GPS and worker monitoring in Croatia: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Prior consent of the works council if the surveillance follows all movements for the entire working time (Zakon o zastiti na radu, art. 43)

  It dependsonly in certain cases

  If the devices follow all of the worker movements for the entire working time, the employer may use them only with the prior consent of the works council (or of the union representative holding the relevant powers). This applies where such a body exists.

  Zakon o zastiti na radu (legge sicurezza sul lavoro), art. 43 (dispositivi di sorveglianza)

• Written information to the worker at hiring and written internal rules (art. 43 + AZOP)

  Yesrequired

  The employer must inform the worker in writing, already at hiring, that they will be monitored, and must regulate the GPS with written internal rules: oral information is not enough.

  AZOP (Garante croato), trattamento dei dati dei dipendenti tramite GPS

• Prior authorisation from an authority before installing

  Nonot required

  No prior authorisation from the AZOP is required; the controller assesses the legal basis and the DPIA on its own.

  AZOP (Garante croato), trattamento dei dati dei dipendenti tramite GPS

• Basis = legitimate interest (not consent) and proportionality; no tracking outside working hours without a basis

  Yesrequired

  The basis is normally legitimate interest, not the worker consent (imbalance of power); the processing must be proportionate and must not extend beyond working hours without a clear basis.

  AZOP (Garante croato), trattamento dei dati dei dipendenti tramite GPS

• Impact assessment (DPIA) for employee tracking systems (AZOP list)

  Yesrequired

  The AZOP list includes the processing of employee data through apps or tracking systems (of work, of movements, of communication) among those that require an impact assessment.

  AZOP, lista dei trattamenti che richiedono una DPIA

The procedure, step by step

1. 1

   If the surveillance follows all movements for the entire working time, obtain the consent of the works council (ZZR art. 43).

2. 2

   Regulate the GPS with written internal rules and inform the workers in writing.

3. 3

   Identify a valid legal basis (normally legitimate interest) and document the balancing test.

4. 4

   Carry out the impact assessment (DPIA) for the tracking system.

5. 5

   Configure the system in a proportionate way: no tracking outside working hours without a basis.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Zakon o zastiti na radu (legge sicurezza sul lavoro), art. 43 (dispositivi di sorveglianza)
• AZOP (Garante croato), trattamento dei dati dei dipendenti tramite GPS
• AZOP, lista dei trattamenti che richiedono una DPIA
• AZOP, richiesta di accertamento di violazione (reclamo)
• AZOP (Garante croato), pagina ufficiale
• Regolamento UE 2016/679 (GDPR)