The 2017 report of the Privacy Guarantor which represents a guide for companies to understand how to apply EU Regulation 2016/679 (GDPR), operational since 25 May 2018, seems to authorize checks on employees via smartphone and GPS, even without consent, in some cases, but with guarantees for workers and third parties.
In particular, these are situations involving the so-called balancing of interests, ie when the traceability of the mobile phone used by the employee or the GPS of the company car is essential for the good performance of the company. However, it is essential to take precautions and safety precautions, or to provide guarantees for workers and third parties.
However, it should be noted that as regards the concept of the company's legitimate interest in the use of equipment that allows workers' data to be processed without asking for their consent, the Authority's positive opinion on data processing under certain conditions is essential.
It is also possible to process data without consent in the case of tracking smartphones and tablets used by employees for the legitimate interest of the company, such as for example in the case of a quality control service for the distribution of advertising material in mailboxes (leaflets, leaflets, etc.), in which the traceability system makes it possible to improve the effectiveness of certifying the results of the service to customers.
The Guarantor therefore deemed a tracking system legitimate without prior consent in the event that:
- the reports on the activity carried out do not contain data that allow the employee to be identified, for example by providing for the use of pseudonyms;
- the detection of the geographical position of the worker does not take place on the basis of a predetermined time interval but on the basis of the active behavior of the employee and only during working hours;
- there is an active icon on the devices for the entire time the traceability system is in operation.
Below is an excerpt from the Guarantor's Report regarding remote control
The Guarantor has evaluated the purposes and concrete functioning methods of the geolocation systems brought to its attention in the light of the updated regulatory framework on remote controls, compliance with which constitutes a condition of lawfulness of the processing of personal data (art. 4 , ln 300/1970; articles 11, paragraph 1, letter a), and 114 of the Code).
In relation to the peculiarity of each technological system, the Authority ruled on the configuration of the same which instrument “from which the possibility of remote control also derives” or as a tool "used [or] by the worker to render work", with the consequent application, respectively, of paragraph 1 or 2 of the aforementioned art. 4 and therefore of the obligation or not to activate the guarantee procedure provided for therein.
From this last point of view, in some decisions the Guarantor has considered certain systems not "directly preordained to the execution of the work performance", with consequent application of the art. 4, paragraph 1.
In this regard, the National Labor Inspectorate, with circular no. 2/2016, relating to the installation of GPS satellite tracking equipment on company cars, clarified that "in principle and in general terms [...] geolocation systems represent an "added" element to work tools", and therefore “the relative equipment can be installed only with prior agreement with the trade union representation or, in the absence of such agreement, with prior authorization from the national labor inspectorate.
If the purposes pursued by the geolocation system have been preordained to a plurality of purposes, in particular the optimization of the management of company activities in the event of requests for intervention or emergencies (in accordance with the levels of guarantee and quality of services indicated by the Charter 
services); raising the safety conditions at work as well as the protection of the company fleet in the event of theft; more efficient scheduling of local activities and vehicle maintenance interventions; the actual commensuration of working time; the management of any claims; the management of complaints of administrative violation of provisions of the highway code. In light of these purposes as well as the operating methods of the devices, the Authority first considered the vehicle tracking system not "directly preordained to the execution of the work performance", with consequent application of art. 4, paragraph 1, ln 300/1970 (referred to in article 114 of the Code); in this perspective, the treatments are considered lawful,
The Guarantor reiterated that any further processing operation, even if carried out in the context of managing the contractual relationship with the worker e in the exercise of the power to verify the effective fulfillment of the service (articles 2086, 2087 and 2104 of the civil code), must be inspired by lawfulness, proportionality and gradualness in the processing of data, avoiding unjustified interference in the private sphere of workers, otherwise the data will be unusable (art. 11, paragraph 2, of the Code; see point 5, provision no. 303 of 13 July 2016, web doc. no. 5408460; even with reference to the previous regulatory framework, with regard to the non-usability of the geolocation data acquired in violation of the law, see Civil Cassation, Labor Section, No. 19922/2016).
Report of the Privacy Guarantor (page 111 and following)
Related news: The art. 4 Workers' Statute after the reform pursuant to Legislative Decree 151/2015
Legislative Decree 30 June 2003, n. 196
Platform for the renewal of the CCNL
