In our previous blog, we explained what GDPR is and whether GDPR allows tracking employees’ location. In this blog, we will go deeper into the issue of tracking employees from a legal perspective in Finland, according to EU and Finnish law. This post is a translation of the original Finnish post. In what situations is employee location tracking allowed? What should an employer bear in mind when introducing personnel tracking? Why can’t the employee’s consent be used as a basis for location tracking?
We interviewed Markus Malmivaara, a lawyer who wrote his thesis on the processing of employee location data. Markus explains what laws apply when locating people in the workplace and shares his tips for those who want to implement personnel tracking.
GDPR, the Data Protection at Work Act and the Co-operation Act guide employee location tracking in the workplace
Let’s first explain what GDPR means and how it affects positioning of people in the workplace. Markus Malmivaara sums it up like this:
“The European Union’s General Data Protection Regulation, commonly referred to as the GDPR, is a central, and for employee privacy the most important, piece of legislation on the processing of personal data, due to its very broad scope. The importance of the GDPR is largely influenced by its EU legal status and the case law of the Court of Justice of the European Union supporting it. In summary, the EU Regulation has direct effect in the Member States and, in the hierarchy of norms, supersedes conflicting national provisions. With some limited exceptions, the GDPR applies to all processing of personal data and thus also to data protection issues directly related to the locating of employees.”
When one of our customers implements employee location tracking, for example on a construction site, the GDPR is the primary legislation applicable to the processing of personal data related to positioning. In addition to the GDPR, the Data Protection Act and the Co-operation Act apply to employee tracking. To comply with the regulation, the employer must prepare data protection documentation and meet a possible obligation to carry out a performance review prior to the positioning of employees and the related processing of personal data.
“The most significant data protection documentation on the processing of employee location data arises from the GDPR. Written documentation prior to processing operations enables the employer to demonstrate that data protection requirements have been taken into account and complied with. The most important of these documents, along with the employee information and privacy statement, is the impact assessment, which identifies, assesses and manages the risks associated with the processing of personal data.
The the obligation of technical supervision of the employee is derived from the national laws on data protection at work (Kansallisesta työelämän tietosuojalaista), and the scope and content are derived from the Act on Co-operation within Undertakings (Yhteistoimintalaki),“ Markus explains.
Why is employee consent not a valid ground for processing personal data?
The key conclusion of Mark’s thesis was that employee consent should not be used as a basis for processing personal data related to location. This is because the relationship between employee and employer is not equal in principle. The GDPR sets out a number of requirements for valid consent, according to which consent must be a voluntary, individual, informed and unambiguous expression of the data subject’s consent to the processing of their personal data. Voluntariness is always linked to a real and genuine freedom to give consent. For consent to be used as a ground for processing personal data in an employment relationship, the employee should have a genuine objective freedom of choice based on his or her own will.
The employee’s consent is typically not a valid ground for processing because the employee is financially dependent on the employer and refusal to use, for example, positioning technology in the employment relationship may lead to negative consequences for the employee. Markus justifies the request for consent as follows:
“The consent requirement is based on national regulation and its interpretation. My own interpretation is that the processing of personal data, for purposes of the general resourcing of work or for improving the efficiency of a team of employees, based on an employer’s right to direct, should not be justified based on the consent of the employee. The most important idea is that consent is not used as a basis for processing personal data generated by tracking employee location. The prevailing regulatory guidance for tracking worker location is currently still based on the consent of the worker, which makes the current legal situation unclear. Unfortunately, the decision on whether to obtain separate employee consent outside the GDPR is currently the responsibility of the individual employer.
Compliance with the Finnish state guidance is often a good practice from a general risk management perspective, but it should not be allowed to compromise the lawfulness of the processing of personal data. In summary, my guidance is to obtain separate consent from the employee, if this is decided in accordance with the opt-in guidance, and to separately assess the processing of personal data related to location in accordance with the requirements of the GDPR.
