GPS and worker monitoring in Lithuania: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Internal rules and prior information of workers about monitoring (Labour Code art. 27)

  Yesrequired

  Article 27 of the Labour Code requires the employer to set up internal rules and to inform workers about the use of technologies and about monitoring in the workplace, including video/audio surveillance and tracking of behaviour, location or movement.

  Eurofound, monitoraggio dei lavoratori in Lituania (Codice del lavoro art. 27)

• Prior authorisation from an authority before installing

  Nonot required

  Under the GDPR no prior notification or authorisation is needed any longer; the controller self-assesses and keeps the documentation.

  Eurofound, monitoraggio dei lavoratori in Lituania (Codice del lavoro art. 27)

• Basis = legitimate interest, not consent

  Yesrequired

  Monitoring is allowed only for a real and justified purpose; the basis is legitimate interest, not consent, which in the employment relationship is not freely given.

  Eurofound, monitoraggio dei lavoratori in Lituania (Codice del lavoro art. 27)

• Proportionate GPS, suspended outside working hours or switchable off by the worker; no continuous tracking

  Yesrequired

  Vehicle tracking must be suspended outside working hours or the worker must be able to switch it off; continuous GPS tracking has been held disproportionate and a less intrusive means is to be preferred.

  Eurofound, monitoraggio dei lavoratori in Lituania (Codice del lavoro art. 27)

• Data protection impact assessment (DPIA) for monitoring employees, including location and movement (VDAI list, item 10)

  Yesrequired

  The VDAI list of processing operations requiring a data protection impact assessment expressly includes the processing of employees data for monitoring, including behaviour, location or movement.

  VDAI, lista dei trattamenti che richiedono una DPIA (voce 10: monitoraggio dei dipendenti)

The procedure, step by step

1. 1

   Set up internal rules on monitoring and inform workers (art. 27 + art. 13 GDPR).

2. 2

   Identify a valid legal basis (legitimate interest, not consent).

3. 3

   Carry out the data protection impact assessment (DPIA) for monitoring employees, including location and movement.

4. 4

   Configure the system in a proportionate way: suspended outside working hours or switchable off by the worker.

5. 5

   Keep the documentation and make it available to the VDAI on request.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Eurofound, monitoraggio dei lavoratori in Lituania (Codice del lavoro art. 27)
• VDAI, lista dei trattamenti che richiedono una DPIA (voce 10: monitoraggio dei dipendenti)
• VDAI, decisione sul trattamento della corrispondenza personale di un dipendente (2022)
• VDAI (Garante lituano), servizi e reclami
• Regolamento UE 2016/679 (GDPR)