GPS and worker monitoring in Iceland: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Prior information to workers and a sign about the monitored area (Rules 50/2023)

  Yesrequired

  Electronic monitoring requires a clear and lawful purpose; whoever monitors must give notice with a sign or in another evident way before the person enters the monitored area.

  Regole n. 50/2023 sulla sorveglianza elettronica (Gazzetta ufficiale)

• Prior authorisation from an authority before installing

  Nonot required

  No prior authorisation from the Persuvernd is required; the controller assesses on its own and documents lawfulness, with a DPIA where required.

  Persuvernd (Garante islandese), FAQ sul GPS e i dispositivi di localizzazione

• Basis = legitimate interest with a documented test, not consent

  Yesrequired

  The most relevant basis is the employer legitimate interest; the employer must carry out a documented balancing assessment against workers rights. Consent is generally not valid in the employment relationship.

  Persuvernd (Garante islandese), FAQ sul GPS e i dispositivi di localizzazione

• GPS only if there is a particular need; avoid continuous monitoring; switchable off outside working hours

  Yesrequired

  The use of tachographs or location devices requires a particular need; proportionality must be respected and continuous monitoring of workers avoided; outside working hours the worker must be able to switch it off.

  Persuvernd (Garante islandese), FAQ sul GPS e i dispositivi di localizzazione

• Impact assessment (DPIA) for monitoring employees performance or behaviour (Persuvernd list)

  Yesrequired

  The Persuvernd list includes processing that involves monitoring employees performance or behaviour among the cases that always require an impact assessment.

  Persuvernd, lista dei trattamenti che richiedono una DPIA (Auglysing nr. 828/2019)

The procedure, step by step

1. 1

   Verify a particular need and a clear and lawful purpose for the GPS (Rules 50/2023).

2. 2

   Identify a valid legal basis (legitimate interest) and carry out the documented assessment.

3. 3

   Carry out the impact assessment (DPIA) for monitoring employees.

4. 4

   Inform workers in advance and signpost the monitored area.

5. 5

   Configure the system: no continuous monitoring, switchable off outside working hours, no reuse for other purposes without prior notice.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Regole n. 50/2023 sulla sorveglianza elettronica (Gazzetta ufficiale)
• Persuvernd (Garante islandese), FAQ sul GPS e i dispositivi di localizzazione
• Persuvernd, lista dei trattamenti che richiedono una DPIA (Auglysing nr. 828/2019)
• Persuvernd, presentare un reclamo
• Persuvernd, decisione Islandspostur (uso illecito del GPS su un dipendente)
• Regolamento UE 2016/679 (GDPR)