GPS and worker monitoring in Finland: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Cooperation procedure with employee representatives before introducing technical monitoring, including location tracking

  It dependsonly in certain cases

  Determining the location of employees is a form of technical monitoring that must be addressed in the workplace cooperation procedure before it is adopted. The negotiation applies above a size threshold (50 employees from 1 July 2025); below it, employees still retain the right to be heard.

  Garante finlandese (Tietosuojavaltuutettu), FAQ sulla vita lavorativa

• Only data directly necessary for the employment relationship; the necessity requirement cannot be waived by consent (Act 759/2004)

  Yesrequired

  The employer may process only data directly necessary for the employment relationship; not even the employee consent authorises the processing of data that does not meet this requirement.

  Legge sulla protezione della privacy nella vita lavorativa (759/2004) - traduzione ufficiale

• Prior authorisation from an authority before installation

  Nonot required

  No prior authorisation from the Ombudsman is required; oversight is carried out afterwards.

  Garante finlandese (Tietosuojavaltuutettu), FAQ sulla vita lavorativa

• Location tracking should not be used for working-time control except in limited cases; proportionality

  Yesrequired

  According to the Ombudsman, location data should not as a rule be used to monitor working time, except in limited cases (e.g. remote work with no less intrusive alternatives), and only with an adequate legal basis and necessity.

  Garante finlandese (Tietosuojavaltuutettu), FAQ sulla vita lavorativa

• Impact assessment (DPIA) for location data used for systematic monitoring

  Yesrequired

  The Ombudsman list requires an impact assessment where location data is used for the systematic monitoring of individuals or processed on a large scale.

  Garante finlandese, lista dei trattamenti che richiedono una DPIA

The procedure, step by step

1. 1

   Address the purpose, adoption and methods of the monitoring in the cooperation procedure with employee representatives (or ensure employees the right to be heard).

2. 2

   Limit the collection to data directly necessary for the employment relationship.

3. 3

   Carry out the impact assessment (DPIA) for location data used for systematic monitoring.

4. 4

   Inform employees of the content of the decision and of the monitoring methods.

5. 5

   Do not use location tracking for working-time control except in limited and justified cases.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Legge sulla protezione della privacy nella vita lavorativa (759/2004) - traduzione ufficiale
• Garante finlandese (Tietosuojavaltuutettu), FAQ sulla vita lavorativa
• Garante finlandese, lista dei trattamenti che richiedono una DPIA
• Garante finlandese, segnalare una violazione
• Garante finlandese, sanzione per dati di localizzazione usati per la rilevazione orario (2021)
• Regolamento UE 2016/679 (GDPR)