GPS tracking of cleaning staff: what you can actually do without getting fined

It’s 10.30 pm on Wednesday evening. You’ve just finished your fourth coffee of the day, you’re locking up the office behind the roller shutter of the warehouse in the industrial estate, and whilst you wait for the key to turn, you’re reading an article from *Il Sole 24 Ore* on your phone. Headline: “Data Protection Authority imposes €50,000 fine on cleaning firm for unlawful geolocation of employees”. You read it twice. Fifty thousand euros. The figure echoes in your head throughout the journey home, whilst your wife tells you to stop staring at your mobile at the dinner table.

And yet you really do want that GPS. You have nineteen cleaners spread across thirty-two sites between Bergamo, Brescia and the Milan hinterland. Every week, some of them turn up late, others don’t turn up at all, and by the end of the month, the foremen’s paper reports are a jumble of working hours rounded off on a whim. You know that half your profit margins are lost there, between ‘creative’ clock-ins and hours billed to clients that don’t match the actual work done. Your accountant has been telling you this for two years: ‘You need to set up a tracking system, otherwise you’ll never be able to keep tabs on anything.’ But that article in *Il Sole 24 Ore* has just given you hives. And your competitor’s accountant – you know this for a fact – has told him the exact opposite: “Forget about GPS; it’s a ticking time bomb with the Data Protection Authority.”

The problem is that they’re both wrong, because they’re both spouting slogans. GPS tracking of cleaning staff in Italy is neither prohibited nor unrestricted. There’s a broad, clearly defined grey area where it’s perfectly legitimate and even protects you from customer complaints and employee appeals. And there is a narrow grey area, outside the rules, where you face a €50,000 fine. The difference between the two areas isn’t the GPS itself: it’s the way you implement it.

What Article 4 of the Workers’ Statute actually says following the Jobs Act

Article 4 of Law 300 of 1970, amended by Legislative Decree 151 of 2015 implementing the Jobs Act, is the key provision. It distinguishes between three things, and this is the crux of the matter. Firstly: video surveillance systems and devices that also enable remote monitoring of workers’ activities may only be installed for organisational and production needs, for workplace safety or to protect company assets, and only subject to agreement with trade union representatives or, failing that, subject to authorisation from the Labour Inspectorate. Secondly: the tools used by the worker to carry out their work – typically the company smartphone, tablet or clocking-in app – do not require trade union agreement or authorisation. Thirdly: in both cases, the information collected may be used for all purposes related to the employment relationship, provided that the worker is given adequate information on how the checks are carried out and in compliance with the GDPR.

Translated for your cleaning company: the GPS feature within a clocking-in app installed on a cleaner’s smartphone, which is activated only when they tap ‘arrived’ and ‘left’ at the site, falls into the second category. It is a work tool, not a surveillance system. You do not need a trade union agreement, nor do you need authorisation from the Inspectorate. What you do need, however, is a written privacy notice for the employee, their explicit consent to the processing of their data, and a clear policy on what data you collect, how long you retain it, and who can access it. Continuous GPS tracking throughout the entire shift, however – even when the employee is on a break or moving between different construction sites – falls into the first category and requires the full trade union procedure or administrative authorisation.

The Data Protection Commissioner, starting with the ruling of 1 March 2007 on geolocation, followed by Ruling No. 161 of 14 October 2010 and all subsequent case law up to the latest opinions of 2024, has repeatedly clarified this point. The fines you read about in the newspapers, including those with six zeros, almost always relate to three types of conduct: continuous tracking not justified by legitimate purposes, failure to inform the employee, and retention of data beyond the necessary period. They do not apply to GPS clocking in and out at the start and end of a shift.

What you can and cannot do, in practical terms, with a cleaning company

You may collect the cleaner’s geolocation at the exact moment they clock in and out of the worksite, to verify that the clocking in and out actually took place at the service location and not from their sofa at home. You can retain that data for as long as is necessary for invoicing the client, for challenging any delays or absences, and as evidence in the event of a trade union dispute or employment claim – typically twelve or twenty-four months, in line with the limitation periods for wage claims. You can present this data in court or to an expert witness, and it carries full evidential value. You can use it to justify a disputed invoice to the client, just as you would with a paper timesheet – except that this evidence stands up to the first objection.

What you cannot do, however, is keep the GPS switched on continuously throughout the entire shift without a trade union agreement. You cannot track the operator’s movements between one site and another as if she were a DHL parcel, because that constitutes remote monitoring of work activities, which requires the procedure set out in Article 4, paragraph 1. You cannot store geolocation data for years ‘just because it doesn’t do any harm’, because the GDPR’s principle of data minimisation requires you to retain data only for as long as is necessary. You cannot access location data outside working hours, not even out of the foreman’s curiosity. You cannot provide the end client of the construction site with an individual worker’s location data linked to their name; only aggregated or anonymised data may be provided.

