GPS and worker monitoring in Frankrig: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Consultation of the CSE before installing the monitoring system (art. L2312-38)

  It dependsonly in certain cases

  Before deciding to install a means of monitoring employees' activity, the employer must inform and consult the CSE (Social and Economic Committee). This applies only where a CSE exists: it is mandatory from 11 employees upwards. Below that threshold there is no CSE to consult, but the obligation to inform each employee individually remains (art. L1222-4).

  Code du travail, art. L2312-38 (consultazione del CSE sui mezzi di controllo)

• Authorisation from a labour authority before installing

  Nonot required

  France does not require prior authorisation from a labour authority, nor any further prior declarations to the CNIL (abolished on 25 May 2018 with the GDPR). The model is based on accountability: a record of processing activities and a DPIA where the risk is high.

  CNIL, abolizione delle dichiarazioni preventive dal 25 maggio 2018

• Individual and prior information to the worker (art. L1222-4 + art. 13 GDPR)

  Yesrequired

  No data may be collected from a device not brought to the worker s knowledge in advance; each worker must be informed of the controller, the purposes, the recipients and their rights.

  Code du travail, art. L1222-4 (nessuna raccolta da dispositivo non portato a conoscenza)

• Ban on permanent surveillance: geolocation must be subsidiary and switchable off outside working hours

  Yesrequired

  For the CNIL, geolocation may not be used to monitor the employee permanently; it is subsidiary (prohibited if a less intrusive means already exists, e.g. to calculate working time where another clock-in system already exists) and must be able to be switched off outside working hours.

  CNIL, guida sulla geolocalizzazione dei veicoli dei dipendenti

• Data protection impact assessment (DPIA) for constant monitoring of employees' activity

  Yesrequired

  The CNIL list includes, among the processing operations requiring a DPIA, those that constantly monitor employees' activity and large-scale processing of location data.

  CNIL, lista dei trattamenti che richiedono una valutazione d'impatto (AIPD)

• Limited retention of location data

  Yesrequired

  The CNIL generally indicates a retention of about two months, extendable to up to one year only to prove a service performed.

  CNIL, guida sulla geolocalizzazione dei veicoli dei dipendenti

The procedure, step by step

1. 1

   If a CSE exists, inform and consult it before deciding on the installation (art. L2312-38).

2. 2

   Inform each worker individually and in advance (art. L1222-4, art. 13 GDPR).

3. 3

   Check subsidiarity: geolocation is not allowed if a less intrusive means already exists for the same purpose.

4. 4

   Carry out the impact assessment (DPIA) if the processing monitors constantly or processes location data on a large scale.

5. 5

   Configure the system: no permanent tracking, switch-off outside working hours, limited retention.

6. 6

   Keep the record of processing activities up to date (accountability, no longer a prior declaration).

7. 7

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Code du travail, art. L2312-38 (consultazione del CSE sui mezzi di controllo)
• Code du travail, art. L1222-4 (nessuna raccolta da dispositivo non portato a conoscenza)
• CNIL, guida sulla geolocalizzazione dei veicoli dei dipendenti
• CNIL, lista dei trattamenti che richiedono una valutazione d'impatto (AIPD)
• CNIL, abolizione delle dichiarazioni preventive dal 25 maggio 2018
• CNIL, dieci nuove sanzioni (procedura semplificata, 2025)
• EDPB, la CNIL sanziona UBEEQO International (175.000 €, 7 luglio 2022)
• Regolamento UE 2016/679 (GDPR)