At Belzuz Abogado's Labor Law Department we
would like to go into the impact and lawfulness of new technologies or IT in the work sphere, since, for now, most of them lack a specific legal framework, which hasn’t prevented their broader use and, among them, this article tries to provide
general information on the lawfulness of the “Geolocation” system.
“Geolocation” system refers to the installation of a GPS positioning system mainly in company vehicles, although it is also commonly installed in company mobile phones, whose main purpose is the corporate control of the employees’ work activities.
For its proper lawfulness, we must start from the judgment by the Supreme Court of 21 June 2012, on a dismissal of a worker whose private car was installed with a GPS control device by the company while he was on a leave for temporary incapacity, which was obviously deemed as an infringement of the worker’s privacy, because it was installed in a private car and intrusive and personal data of the worker were obtained which clearly violates the principle of constitutional proportionality.
Similarly, the High Court of Justice of Castilla-La Mancha in its judgement of 10 June 2014 deemed unlawful the surreptitious installation of a GPS device in the mobile phone assigned to the worker for commercial purposes, since the worker wasn’t properly notified and the measure was a surprise and collected data outside the working hours.
On the other hand, the Spanish Data Protection Agency, on the basis of the still-applicable Organic Law on Personal Data Protection and of the EU Directive 2002/58/EC, deemed in 2009 that, given that location data are related to an identified or identifiable natural person, they are personal data and, as such, the existing legal provisions on Data Protection are applied, albeit validating the existence of the control mechanism in a private security firm it was clearly stated that “the processing of location data outside working hours is excessive concerning the aim pursued and therefore the principle of proportionality and the Organic Law on Data Protection would be violated.”
With this background, it is quite clear that this system may be only used in corporate cars or mobile phones assigned to the workers to provide their services, that obviously data processing comes within the scope of the Organic Law on Data Protection and the obligations arising thereof, and that its use is restricted to working hours, although the implementation of this kind of systems is still disputed before the courts.
In this regard, the recent judgement of the Asturias High Court of Justice of 27 December 2017 (EDJ 2017/297652) is of particular interest, because after a correct summary of the legislation and case law applicable to the scenario of Geolocation systems, it validates the lawfulness of installing this system for corporate control, although it draws particular attention that, in order to be lawful, data protection rules must be complied with and the use of these systems will restricted to working hours.
Particularly, the judgement, on the basis of the non-discussed principle of jurisprudence on the force and full effect of the fundamental rights of the worker in the work sphere, acknowledges that the Company installed the system without the express consent of the workers, which doesn’t prevent lawfulness since it is understood that the system has legal protection in article 20 of the Worker’s statute and in the employment agreement, and the exception provided for in article 6.1 of the Organic Law on Data Protection (LOPD in Spanish) is applied. Despite express non-consent by the worker, it is required to comply with the notification duty provided for in article 5.1 of LOPD. Lastly, even validating such a system, the Judgement sentences the Company to adopt the necessary measures to disconnect the system after working hours.
To sum up, as lawyers expert in new technologies in the work sphere, our advice to the companies implementing this corporate control system, or those that already have it, is to have appropriate legal advice because it must be taken into account not only the managerial and control power of the business activity, but also the fundamental rights of the worker and, particularly, the specific rules on Data Protection that additionally must be adapted to the new provisions of the European Regulation on Data Protection, since the legal consequences of these systems go beyond the labour scope, which may result in substantial fines in the field of data protection.
Director del Departamento de Derecho laboral | Madrid (España)
Belzuz Abogados SLP
La presente publicación contiene información de carácter general sin que constituya opinión profesional ni asesoría jurídica. © Belzuz Abogados, S.L.P., quedan reservados todos los derechos. Se prohíbe la explotación, reproducción, distribución, comunicación pública y transformación total o parcial, de esta obra, sin autorización escrita de Belzuz Abogados, S.L.P.
