GPS and worker monitoring in Norway: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Objective reason (saklig grunn) and not disproportionate (Arbeidsmiljoloven § 9-1)

  Yesrequired

  A control measure (including GPS) is permitted only if it has an objective reason rooted in the business's needs and does not impose a disproportionate burden on the worker.

  Arbeidsmiljoloven, kap. 9 (misure di controllo, §§ 9-1 e 9-2)

• Prior discussion with the employee representatives (tillitsvalgte) (§ 9-2)

  It dependsonly in certain cases

  The employer must discuss the measure with the employee representatives as soon as possible. This applies where representatives (tillitsvalgte) exist.

  Arbeidsmiljoloven, kap. 9 (misure di controllo, §§ 9-1 e 9-2)

• Prior authorization from an authority before installing

  Nonot required

  Chapter 9 provides for no prior authorization from the Datatilsynet; lawfulness is the responsibility of the controller.

  Arbeidsmiljoloven, kap. 9 (misure di controllo, §§ 9-1 e 9-2)

• Prior information to workers (purpose, consequences, duration; § 9-2 + Art. 13 GDPR)

  Yesrequired

  Before activating it, the employer informs the workers about the purpose of the measure, the practical consequences (how it will be carried out) and the expected duration.

  Arbeidsmiljoloven, kap. 9 (misure di controllo, §§ 9-1 e 9-2)

• GPS on vehicles only for the stated purpose, with no reuse to assess performance

  Yesrequired

  GPS on vehicles is normally a control measure: the purpose must be specified, and the collected data cannot be reused to assess employees performance.

  Datatilsynet (Norvegia), GPS e tracciamento dei veicoli aziendali

• Data protection impact assessment for systematic monitoring of employees and location data

  Yesrequired

  The Datatilsynet always requires a data protection impact assessment for the systematic monitoring of employees, and for location data combined with other risk criteria.

  Datatilsynet (Norvegia), quando svolgere una valutazione d'impatto

The procedure, step by step

1. 1

   Check for an objective reason (saklig grunn) and that the measure is not disproportionate (§ 9-1).

2. 2

   If employee representatives exist, discuss the measure with them as soon as possible (§ 9-2).

3. 3

   Inform the workers about the purpose, consequences and duration before activating.

4. 4

   Carry out the data protection impact assessment for systematic monitoring or location data.

5. 5

   Configure the system: stated purpose only, no reuse to assess performance.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Arbeidsmiljoloven, kap. 9 (misure di controllo, §§ 9-1 e 9-2)
• Datatilsynet (Norvegia), GPS e tracciamento dei veicoli aziendali
• Datatilsynet (Norvegia), quando svolgere una valutazione d'impatto
• Datatilsynet (autorita garante norvegese)
• Personvernnemnda, PVN-2017-07 (uso del GPS per controllare le ore del dipendente)
• Regolamento UE 2016/679 (GDPR)