The EU’s new General Data Protection Regulation (GDPR) came into force in May 2016 with a two-year transitional period. Kaltiot’s customers did not need to worry, as we were prepared for the regulation (GDPR) well in advance of its implementation from 25 May 2018.
We will go deeper into the issue of locating people in the workplace from a legal perspective in a new blog post.
We also aim to comply with our obligations under data protection legislation in all our activities. But what does this regulation mean in practice? Below is an example.
Is it allowed, under GDPR, to track an employee’s location?
The Regulation requires that the consumer’s consent to the monitoring must be obtained. At work, it’s not so simple. The first thing to consider is the processing of personal data. The employer, i.e. the controller, has the right to process employees’ personal data as necessary without the employee’s consent, where there is a legitimate basis for doing so. Such due grounds for processing may include ensuring the safety of employees or directing resources to the right place, among other things. As long as the purpose is sufficiently clear that there is no risk of it being interpreted as an unwarranted invasion of privacy, and the information is used only for the purpose for which it is intended.
What about the employee location tracking, then? Indirect tracking (e.g. vehicle tracking) can be introduced in an organisation, taking into account the duty of cooperation under the Data Protection at Work Act, i.e. informing employees. If the tracking is directly aimed at the employee (e.g. by means of a mobile phone or other personal device), the employee’s consent should be obtained, as interpreted by the data protection ombudsman. In addition, it would be advisable to give the employee the possibility to switch off the positioning when the device may be used outside working hours. More information on this topic can be found here (Finnish).
So tracking workers’ location is allowed, as long as you take care of the above. At Kaltiot, we assist our customer in implementing the technical and organisational measures that are part of the controller’s obligations from the outset (the customer as controller and Kaltiot as processor). Some of this is Kaltiot’s concern, some of it is the customer’s, but the responsibility for the processing of personal data is shared under the Regulation.
