It is 9.14 am on a Wednesday morning. You open your post and find a registered letter from the Italian Data Protection Authority. Subject: GPS tracking of your field technicians. Three employees have lodged a complaint; they were unaware that the app installed on their company car was continuously recording their location, even during their lunch break, even after working hours, and when they were using the vehicle for private errands.
The Data Protection Authority’s fines for GDPR breaches relating to the monitoring of workers have risen significantly over the last two years. In 2024, the Authority issued over 30 injunctions for sums ranging from €20,000 to €50,000 against companies in the facilities management and cleaning sectors. The recurring reason: a lack of specific information and the absence of a trade union agreement or prior authorisation.
The problem is rarely a technical one. It is organisational: the device is handed over, an app is installed, and no one explains to the employee exactly what is being recorded, when, why, for how long the data is stored and who can access it. This is precisely where the Data Protection Authority is raising the bar, and this is where the fines arise.
GDPR-compliant employee GPS tracking without the hassle
GeoTapp Flow provides pre-configured GDPR privacy notice templates, granular control over tracking times and audit logs that stand up to any inspection by the Data Protection Authority.
Legal basis: when is GPS tracking actually permitted?
The GDPR does not permit the tracking of workers in a general sense. It requires a specific legal basis in accordance with Article 6 of the GDPR, supplemented by Article 88 of the GDPR and the Workers’ Statute (Law 300/1970, Article 4, as amended by the Jobs Act). In practice, there are three possible approaches:
Legitimate interest (Article 6(f) of the GDPR): the employer must demonstrate specifically why tracking is necessary, such as managing operations, optimising routes or verifying performance. General references to ‘safety’ or ‘efficiency’ are not sufficient. The balancing of these interests against the employee’s rights must be set out in writing.
Trade union agreement or authorisation from the Territorial Labour Inspectorate (Workers’ Statute, Article 4(1)): if the tracking tools may also involve monitoring of workers’ activities, this is mandatory. Without an agreement (or authorisation from the Territorial Labour Inspectorate), the system is arbitrarily unlawful, and penalties are cumulative: GDPR + Workers’ Statute + any offences of unlawful interference.
Consent (Article 7 of the GDPR): this is problematic in an employment relationship, as the freedom to give consent is questionable. It is valid only if the employee can effectively refuse without suffering any repercussions. In practice, it can only be used as a supplementary measure, never as the sole basis.
Data minimisation: record only what you need
Article 5(1)(c) of the GDPR requires data minimisation. In other words: GPS location data should only be collected during agreed working hours, not during breaks, not after the end of a shift, and not whilst on holiday. Anyone who tracks employees continuously, or monitors them in their private lives, has already lost the argument, even before the first inspection.
Technically, this means: the app must have a scheduled timetable. It activates when the employee clocks in, stops when they clock in for a break, and pauses during authorised leave. Geofences around private homes must be excluded in the settings. Data retention: for no longer than is necessary for the stated purpose, typically 30–90 days, followed by automatic deletion.
Technical and organisational measures (TOM)
Article 32 of the GDPR requires appropriate security measures. In practical terms: encryption of GPS data in transit and at rest, restricted access in accordance with the ‘need-to-know’ principle, periodic review of authorisations, and comprehensive audit logs. In the event of an inspection, the Data Protection Authority wishes to see who has accessed which location and when.
