GPS in the workplace: measures to be implemented

Global Position System, or GPS for short, is a technology that enables the remote and real-time tracking of a device's movements by aggregating information from satellites. In the past, GPS was commonly associated only with company vehicles, but thanks to technological advancements, it has become possible to deploy location systems on any device connected to the network.

In Italy, these instruments are subject to a dual regulation, that of Article 4 of the Workers' Statute and that of the Privacy Code. In fact, the last paragraph of Article 4 of the Workers' Statute expressly refers to the application of the Privacy Code.

According to Article 4 of the Workers' Statute, the location of the localisation system covers an undefined area. As a result, it is complex to establish in advance whether GPS should be included among the tools that are indispensable to facilitate the performance of work (second paragraph of Article 4 of the Workers' Statute, think of a trucking company), rather than categorising it among those that could potentially lead to remote control of work activities, (first paragraph of Article 4 of the Workers' Statute).

The Garante per la Protezione dei Dati Personali has tried to solve this problem. In 2011, it ruled that if GPS is added to a device that the worker normally uses, then it is considered a tool from which control can arise. And in this case, all the precautions provided for in the first part of Article 4 of the Workers' Statute are required.

This interpretation is further corroborated by the position expressed by the National Labour Inspectorate, which through its note prot. no. 2 of 2016 circumscribed the scope of application of the second paragraph of Article 4 of the Workers' Statute (work tools) exclusively to localisation systems, thus limiting the cases in which the devices, such as apparatuses, and devices, constitute the indispensable means of fulfilling work obligations established by a contract.

Accordingly, the employer must first assess whether the GPS falls under the first or second paragraph of Article 4 of the Workers' Statute. In the first case, it is required to obtain a prior trade union agreement or, in the absence thereof, authorisation from the territorially competent Labour Inspectorate. This can be done provided that the legitimate conditions laid down in the rules are met, i.e. the safeguarding of workplace safety, organisational and production requirements or the protection of company assets.

Privacy obligations

The first step is to provide detailed information, as required by Article 13 of the GDPR. This information is crucial as it represents the employer's way of demonstrating that it acts in a transparent manner. Moreover, this duty is also reiterated by the Transparency Decree, which explicitly requires sharing information regarding the tools used for monitoring and control.

The information must include all the aspects mentioned in Article 13 of the GDPR. Therefore, it is essential to conduct a preliminary assessment to identify the nature and modalities of the processing. It is important to note that some information, such as the legal basis of the processing, the data retention period and the entities that can access the data, require prior analysis by the employer.

After completing the analysis, the controller must adopt the measures required by Article 32 of the GDPR and implement appropriate technical and organisational precautions. These include the designations and related instructions to be given to the individuals who will handle the data on behalf of the controller. The importance of this action was also emphasised by the Authority, which in its Order on the installation of GPS, in point 5, underlined the importance of limiting access to data from location systems only to previously authorised individuals. In addition, if the employer involves external companies, it is necessary to regulate this involvement in accordance with article 28 of the GDPR. This means that the contract between the parties must clarify the predominant role of the controller the processor, specifying in detail the manner of processing and ensuring that the controller takes appropriate security measures to ensure and maintain data protection.

The Italian Authority for the protection of personal data in the above-mentioned provision outlined several measures to be applied to localisation systems. In particular, the employer will be required to configure the system in such a way that there is an icon on the device indicating the activation of the localisation function. This configuration will also have to allow the deactivation of the tracking function during permitted breaks during work activity. Furthermore, the system will have to be configured to hide the visibility of the location after a certain period of inactivity of the operator on the monitor in the operations centre, in connection with this functionality. Differentiated authorisations will be required for the various types of data and the operations possible, and it will be important to establish retention periods for processed data, considering the purposes involved. The software supplier will have to be designated as an external data controller or system administrator, depending on the power it retains over the system. Periodic testing of the “excess stop” functionality and the reliability of the parameters adopted will be necessary in order to assess possible errors (positive or negative) generated by the system and to make possible corrections to ensure the quality of the data processed. Finally, in certain situations, the decision to install GPS must be preceded by an impact assessment, in accordance with Article 35 of the GDPR. This article subjects monitoring systems to a prior impact assessment.

The activities must then be promptly entered in the records of processing activities in Article 30 of the GDPR. Finally, it should be noted that Article 4 of the Workers' Statute conditions the use of information collected by such tools to the provision of further information to workers. In particular, the employer will have to provide specific information on how to use the tool and how the control could be carried out.