GPS and worker monitoring in Slovenia: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Proportionality test: indiscriminate tracking of employees has no legal basis (IP-RS)

  Yesrequired

  For the Slovenian authority, indiscriminate tracking of workers via GPS does not meet the necessity standard for exercising the rights and obligations of the employment relationship: in that case the legal basis is missing. It is necessary to pass the proportionality test (necessity, suitability, proportionality in the strict sense).

  IP-RS (Garante sloveno), linee guida sull'uso dei dispositivi GPS

• Legal basis = performance of the contract (ZDR-1 art. 48) or legitimate interest, not consent

  Yesrequired

  The basis is the performance of the employment relationship (art. 48 ZDR-1) or the legitimate interest; the employee's consent is hardly valid due to the imbalance of power.

  IP-RS (Garante sloveno), linee guida sull'uso dei dispositivi GPS

• Prior authorisation from an authority before installing

  Nonot required

  No prior authorisation from the IP-RS is required; the controller assesses on its own the legal basis, proportionality and DPIA.

  IP-RS (Garante sloveno), linee guida sull'uso dei dispositivi GPS

• No continuous surveillance: only point-in-time or real-time data, not permanent storage; safety device that can be switched off

  Yesrequired

  For the IP-RS, continuous tracking is not proportionate when point-in-time or real-time data without storage would suffice; a device meant solely for safety must be able to stay switched off until the worker activates it.

  IP-RS (Garante sloveno), linee guida sull'uso dei dispositivi GPS

• Information to workers and internal act; information of the works council if one exists (ZDR-1)

  It dependsonly in certain cases

  The employer must inform the workers (art. 13 GDPR) and adopt an internal act; where a works council exists, it must be informed before adopting the general act.

  Zakon o delovnih razmerjih (ZDR-1), art. 48 (dati dei lavoratori)

• Data protection impact assessment (DPIA) for geolocation and employee data (IP-RS list)

  Yesrequired

  The authority recommends carrying out an impact assessment before introducing GPS devices, and geolocation and employee data are on the list that requires one.

  IP-RS, valutazione d'impatto sulla protezione dei dati

The procedure, step by step

1. 1

   Pass the proportionality test: no indiscriminate tracking, choose the least intrusive means.

2. 2

   Identify a valid legal basis (performance of the contract, art. 48 ZDR-1, or legitimate interest).

3. 3

   Adopt an internal act and inform the workers; inform the works council if one exists.

4. 4

   Carry out the data protection impact assessment (DPIA) before introducing the GPS.

5. 5

   Configure the system: no continuous surveillance, no permanent storage, safety devices that can be switched off.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• IP-RS (Garante sloveno), linee guida sull'uso dei dispositivi GPS
• IP-RS, parere 'Sledenje zaposlenim' (tracciamento dei dipendenti)
• Zakon o delovnih razmerjih (ZDR-1), art. 48 (dati dei lavoratori)
• IP-RS, valutazione d'impatto sulla protezione dei dati
• IP-RS, presentare una segnalazione
• Regolamento UE 2016/679 (GDPR)