The current regulatory guidance on employee tracking, which is still available, has the same elements as the national interpretation and guidance on cookie policies for websites and mobile services, which was for a long time confusing and contrary to EU law. Soft law guidance is also sometimes given undue and uncritical weight at national level in relation to explicit legislation. ”
The Data Protection Regulation requires the processing of personal data to be informed and transparent. Even if the employee is not asked to give consent to positioning, he or she must be aware of the technology used, its purpose and the content of the personal data being processed. This requirement is complemented by the national law on collective bargaining, which requires that the technical supervision of the employee be openly discussed in the collective bargaining procedure. The criteria for “technical supervision” are typically met when tracking employee location, and this is something that must be taken into account when designing a location service. In a situation of ambiguity, Markus urges you to follow the requirements from the Act on Co-operation within Undertakings (Yhteistoimintalaki).
Kaltio Technologies’ personnel tracking solves workplace safety and labour resourcing problems
The positioning of a worker in the eyes of the law must always be assessed on a case-by-case basis. Kaltio Technologies offers positioning solutions related to worker safety and work resourcing, where positioning is justifiably acceptable. Kaltiot’s worker positioning can save time and money and increase safety at work. With worker location tracking, our customers have:
- solved fire safety problems on a high-rise building site
- saved time by following the work phases on the construction site using takt time scheduling
- been able to keep healthy workers at work and quarantine corona-exposed people when people return to work after working remotely due to the corona situation
The case-by-case use and implementation of the location service determine whether the data generated by the location service is personal data or not, and therefore whether a separate data protection and collective bargaining process is required. For example, locating workers or other personnel on a construction site typically does not generate personal data if the devices are not named or identified by an individual person, the number of locating devices in use in the same area is sufficiently large, and the data collected by tracking or combined with it does not identify the person being located. In any case, it is always worth informing staff openly about tracking, even if the information received is anonymous.
When would employee location tracking not be legal? Markus Malmivaara explains that in the case of an unnecessarily comprehensive location of an individual employee, unjustified from the point of view of technological benefits or revealing information other than, for example, the directive-legal dimension of the employee’s work, the processing of personal data collected through location data would in principle not be possible.
“It is worth remembering that, for example, personal data relating to trade union activities that may be revealed by tracking are classified in the same category as personal health data in the GDPR and can only be processed in exceptional circumstances. Special consideration and justification is also required for the use of positioning, for example for monitoring working hours, which is not generally acceptable in a normal employment relationship.“, Markus clarifies.
A lawyer’s tips for starting employee tracking
The legal provisions can create confusion for the employer when introducing staff location tracking. Am I doing everything right and according to the law? Kaltio Technologies’ personnel location solutions can be used with confidence, as long as you first assess your situation on a case-by-case basis and remember a few things. Our positioning solutions are designed to optimize resources and streamline work, making positioning a legitimate option under GDPR. Markus will also share the lawyer’s advice for the employer who is introducing employee tracking:
- Only use a company that can describe its services transparently and provide a basis for meeting data protection requirements.
- Only implement the service once the data protection documentation and typically the collective bargaining procedure have been completed.
- Assess and justify the need for a positioning service.
- Continue to evaluate the processing of personal data related to positioning after starting, and make changes if necessary.
- Only collect and process personal data that is necessary.
- Only use the personal data you collect for the purposes for which it was collected.
- Keep personal data only for the minimum period required for their processing.
- If you are not sure whether you are processing personal data or not, follow the data protection rules.
- Make the use of the tracking service fully transparent to employees. Explain the benefits and provide transparent and clear information about the technology and the related processing of personal data.
- Please make sure that the personal data collected by the tracking system is not sensitive.
Want to know more?
- Read Markus Malmivaara’s thesis on employee location data processing here (CC licence): https://lauda.ulapland.fi/handle/10024/63836
- Mia Eklund’s dissertation on the processing of employees’ personal data in the context of employer supervision (in Swedish, summary in English and Finnish) here (note: limited access): https://helda.helsinki.fi/handle/10138/326645
