GPS and worker monitoring in Ireland: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Prior notice to workers of the existence, operation and all purposes of the tracking (art. 13 GDPR)

  Yesrequired

  The worker must be informed, before activation, of the existence of the tracking, how it works and all its purposes.

  DPC, guida sul tracciamento dei veicoli aziendali (maggio 2020)

• Mandatory consent or trade-union agreement before installation

  Nonot required

  Ireland has no trade-union consent mechanism that conditions monitoring; control runs through legal basis, transparency, proportionality and DPIA. The worker's consent is valid only in exceptional cases.

  DPC, guida sul tracciamento dei veicoli aziendali (maggio 2020)

• Prior authorisation from an authority before installation

  Nonot required

  No prior authorisation from the DPC is needed; the authority must be consulted beforehand only if the DPIA reveals a high risk that cannot be mitigated.

  DPC, consultazione preventiva

• Valid legal basis (usually legitimate interest, not consent) with balancing test and right to object

  Yesrequired

  The usual basis is legitimate interest (art. 6(1)(f)), which must be strictly necessary and proportionate and balanced against the worker's rights, subject to the right to object (art. 21).

  DPC, guida sul tracciamento dei veicoli aziendali (maggio 2020)

• Prohibition on using the tracking for general monitoring of staff; opt-out outside working hours

  Yesrequired

  The tracking cannot be used to monitor staff in general; it is unlikely to be lawful outside working hours, and an opt-out (privacy switch) is needed if the vehicle is also used privately.

  DPC, guida sul tracciamento dei veicoli aziendali (maggio 2020)

• Data protection impact assessment (DPIA) mandatory for systematic location monitoring

  Yesrequired

  The DPC list makes a DPIA mandatory for the systematic monitoring, tracking or observation of the location or behaviour of individuals.

  DPC, lista dei trattamenti che richiedono una DPIA

The procedure, step by step

1. 1

   Inform workers, before activation, of the existence, operation and purposes of the tracking.

2. 2

   Identify a valid legal basis (usually legitimate interest) and document the balancing test.

3. 3

   Carry out the data protection impact assessment (DPIA): mandatory for systematic location monitoring.

4. 4

   Limit the tracking to what is strictly necessary and to working hours; provide an opt-out for private use.

5. 5

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• DPC, guida sul tracciamento dei veicoli aziendali (maggio 2020)
• DPC, protezione dei dati sul luogo di lavoro
• DPC, lista dei trattamenti che richiedono una DPIA
• DPC, consultazione preventiva
• DPC, presentare un reclamo
• DPC, decisione Limerick City and County Council (dicembre 2021)
• Regolamento UE 2016/679 (GDPR)