GPS and worker monitoring in Spain: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Express, clear and unambiguous information to workers before activation (LOPDGDD art. 90)

  Yesrequired

  Article 90 LOPDGDD allows the processing of geolocation data for the monitoring powers under art. 20.3 of the Workers' Statute, but only after expressly, clearly and unambiguously informing the workers (and, where they exist, their representatives) about the existence and characteristics of the devices and about their rights.

  Ley Organica 3/2018 (LOPDGDD), art. 90 (geolocalizzazione sul lavoro)

• Information to the workers' representatives (Estatuto art. 64)

  It dependsonly in certain cases

  Article 64 of the Statute gives the works council the right to be informed and to issue a prior report on the introduction of systems for the organisation and monitoring of work. It applies only where workers' representatives exist.

  Estatuto de los Trabajadores, artt. 20.3 e 64

• Authorisation from a labour authority before installation

  Nonot required

  Spain does not require an administrative authorisation or one from a labour authority to install a geolocation system. The safeguards are the information under art. 90 LOPDGDD, the information to the representatives (art. 64) and the GDPR.

  AEPD, FAQ sul GPS nelle auto aziendali usate dai lavoratori

• Ban on continuous surveillance: minimisation and proportionality

  Yesrequired

  The AEPD requires geolocation to be proportionate and not used for permanent surveillance; if the purpose is time recording, the data may indicate only the start and end of the activity, not the position at every moment, and the system must not be operational once the working day is over.

  AEPD, guida sulla protezione dei dati nei rapporti di lavoro

• Data protection impact assessment (DPIA) for systematic and exhaustive geolocation

  Yesrequired

  The AEPD list includes, among the processing operations requiring an impact assessment, those involving the observation, monitoring, geolocation or control of the data subject in a systematic and exhaustive manner.

  AEPD, lista dei trattamenti che richiedono una valutazione d'impatto (art. 35.4 GDPR)

• Valid legal basis (art. 20.3 Statute / performance of the contract, GDPR art. 6)

  Yesrequired

  The processing is based on the employer's power of control (art. 20.3 Statute) and on the performance of the employment relationship, within the limits of the GDPR; a broader purpose that would allow the continuous observation of workers is not permitted.

  AEPD, FAQ sul GPS nelle auto aziendali usate dai lavoratori

The procedure, step by step

1. 1

   Inform the workers expressly, clearly and unambiguously before activation (art. 90 LOPDGDD).

2. 2

   If workers' representatives exist, inform them and obtain their prior report (art. 64 Statute).

3. 3

   Define a valid legal basis (power of control art. 20.3 Statute / performance of the contract).

4. 4

   Carry out the impact assessment (DPIA) if the geolocation is systematic and exhaustive.

5. 5

   Configure the system with minimisation: no continuous surveillance, deactivation outside working hours; if time recording is needed, only start and end.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Ley Organica 3/2018 (LOPDGDD), art. 90 (geolocalizzazione sul lavoro)
• Estatuto de los Trabajadores, artt. 20.3 e 64
• AEPD, FAQ sul GPS nelle auto aziendali usate dai lavoratori
• AEPD, lista dei trattamenti che richiedono una valutazione d'impatto (art. 35.4 GDPR)
• AEPD, guida sulla protezione dei dati nei rapporti di lavoro
• AEPD, sanzione PS/00454/2024 (Ares Capital, 200.000 €)
• Regolamento UE 2016/679 (GDPR)