GPS and worker monitoring in Bulgaria: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Internal rules and worker information on systems for access, time and discipline control (ZZLD art. 25zh)

  Yesrequired

  The employer must adopt internal rules and procedures when introducing systems for controlling access, working time and labour discipline, setting out their scope, obligations and methods, and bring them to the workers attention.

  Legge sulla protezione dei dati (ZZLD), art. 25ж e 25и (controllo sul lavoro e monitoraggio su larga scala)

• Special rules for large-scale systematic monitoring, including video surveillance (art. 25i)

  It dependsonly in certain cases

  For large-scale systematic monitoring of publicly accessible areas, including video surveillance, special rules are required on legal bases, purposes, scope, retention and information.

  Legge sulla protezione dei dati (ZZLD), art. 25ж e 25и (controllo sul lavoro e monitoraggio su larga scala)

• Prior authorisation from an authority before installing

  Nonot required

  No prior authorisation from the CPDP is required; the controller adopts the internal rules itself and carries out the DPIA when required.

  CPDP, lista dei trattamenti che richiedono una DPIA (art. 35.4)

• Basis = legitimate interest (not consent, due to the imbalance of power); proportionality; no tracking during private use of the vehicle

  Yesrequired

  According to the CPDP, consent can hardly be free in the employment relationship; the basis is legitimate interest, the processing must be proportionate and the employer cannot use tracking devices during private use of the vehicle.

  CPDP (Garante bulgaro), guida sulla privacy sul luogo di lavoro (GPS)

• Impact assessment (DPIA) for processing location data with profiling or for systematic monitoring

  Yesrequired

  The CPDP list includes processing of location data for profiling with significant effects; systematic monitoring of employees falls among the high-risk cases that require an impact assessment.

  CPDP, lista dei trattamenti che richiedono una DPIA (art. 35.4)

The procedure, step by step

1. 1

   Adopt internal rules on the control systems and bring them to the workers attention (art. 25zh).

2. 2

   Identify a valid legal basis (legitimate interest, not consent) and document the proportionality.

3. 3

   Carry out the impact assessment (DPIA) for systematic monitoring or location data.

4. 4

   Inform the workers before activation (art. 13 GDPR).

5. 5

   Configure the system: no tracking during private use of the vehicle, only for the stated purposes.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Legge sulla protezione dei dati (ZZLD), art. 25ж e 25и (controllo sul lavoro e monitoraggio su larga scala)
• CPDP (Garante bulgaro), guida sulla privacy sul luogo di lavoro (GPS)
• CPDP, lista dei trattamenti che richiedono una DPIA (art. 35.4)
• CPDP, parere su LUKOIL (riuso della videosorveglianza per valutare i dipendenti)
• CPDP (Garante bulgaro), pagina ufficiale
• Regolamento UE 2016/679 (GDPR)