GPS and worker monitoring in Serbia: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Detailed and prior information to workers (LPDP art. 23)

  Yesrequired

  Workers who will use the vehicles must be informed in detail about the processing: controller, purposes, legal basis, recipients, retention and rights.

  Legge sulla protezione dei dati (LPDP, 87/2018) - testo ufficiale

• Authorisation or prior registration with an authority before installing

  Nonot required

  The LPDP mirrors the GDPR accountability model: the old registration has been abolished.

  Poverenik (Garante serbo), competenze e contatti

• Basis = legitimate interest with a documented three-part test, not consent

  Yesrequired

  The basis is the employer's legitimate interest, which must be clearly defined, documented with a three-part test and communicated to the worker; consent in the employment relationship is the weakest basis.

  PR Legal, GPS sui veicoli aziendali (lista DPIA, voce monitoraggio dipendenti)

• No continuous tracking (serious interference); only working hours and purpose

  Yesrequired

  For the Poverenik, continuous GPS monitoring is a serious interference with privacy, because it allows real-time tracking of movements and behaviour; generic justifications of asset protection are rejected.

  Legge sulla protezione dei dati (LPDP, 87/2018) - testo ufficiale

• Impact assessment (DPIA) and prior opinion of the Poverenik for monitoring employees via apps or tracking systems (list, LPDP art. 54)

  Yesrequired

  The processing of employee data via apps or systems that track their work, movements and communication is on the list requiring an impact assessment; for these processing operations the controller must, before starting, carry out the DPIA and request the opinion of the Poverenik.

  Legge sulla protezione dei dati (LPDP, 87/2018) - testo ufficiale

The procedure, step by step

1. 1

   Define and document the legitimate interest with a three-part test.

2. 2

   Inform in detail the workers who will use the vehicles (art. 23).

3. 3

   Carry out the impact assessment (DPIA) and request the prior opinion of the Poverenik before starting.

4. 4

   Limit GPS to working hours and the purpose: no continuous tracking.

5. 5

   Configure the system in a proportionate way and respect the workers' right to object.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Legge sulla protezione dei dati (LPDP, 87/2018) - testo ufficiale
• Poverenik, decisione sulla lista dei trattamenti che richiedono una DPIA (Gazzetta 45/2019)
• PR Legal, GPS sui veicoli aziendali (lista DPIA, voce monitoraggio dipendenti)
• Poverenik (Garante serbo), competenze e contatti
• N1, GPS su 80 cassonetti del JKP Mediana di Nis (ispezione del Poverenik)
• Regolamento UE 2016/679 (GDPR) - riferimento comparativo