GPS and worker monitoring in Switzerland: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Ban on systems intended to monitor the behaviour of workers (OLT 3, art. 26)

  Yesrequired

  A cornerstone Swiss rule, stricter than the GDPR: it is forbidden to use systems intended to monitor the behaviour of workers at the workplace. If they are needed for other reasons (safety, production, organisation), they must be designed so as not to harm health and freedom of movement, and a system is forbidden if it aims solely or essentially at monitoring behaviour.

  Tribunale federale, ATF 130 II 425 (GPS sui veicoli dei dipendenti; cita OLT 3 art. 26)

• Data processing only if it concerns suitability for the job or is necessary for the contract (CO art. 328b)

  Yesrequired

  The employer may process the worker data only if it concerns their suitability for employment or is necessary for performing the contract, in compliance with good faith and proportionality.

  PFPDT/FDPIC, trattamento dei dati da parte del datore di lavoro (CO art. 328b)

• Prior authorisation from an authority before installing

  Nonot required

  No prior authorisation from the PFPDT/FDPIC is needed; the employer assesses lawfulness and proportionality on its own.

  PFPDT/FDPIC, mezzi tecnici di sorveglianza sul luogo di lavoro

• Prior information and consultation of workers; no permanent monitoring of behaviour

  Yesrequired

  Workers must be informed in advance; continuous, periodic or sample-based surveillance aimed at monitoring behaviour is forbidden; the proportionate and least intrusive means must be chosen.

  PFPDT/FDPIC, mezzi tecnici di sorveglianza sul luogo di lavoro

• Impact assessment (DPIA, nLPD/revFADP art. 22) if the processing entails a high risk

  Yesrequired

  The nLPD/revFADP requires an impact assessment when the processing is likely to entail a high risk to personality or fundamental rights, such as systematic surveillance.

  PFPDT/FDPIC, valutazione d'impatto sulla protezione dei dati (nLPD art. 22)

The procedure, step by step

1. 1

   Check that the system is not intended to monitor the behaviour of workers (OLT 3 art. 26): if it is, it is forbidden.

2. 2

   Make sure the data processed concerns suitability for the job or is necessary for the contract (CO art. 328b).

3. 3

   Inform and consult workers in advance.

4. 4

   Carry out the impact assessment (DPIA) if the processing entails a high risk.

5. 5

   Configure the system in a proportionate and deferred way (not real-time tracking of the person).

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Tribunale federale, ATF 130 II 425 (GPS sui veicoli dei dipendenti; cita OLT 3 art. 26)
• PFPDT/FDPIC, mezzi tecnici di sorveglianza sul luogo di lavoro
• PFPDT/FDPIC, trattamento dei dati da parte del datore di lavoro (CO art. 328b)
• PFPDT/FDPIC, valutazione d'impatto sulla protezione dei dati (nLPD art. 22)
• Regolamento UE 2016/679 (GDPR) - riferimento comparativo