GPS and worker monitoring in Poland: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Purpose, scope and methods of monitoring set out in a collective agreement, work regulations or a notice (Kodeks pracy art. 22(2)/22(3))

  Yesrequired

  the Polish Labour Code expressly governs monitoring: purpose, scope and methods must be set out in the collective agreement, the work regulations or a notice, and the rules on video monitoring also apply to other forms (GPS included).

  Kodeks pracy, art. 22(3) (altre forme di monitoraggio, incl. GPS)

• Prior information to workers at least 2 weeks in advance, and in writing to the new hire (art. 22(2) par. 7-8)

  Yesrequired

  the employer informs the workers of the introduction of monitoring at least two weeks before it starts, and gives the information in writing to the new hire before assigning them to work.

  Kodeks pracy, art. 22(2) (monitoraggio)

• Prior authorisation from an authority before installing

  Nonot required

  no prior authorisation from the UODO is required; the procedure is internal (rules in the regulations/notice, information, marking of areas) plus compliance with the GDPR.

  UODO, guida alla protezione dei dati sul luogo di lavoro

• No tracking of private movements or outside working hours; proportionality (UODO)

  Yesrequired

  for the UODO the employer is not entitled to collect data on the worker's private movements (save for exceptional cases such as theft of the vehicle); if the vehicle is also used privately, rules and deactivation outside service must be provided. The risk to rights must be proportionate to the purpose.

  UODO, guida alla protezione dei dati sul luogo di lavoro

• Impact assessment (DPIA) for workers' location data (UODO list)

  Yesrequired

  the UODO list of processing operations that require an impact assessment expressly includes the processing of workers' location data and systematic monitoring in the work context.

  UODO, lista dei trattamenti che richiedono una DPIA (M.P. 2019 poz. 666)

The procedure, step by step

1. 1

   Set out the purpose, scope and methods of monitoring in the collective agreement, the work regulations or a notice.

2. 2

   Inform the workers at least two weeks before the start; give the information in writing to the new hire before work begins.

3. 3

   Identify a valid legal basis under the GDPR (as a rule legitimate interest, not consent).

4. 4

   Carry out the impact assessment (DPIA) for workers' location data.

5. 5

   Configure the system: no private/off-hours tracking, purpose matching actual use.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Kodeks pracy, art. 22(2) (monitoraggio)
• Kodeks pracy, art. 22(3) (altre forme di monitoraggio, incl. GPS)
• UODO, guida alla protezione dei dati sul luogo di lavoro
• UODO, lista dei trattamenti che richiedono una DPIA (M.P. 2019 poz. 666)
• UODO, presentare un reclamo
• UODO, sanzione Centrum Medyczne Ujastek (monitoraggio non comunicato ai dipendenti)
• Regolamento UE 2016/679 (GDPR)