GPS and worker monitoring in Luxembourg: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Prior collective information to the staff delegation and codecision (Code du travail art. L.261-1)

  It dependsonly in certain cases

  Before installing monitoring, the employer must inform the staff delegation in advance; for the purposes provided for, deployment is subject to codecision with the delegation. This applies where a staff delegation exists.

  Code du travail, art. L.261-1 (sorveglianza dei lavoratori) - riproduzione CNPD

• Possibility for the delegation or the workers to request a prior opinion from the CNPD within 15 days (suspensive effect)

  It dependsonly in certain cases

  The staff delegation, or in its absence the workers concerned, may request an opinion from the CNPD within 15 days of the prior information, and the request has suspensive effect.

  Code du travail, art. L.261-1 (sorveglianza dei lavoratori) - riproduzione CNPD

• Prior authorisation from an authority before installing

  Nonot required

  The old prior authorisation from the CNPD was abolished with the GDPR and replaced by codecision with the staff delegation; the obligation to keep the record of processing activities remains.

  CNPD, geolocalizzazione dei veicoli: necessita e proporzionalita

• Basis = a condition of GDPR art. 6 and individual information; no permanent tracking if private use is allowed, deactivatable by the worker

  Yesrequired

  A basis under GDPR art. 6 and individual information (art. 13) are required; the employer cannot monitor outside working hours, and if private use of the vehicle is allowed the system cannot remain permanent and the worker must be able to deactivate it.

  CNPD, geolocalizzazione dei veicoli: necessita e proporzionalita

• Impact assessment (DPIA) for geolocation that regularly or systematically monitors employees (e.g. for working time)

  Yesrequired

  An impact assessment is required when geolocation involves regular and systematic monitoring of employees or tracks their working time.

  CNPD, geolocalizzazione: valutazione d'impatto (AIPD)

The procedure, step by step

1. 1

   Inform the staff delegation in advance and activate codecision (art. L.261-1).

2. 2

   Allow the delegation or the workers the possibility to request an opinion from the CNPD within 15 days (suspensive effect).

3. 3

   Identify a legal basis under GDPR art. 6 and inform the workers individually (art. 13).

4. 4

   Carry out the impact assessment (DPIA) if the geolocation regularly monitors employees.

5. 5

   Configure the system: no permanent tracking if private use is allowed, deactivatable by the worker.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Code du travail, art. L.261-1 (sorveglianza dei lavoratori) - riproduzione CNPD
• CNPD, geolocalizzazione dei veicoli: necessita e proporzionalita
• CNPD, geolocalizzazione: valutazione d'impatto (AIPD)
• CNPD, decisione 11FR/2021 (sanzione geolocalizzazione veicoli di servizio)
• CNPD, presentare un reclamo
• Regolamento UE 2016/679 (GDPR)