The 2017 report of the Privacy Guarantor which represents a guide for companies to understand how to apply EU Regulation 2016/679 (GDPR), operational since 25 May 2018, seems to authorize checks on employees via smartphone and GPS, even without consent, in some cases, but with guarantees for workers and third parties.
In particular, these are situations involving the so-called balancing of interests, ie when the traceability of the mobile phone used by the employee or the GPS of the company car is essential for the good performance of the company. However, it is essential to take precautions and safety precautions, or to provide guarantees for workers and third parties.
However, it should be noted that as regards the concept of the company's legitimate interest in the use of equipment that allows workers' data to be processed without asking for their consent, the Authority's positive opinion on data processing under certain conditions is essential.
It is also possible to process data without consent in the case of tracking smartphones and tablets used by employees for the legitimate interest of the company, such as for example in the case of a quality control service for the distribution of advertising material in mailboxes (leaflets, leaflets, etc.), in which the traceability system makes it possible to improve the effectiveness of certifying the results of the service to customers.
The Guarantor therefore deemed a tracking system legitimate without prior consent in the event that:
- the reports on the activity carried out do not contain data that allow the employee to be identified, for example by providing for the use of pseudonyms;
- the detection of the geographical position of the worker does not take place on the basis of a predetermined time interval but on the basis of the active behavior of the employee and only during working hours;
- there is an active icon on the devices for the entire time the traceability system is in operation.
Below is an excerpt from the Guarantor's Report regarding remote control
The Guarantor has evaluated the purposes and concrete functioning methods of the geolocation systems brought to its attention in the light of the updated regulatory framework on remote controls, compliance with which constitutes a condition of lawfulness of the processing of personal data (art. 4 , ln 300/1970; articles 11, paragraph 1, letter a), and 114 of the Code).
From this last point of view, in some decisions the Guarantor has considered certain systems not "directly preordained to the execution of the work performance", with consequent application of the art. 4, paragraph 1.
Al riguardo anche l’Ispettorato nazionale del lavoro, con circolare n. 2/2016, relativamente all’installazione di apparecchiature di localizzazione satellitare GPS su autovetture aziendali, ha chiarito che “in linea di massima e in termini generali […] i sistemi di geolocalizzazione rappresentano un elemento “aggiunto” agli strumenti di lavoro”, e pertanto “le relative apparecchiature possono essere installate solo previo accordo con la rappresentanza sindacale ovvero, in assenza di tale accordo, previa autorizzazione dell’Ispettorato nazionale del lavoro.
If the purposes pursued by the geolocation system have been preordained to a plurality of purposes, in particular the optimization of the management of company activities in the event of requests for intervention or emergencies (in accordance with the levels of guarantee and quality of services indicated by the Charter 
The Guarantor reiterated that any further processing operation, even if carried out in the context of managing the contractual relationship with the worker e in the exercise of the power to verify the effective fulfillment of the service (articles 2086, 2087 and 2104 of the civil code), must be inspired by lawfulness, proportionality and gradualness in the processing of data, avoiding unjustified interference in the private sphere of workers, otherwise the data will be unusable (art. 11, paragraph 2, of the Code; see point 5, provision no. 303 of 13 July 2016, web doc. no. 5408460; even with reference to the previous regulatory framework, with regard to the non-usability of the geolocation data acquired in violation of the law, see Civil Cassation, Labor Section, No. 19922/2016).
Report of the Privacy Guarantor (page 111 and following)
Related news: The art. 4 Workers' Statute after the reform pursuant to Legislative Decree 151/2015
Legislative Decree 30 June 2003, n. 196
Platform for the renewal of the CCNL
