GPS and worker monitoring in Romania: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Mandatory, complete and explicit prior information of workers (Law 190/2018 art. 5 lett. b)

  Yesrequired

  monitoring of employees through electronic means/geolocation is permitted only after mandatory, complete and explicit prior information of the workers.

  Legge 190/2018, art. 5 (monitoraggio dei dipendenti)

• Prior consultation of the trade union or of the employees representatives (art. 5 lett. c)

  It dependsonly in certain cases

  before introducing the monitoring systems the employer must consult the trade union or, where applicable, the employees representatives. It applies where they exist.

  Legge 190/2018, art. 5 (monitoraggio dei dipendenti)

• Prior authorisation from an authority before installation

  Nonot required

  the law makes monitoring subject to the conditions of art. 5, but not to a prior authorisation from the ANSPDCP.

  Legge 190/2018, art. 5 (monitoraggio dei dipendenti)

• Less intrusive means already proven ineffective and prevailing legitimate interest (art. 5 lett. a, d)

  Yesrequired

  monitoring is permitted only if other less intrusive forms have not already proven effective and if the legitimate interest of the employer prevails over the rights of the workers.

  Legge 190/2018, art. 5 (monitoraggio dei dipendenti)

• Proportionate retention, no longer than 30 days save exceptions (art. 5 lett. e)

  Yesrequired

  the retention period must be proportionate to the purpose and no longer than 30 days, save for cases provided for by law or duly justified.

  Legge 190/2018, art. 5 (monitoraggio dei dipendenti)

• Impact assessment (DPIA) for the systematic geolocation of employees (Decizia 174/2018)

  Yesrequired

  the national list makes the impact assessment mandatory for the large-scale systematic monitoring of vulnerable persons (including employees) and for the systematic processing of location data.

  ANSPDCP, Decizia 174/2018 (lista trattamenti che richiedono DPIA)

The procedure, step by step

1. 1

   Inform the workers in a prior, mandatory, complete and explicit manner (art. 5 lett. b).

2. 2

   Consult the trade union or the employees representatives before introducing the system (art. 5 lett. c).

3. 3

   Verify that other less intrusive means have not already been sufficient and document the prevailing legitimate interest.

4. 4

   Carry out the impact assessment (DPIA) for the systematic geolocation.

5. 5

   Limit retention to 30 days save justified exceptions; use the data only for the stated purpose.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Legge 190/2018, art. 5 (monitoraggio dei dipendenti)
• Codul Muncii, art. 40 (obblighi del datore, riservatezza dati)
• ANSPDCP, comunicato del 23 marzo 2023 (sanzione Tehnoplus, GPS)
• ANSPDCP, Decizia 174/2018 (lista trattamenti che richiedono DPIA)
• ANSPDCP, presentazione dei reclami
• Regolamento UE 2016/679 (GDPR)