentless technological advancement, the potential influence from the vested interests of technology – and other global – enterprises, may yet reshape the prevailing landscape. Whether this confluence of forces will ultimately prompt a recalibration of the current polygraph status quo in Cyprus and across the European Union, remains a matter for time to reveal.

1. 1. Licensed practicing lawyer in Cyprus, specializes in Corporate, Commercial and Regulatory compliance matters, like AML and GDPR, https://enalian.com.cy/; ↩︎
2. 2. Licensed practicing lawyer in Cyprus, specializes in Litigation, Corporate and Commercial matters, including GDPR, https://enalian.com.cy/; ↩︎
3. 3. Licensed practicing lawyer in Cyprus, specializes in Corporate, Commercial and Regulatory compliance matters, like AML and GDPR, https://enalian.com.cy/; ↩︎
4. 4. Security expert and credibility assessment professional; ↩︎
5. 5. Donald Krapohl, Special Guest Speaker Speech, APA Magazine 2015, 48(5). p. 96 ↩︎