Worker monitoring in Europe, thirty regulators in one register

There is a precise moment when a business owner with crews out on site gives up. Two hours in front of the screen, trying to work out whether the team can clock in with a location stamp, and what sits there is the ICO’s guidance in one tab, a tribunal decision somebody forwarded on WhatsApp, a vendor’s blog swearing the whole thing is perfectly lawful, and the distinct feeling of holding nothing solid. So everything gets closed and the paper timesheet comes back out, the one nobody has ever challenged, for the simple reason that it proves nothing.

The information is not missing. It sits in thirty different places, in nine languages, inside documents lawyers write for other lawyers.

The Italian regulator publishes a taxonomy with more than two hundred decisions on private employment alone. France’s CNIL keeps a news archive going back years. Sweden’s IMY exposes a feed with two hundred entries. Denmark’s Datatilsynet does not even print its list of decisions into the page, it loads them with JavaScript, so anyone arriving from outside sees an empty shell. Germany is not one authority at all, it is seventeen, and the press releases arrive as PDFs, one file each, with the date in the filename. None of these sites talks to the others, and not one of them is written for the owner of a cleaning firm with forty people out on jobs.

So something was built that reads all of them.

Every morning the system visits the official sources of the data protection authorities of thirteen European countries, plus the European Data Protection Board. It reads the new decisions, keeps only what touches work, meaning location data, video surveillance, time and attendance, staff email and remote working, and puts them in a single table with date, country, authority, title and the size of the fine where there is one.

There is something the register deliberately does not do, and that is the part that matters. It does not summarise, it does not interpret, it does not translate to taste. The title is the one the authority wrote, word for word. An amount appears only where the authority spells it out inside the document, and of sixty-eight decisions collected, forty-eight carry one. In the rest there either was no financial penalty, or the page was an annual round-up adding many cases together, and pinning one of those totals to a single document would have been convenient and untrue. Every row links to the original document, because a row you cannot check in one click is no use to anybody.

The line does not fall where nearly everyone thinks it does

In March 2025 the Italian authority issued two fifty thousand euro fines eight days apart.

The first went to a haulage company running GPS continuously on its vehicles, recording position, speed and mileage in a way that departed from the authorisation the labour inspectorate had already granted, and without telling the drivers. The second went to a public body in Calabria whose app captured location only at the instant of the clock-in, to check it matched the address named in the remote working agreement.

The first still stands. The second was quashed by the Cosenza tribunal on 1 July 2026, on reasoning worth reading in full, because where location is captured solely at the moment of the punch and gives no ability to follow someone’s movements, it is not a remote monitoring tool, it is an access and attendance record.

Same figure, same month, same regulator, opposite outcomes. GPS is not the dividing line. Timing is.

For anyone operating under the UK GDPR the shape of that question is familiar. The ICO’s employment practices guidance turns on necessity and proportionality rather than on the technology itself, and continuous tracking of a worker throughout a shift is a very different proposition from a stamp at the start and the end of one.

Three regulators who never spoke to each other, and the same line

The second thing the register makes visible is that the same question gets decided remarkably consistently in countries with no coordination at all, and nobody ever tells that story together.

In Sweden, IMY criticised the security firm Securitas over cameras pointed at drivers inside company vehicles. In the Netherlands, the Autoriteit Persoonsgegevens held that public transport drivers cannot remain permanently in shot. In Denmark, the Datatilsynet, brought in by a trade union on behalf of a member, examined the cameras in shops run by DSB Service & Retail and found they sat within the rules, while setting down in writing the conditions under which anyone may access the footage.

Three authorities, three languages, no shared table, and the same line. The camera itself is not the problem. Keeping a person in frame for an entire shift is, and so is the question of who gets to open the recordings, and when.

The register, and the two empty slots

The register lives here, with no email address to leave and no form to fill in.

Two slots are empty, though, and it is better to say so than to let somebody else spot it. The authority for North Rhine-Westphalia and the Austrian Datenschutzbehörde were not responding during the days the system was assembled. The cause is technical and sits on their side rather than ours, and it is not a configuration slip either, because every other authority in those same two countries answers perfectly well and is already included, the other sixteen German states among them. The server in Düsseldorf lets the connection time out, the one in Vienna refuses it outright.

The system knocks on both doors every day, by itself. The day they open, those two authorities join the register like all the others and this notice disappears. Until then they stay flagged as missing, because a register that claims to be complete when it is not is worth less than one that admits the gap.

For journalists and for people who do this for a living

The data is public and every row can be checked on its own. Anyone working on workplace surveillance, on monitoring in remote work, or on CCTV in the workplace will find the decisions here with the figures and a direct link to the primary source, without having to interrogate fifteen sites in nine languages.

If a cross-border comparison is missing, or a number you need is not there, write and it gets looked for. Whatever turns up goes into the public register anyway, not into an exclusive.

Why it is free

Because the question that comes in most often is not what the software costs. It is whether this can be done without getting into trouble. And that answer does not depend on us, it depends on what the regulators decided.

A supplier who answers that with its own brochure is asking to be taken on trust. Far better to hand over somewhere to look.

GeoTapp came out of the same idea, that location should prove the work happened rather than follow people around all day. The application records where a shift opens and where it closes, and in between it looks away. The European register is simply the way of showing that this line was not drawn by us in a marketing meeting. Thirty European regulators drew it, one decision at a time.

If it is useful, pass it to anyone with the same problem. There is no form to fill in to see it, and there never will be.

---

How many hours have gone into working out whether something was allowed?