GPS and worker monitoring in Greece: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Informing workers about the purposes, type of data collected and retention period

  Yesrequired

  the employer must inform workers about the purpose of the processing, the type of data recorded and the retention period.

  HDPA (Garante greco), FAQ sui rapporti di lavoro (geolocalizzazione)

• Geolocation must not aim to monitor the worker; limited to working hours and a predefined route

  Yesrequired

  according to the HDPA, installing a geolocation system does not infringe the worker's private sphere when it does not aim to monitor them; it must be limited to working hours and a predefined route.

  HDPA (Garante greco), FAQ sui rapporti di lavoro (geolocalizzazione)

• Prior authorisation from an authority before installation

  Nonot required

  no prior authorisation from the HDPA is required; prior consultation is only foreseen if the DPIA reveals a high residual risk.

  HDPA (Garante greco), FAQ sui rapporti di lavoro (geolocalizzazione)

• No use outside working hours; deactivatable system; retention no longer than one month

  Yesrequired

  the worker must not use the vehicle outside working hours, the system must be able to be deactivated whenever the worker wishes, and retention must not exceed one month.

  HDPA (Garante greco), FAQ sui rapporti di lavoro (geolocalizzazione)

• Impact assessment (DPIA) for systematic monitoring of workers location (Decision 65/2018)

  Yesrequired

  the HDPA list includes the systematic monitoring of employees location among the processing operations that require an impact assessment.

  HDPA, Decisione 65/2018 (lista dei trattamenti che richiedono DPIA)

• Legal basis = legitimate interest, not consent (Law 4624/2019 art. 27)

  Yesrequired

  in the employment relationship consent is not considered freely given because of the power imbalance; the basis is legitimate interest and the necessity for the contract.

  Legge 4624/2019, art. 27 (dati dei dipendenti) - traduzione ufficiale HDPA

The procedure, step by step

1. 1

   Inform workers about the purposes, data collected and retention period.

2. 2

   Verify that geolocation does not aim to monitor the worker and is limited to working hours and a predefined route.

3. 3

   Identify a valid legal basis (legitimate interest, not consent).

4. 4

   Carry out the impact assessment (DPIA) for the systematic monitoring of location.

5. 5

   Configure the system: deactivatable outside working hours, retention no longer than one month.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• HDPA (Garante greco), FAQ sui rapporti di lavoro (geolocalizzazione)
• Legge 4624/2019, art. 27 (dati dei dipendenti) - traduzione ufficiale HDPA
• HDPA, Decisione 65/2018 (lista dei trattamenti che richiedono DPIA)
• HDPA, sanzione a un datore per geolocalizzazione (16 febbraio 2024)
• HDPA (Garante greco), pagina ufficiale
• Regolamento UE 2016/679 (GDPR)