Tracking staff by SIM: why it is almost always unlawful

Every so often a director tries this, and the call always goes the same way. He rings the mobile network, explains that the company pays for the SIMs, that the handsets are on a business account in the firm’s name, that all he wants is to know where one of the vans was at three o’clock. The person on the other end is perfectly polite about it and tells him no. He pushes, mentions the monthly bill, points out that he is the customer. Still no. He hangs up convinced he has run into a jobsworth, when in fact he has run into the only answer that jobsworth was allowed to give him.

Locating staff through the SIM is one of those things that feels obvious right up until you look at it properly. The instinct runs smoothly enough: the card is ours, the handset is ours, the contract is ours, so the data must be ours. What that reasoning misses is that a position worked out from the network never comes from inside the phone at all. It comes from inside the operator’s infrastructure, and that infrastructure sits under a rulebook that has nothing whatsoever to do with who bought the device.

Two identical dots on a map, two different bodies of law

On screen they look the same. A pin, an address, a timestamp. But a position that an app on the handset reads from GPS the moment somebody starts it is one thing, and a position the network reconstructs from the masts the SIM has been talking to is quite another. The first one begins with a deliberate act by the person doing the work. The second begins with nothing more than the phone being switched on. And the law, which makes its living on exactly this sort of distinction, treats them as separate subjects entirely.

In the UK the network side of it falls under the Privacy and Electronic Communications Regulations, and regulation 14 is remarkably blunt about who is allowed anywhere near location data. Processing is reserved to public communications providers, to providers of a value added service, and to people acting on their authority, and even then the data has to be anonymous or covered by the user’s consent, used only for the value added service that user actually asked for. Read that list again and see whether an employer appears anywhere on it, because it does not, no matter how many handsets are on the account.

That is why the network says no. It is not box ticking and it is not caution for its own sake. Handing you that location would put the operator itself on the wrong side of the regulations, in an area where the penalties are not decorative.

The consent that will not bear weight

Which leads to the obvious next move. If consent is what is missing, then get the consent signed. One more sheet in the onboarding pack, one more tick box, done by Tuesday. It looks like the elegant way round the problem and it is in fact the exact point where the whole structure gives way, because consent only counts when it is freely given, and inside an employment relationship the freedom to say no is thinner than anyone likes to admit.

Put yourself on the other side of the desk. Somebody has just signed a contract and is now being asked to authorise the network tracking their whereabouts. Can they refuse? On paper, certainly. In practice they would be refusing the person who writes the rota, approves the leave and decides who gets kept on after Christmas. Regulators have been consistent on this for years: where one party holds that much more power than the other, the consent collected is not worth the paperwork it came on. And consent that does not stand up is not a missing formality, it is the whole processing operation left with no lawful basis under it.

---

Then comes the layer that gets forgotten, and it is the one the ICO has spent real effort on. Monitoring workers is not treated as ordinary data handling. It expects you to have worked out why less intrusive options would not do, to have run an impact assessment before switching anything on rather than after somebody complains, and to have told your people plainly what is being collected. Systematic location monitoring walks straight into all three. Skip them and you have built a pile of data you cannot rely on, which stings most on the day that data was the thing that would have got you out of a tribunal.

The sales pitch that should make you sit up

Now and then a supplier turns up with an offer that appears to solve all of it at once. Location tracking with nothing to install on the handset, nothing for the employee to do, nothing for them to notice. Phrased that way it sounds like pure convenience, and read a little more carefully it is a technical description of a system built to run without the knowledge of the person it runs on.

When somebody sells you transparency as an obstacle they have kindly removed, they have just told you precisely what you would be buying. A system your staff cannot see is a system your staff never agreed to, and sooner or later someone finds it: a union rep, a regulator, or a former employee with a solicitor and a great deal of time on their hands. At that stage the money saved on the subscription becomes the least interesting number in the room.

None of this is a British peculiarity either. Italy reserves the same network data under article 126 of its privacy code and then piles on a second requirement, since the workers’ statute makes any tool capable of remote monitoring conditional on a union agreement or authorisation from the labour inspectorate. In Germany the works council holds a codetermination right over any technical device merely suited to monitoring behaviour. The abbreviations change, the substance does not. The mobile network is not ground an employer gets to walk on unaccompanied.

What you actually needed was never a trail

Go back to the director making that phone call, because the question in his head was entirely reasonable. He did not want to know where his engineer stops for lunch. He wanted to know whether the three o’clock job was done, where, by whom and for how long, because the customer was disputing the invoice and all he had to argue with was a job sheet filled in by hand the night before.

Those are two different needs that look alike for about a second before they part company completely. Following a person across the whole day produces a continuous trail, intrusive, close to impossible to justify and not even much use, since nobody is going to read twenty four hours of coordinates to work out whether a boiler got fitted. Recording the moment work starts and the moment it ends, with the location of those two instants and photographs of what was done, produces something else. It produces evidence, readable in ten seconds and gathered through a deliberate act by the person doing the job, which is exactly what makes it defensible.

That is the difference between watching people and certifying work, and it is why the software we build at GeoTapp reads location only when somebody taps to start and taps to finish, and never in between. Not out of squeamishness. Out of durability, because proof assembled that way holds, and a trail collected quietly does not.

Next time an invoice gets challenged, which would you rather be holding, a phone record you are not allowed to show anyone, or a report the customer cannot take apart?