The practical difference can be seen in an example. Maria Rossi, aged 47, a cleaner at your construction site for a property agency in the centre of Bergamo, opens the app on her company smartphone at 6.00 pm, taps ‘Start shift’, the app reads the coordinates, confirms she is at the correct address, and records the time. At 8.15 pm, she taps ‘End shift’; the app reads her coordinates again and records the time she finishes. Between 6.00 pm and 8.15 pm, the GPS is not active; the app does not know where Maria is, nor does it ask her. This is legitimate, compliant and defensible to anyone. If, on the other hand, the app tracks Maria every three minutes during her shift and reports “stuck in the loo for eight minutes”, that’s the Data Protection Authority’s ruling you can expect.

The employee information notice and the role of the trade union

Even in the simplest case – real-time GPS clocking in and out as a work tool – you are not exempt from your GDPR obligations. Before activating the system, you must provide the employee with a written privacy notice explaining in plain language what data you collect (coordinates upon clocking in and out, time, device identifier), for what purposes (verification of work performance, customer invoicing, evidence in the event of a dispute, worker safety on remote sites), how long you will retain the data, who within the company can view it, to whom it will not be transferred, and how they can exercise their rights of access, rectification and erasure. You must obtain signed consent; a clause in an employment contract from three years ago is not sufficient. You must appoint a data controller if you use an external software provider, with a valid Data Processing Agreement (DPA).

On the trade union front, the Multiservizi National Collective Labour Agreement (CCNL), which governs the vast majority of Italian cleaning companies, does not require prior agreement for real-time clocking-in systems; however, trade associations such as ANIP-Confindustria, FISE-ARE and Legacoop Servizi nevertheless recommend a formal notification to the RSU or, in its absence, to the signatory trade union. It is not an obligation that renders the arrangement null and void, but it is good practice that closes off any scope for future disputes. If, on the other hand, you introduce continuous tracking, an agreement with the RSA or RSU becomes mandatory; in the absence of such an agreement, you must submit an application to the relevant local National Labour Inspectorate, setting out the organisational requirements in writing, and await authorisation – a procedure that takes weeks and is only granted if the purpose is genuinely proportionate.

There are ready-made information and consent forms for the cleaning sector provided by Confindustria Servizi, Confartigianato Servizi alla Persona and the leading employment consultancy firms. An employment consultant familiar with the multi-services sector can set these up for you in half a day’s work. It is not the bureaucratic hurdle you’ve been led to believe: it is a standard procedure that well-established companies in the sector have been managing for years.

---

The future if you carry on failing to keep proper records out of fear

You’ll keep losing profit margins without even realising it. The hours invoiced to clients don’t match the actual hours worked – not because anyone is deliberately cheating you, but because no one can remember exactly whether that team started at 5.50 pm or 6.15 pm, and at the end of the month, the figures are rounded off. The more attentive clients notice this and start to raise objections. The most conscientious employees – those who arrive on time – see that those who turn up forty minutes late receive the same salary, and after a while they become demotivated or leave. When a client asks you for a discount because ‘the cleaning hadn’t been done on Friday’, you have no way of refuting the complaint and you give in. When an employee takes you to court for “unpaid hours worked”, you have no objective data to present to the employment tribunal and end up settling out of court. All because a newspaper article convinced you that GPS is banned, when in fact it was only a certain way of using it that was prohibited.

The future, however, if you track correctly

The hours invoiced match the actual hours worked, with a discrepancy of just a few minutes – which is to be expected. The margin on each individual site is recouped by between three and eight per cent of the total hours, simply because those unrecorded half-hours no longer slip through the net. Customer disputes are resolved in thirty seconds with a branded PDF showing coordinates, times and photos of the site. Sincere employees feel protected: those who arrive on time and work the agreed hours can be sure that the system certifies this, and that those who cheat won’t get away with it. Potential disputes are nipped in the bud because both parties know that objective data exists and that negotiations are based on figures, not words. The RSU of your Multiservizi National Collective Labour Agreement, far from opposing the system, in many cases welcomes it because it also protects employees from unfounded accusations such as ‘you didn’t turn up on Friday’.

What is actually needed to achieve this

You need a contextual, non-continuous GPS clocking-in tool that runs on the operator’s company or personal smartphone. You need a platform that automatically manages employee information notices, the collection of consent, versioning of the privacy policy, data retention for the period you have specified, and automatic deletion beyond that period. You need a provider that acts as a data processor under a standard data processing agreement (DPA), with servers in the EU, and which provides you with a compliant data export in a readable format upon the employee’s request. You need a service report in PDF format that documents each individual service so that it stands up to scrutiny by the client, and you need an aggregated report that stands up to scrutiny by the employment consultant for the monthly payroll closure.

GeoTapp was developed in the field, through discussions with owners of Italian cleaning companies who were facing exactly the same dilemma as you: ‘I want GPS, but I don’t want to end up in the newspapers’. GPS clocking in on tap, no continuous tracking, automated management of privacy notices and consents in line with the Data Protection Authority, configurable data retention, standard DPA, EU servers, compliant data export. See how it works and try to imagine your next payroll closing with objective data instead of reports rounded off from memory.

What about you? Have you ever turned down a tracking system because an article or a consultant had scared you off with talk of penalties from the Data Protection Authority? Share your story in the comments – it’s a fear that’s holding back so many cleaning company owners in Italy, and reading your experiences will help other colleagues break the deadlock too.