GPS and worker monitoring in Austria: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Consent of the works council (Betriebsrat) for monitoring measures that affect human dignity (ArbVG § 96 Abs. 1 Z 3)

  It dependsonly in certain cases

  Monitoring measures and technical systems capable of controlling workers that affect human dignity require the consent of the works council (a Betriebsvereinbarung is mandatory): without it, they are inadmissible. This applies where a Betriebsrat exists; in its absence an individual agreement under § 10 AVRAG is required.

  Arbeitsverfassungsgesetz (ArbVG), § 96 (misure di controllo che toccano la dignita: consenso del consiglio aziendale)

• Betriebsvereinbarung for systems that process workers personal data beyond basic identification data (ArbVG § 96a)

  It dependsonly in certain cases

  Systems that automatically collect and process workers personal data beyond basic identification and job classification require a Betriebsvereinbarung (or, in the absence of a works council, individual consent).

  Arbeitsverfassungsgesetz (ArbVG), § 96a (sistemi che trattano dati personali dei lavoratori)

• Prior authorisation from an authority before installation

  Nonot required

  No prior authorisation is needed: the old DVR register was abolished with the GDPR; the accountability principle applies (records of processing activities and a data protection impact assessment where required).

  DSFA-V, regolamento sui trattamenti che richiedono una valutazione d'impatto

• Ban on permanent GPS monitoring; allowed only if the purpose cannot be achieved by less intrusive means

  Yesrequired

  In the Austrian reference case, the DSB found the permanent tracking of company vehicles unlawful because the purpose could be achieved by less intrusive means, and ordered it to stop; monitoring outside working hours is in any case inadmissible.

  Datenschutzbehorde (DSB), decisione 2022-0.021.739 (stop al GPS sui veicoli aziendali)

• Data protection impact assessment (DSFA) for the geolocation of workers

  Yesrequired

  The Austrian regulation on impact assessment includes processing that evaluates a person behaviour, location or movements and processing of workers data; the geolocation of employees falls among the cases that require an impact assessment.

  DSFA-V, regolamento sui trattamenti che richiedono una valutazione d'impatto

The procedure, step by step

1. 1

   If a works council exists, obtain its consent through a Betriebsvereinbarung before activation (ArbVG § 96 / § 96a); in its absence, an individual agreement under § 10 AVRAG.

2. 2

   Verify that the purpose cannot be achieved by means less intrusive than permanent tracking.

3. 3

   Carry out the data protection impact assessment (DSFA) for the geolocation of workers.

4. 4

   Inform the workers and identify a valid legal basis (Art. 6 GDPR).

5. 5

   Configure the system: no permanent tracking, no monitoring outside working hours.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Arbeitsverfassungsgesetz (ArbVG), § 96 (misure di controllo che toccano la dignita: consenso del consiglio aziendale)
• Arbeitsverfassungsgesetz (ArbVG), § 96a (sistemi che trattano dati personali dei lavoratori)
• DSFA-V, regolamento sui trattamenti che richiedono una valutazione d'impatto
• Datenschutzbehorde (DSB), decisione 2022-0.021.739 (stop al GPS sui veicoli aziendali)
• Datenschutzbehorde (DSB), procedura di reclamo
• Regolamento UE 2016/679 (GDPR)