GPS og overvåking av ansatte, land for land
GPS og overvåking av ansatte i Italia
hva som skal til for å være i orden
Oppdatert den 3. august 2026
Kompetent myndighet
Garante per la protezione dei dati personali (italiensk datatilsyn)Verifisert den 15. juni 2026
Hva du risikerer
EUR 120,000fra en reell GPS-sak
Oppdatert den 3. august 2026
Hva du trenger
8For hver plikt forteller vi deg om den gjelder i dette landet: Ja betyr påkrevd, Det kommer an på betyr bare i visse tilfeller, Nei betyr ikke påkrevd.
Hva du trenger
For hver plikt forteller vi deg om den gjelder i dette landet: Ja betyr påkrevd, Det kommer an på betyr bare i visse tilfeller, Nei betyr ikke påkrevd.
Trade union agreement (RSA/RSU) or authorisation from the Labour Inspectorate, before installing the system
JapåkrevdGPS is a tool that can lead to remote monitoring of workers. Article 4 of the Workers' Statute allows it only after a trade union agreement with the RSA or RSU, or authorisation from the Territorial Labour Inspectorate. Installing it before this step, or using it differently from what was authorised, is the fastest route to a penalty.
Legge 20 maggio 1970, n. 300 (Statuto dei Lavoratori), art. 4
Location recorded only at clock-in and clock-out, with no continuous monitoring
JapåkrevdThis is the line between recording attendance and remote monitoring. The Court of Cosenza, judgment no. 972 of 1 July 2026, annulled a EUR 50,000 fine by the Garante precisely because the system recorded date, time, coordinates and site only at the moment of clocking, without allowing continuous tracking of movements: configured that way it falls among the access and attendance recording tools of Article 4, paragraph 2. Note that this is a first-instance ruling, not a Supreme Court decision, and it does not remove the other obligations. At the opposite end, recording the position every sixty seconds with real-time display cost a health authority a fine in May 2026.
Written privacy notice to workers, complete and truthful (Article 13 GDPR)
JapåkrevdThe worker must know clearly and truthfully that they are being geolocated, how, when and why (Article 13 GDPR). In the road haulage case the notice existed but was full of inconsistencies and typos: for the Garante that is the same as not having one.
Garante Privacy, Provvedimento del 16 gennaio 2025, n. 10112287
No continuous tracking: location collected only when needed (data minimisation)
JapåkrevdFollowing the vehicle 24/7, breaks included, violates the data minimisation principle (Article 5 GDPR). Location is collected when it serves a legitimate purpose, not to always know where the person is. Continuous tracking is one of the reasons for the 50,000 EUR penalty against the road haulage company.
Garante Privacy, Provvedimento del 16 gennaio 2025, n. 10112287
Use of data only for the declared purpose, with no reuse for disciplinary sanctions
JapåkrevdLocation data must be used only for the purpose for which it was collected (Article 5 GDPR, purpose limitation). Reusing it for another purpose, for example data collected to document the work and then used to start a disciplinary procedure, is a misuse of purpose. The same applies to the scope of collection: in the Pioneer case the driving-style score was calculated on private and off-duty trips as well, and staff of other group companies could access the data without Article 28 agreements.
Data Protection Impact Assessment (DPIA)
Det kommer an påbare i visse tilfellerFor processing of this kind a DPIA (Article 35 GDPR) is required, expressly listed in the annex to the Garante decision no. 467 of 11 October 2018 for technological systems in the employment relationship, geolocation included. It must be done before switching the system on: in the Ligurian health authority case the missing assessment was among the findings.
Data retention limited to the strictly necessary period
JapåkrevdData is kept for the time necessary for the purpose, not "just in case" indefinitely. In the road haulage case, retention for 180 days contributed to the penalty.
Garante Privacy, Provvedimento del 16 gennaio 2025, n. 10112287
Legitimate and declared purpose (organisational, safety, protection of company assets)
JapåkrevdOrganisational, safety or company asset protection needs are legitimate purposes. Never "checking what the employee does": that is exactly what Article 4 prohibits.
Legge 20 maggio 1970, n. 300 (Statuto dei Lavoratori), art. 4
Fremgangsmåten, steg for steg
Complete the Article 4 procedure first, not later: an agreement with the trade union representatives (RSA or RSU) or authorisation from the Territorial Labour Inspectorate. Without it, you are out from the first minute.
Define a legitimate and declared purpose: organisational, safety or company asset protection needs. Never "checking what the employee does".
Prepare a complete and truthful privacy notice under Article 13 GDPR: no typos, no grey areas.
Apply data minimisation: collect only the data you need, only when you need it. No tracking during breaks, provide the ability to switch it off.
Limit retention: data is kept for the time necessary for the purpose, not indefinitely.
Carry out the impact assessment (DPIA) when the risk is high (Article 35 GDPR).
Keep a single purpose: data collected for one purpose is not reused to sanction. Ever.
If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the trade-union agreement (Art. 4) or the Labour Inspectorate authorisation needs renewing. The provider (data processor), the data collected and the methods often change: the one signed earlier is not enough.
Hvem du skal kontakte
Garante per la protezione dei dati personali (italiensk datatilsyn)
Verifisert den 15. juni 2026
Garante per la protezione dei dati personali
Verifisert den 15. juni 2026
Malen du kan laste ned
Last ned den gratis GDPR-malen for GPS-personvernerklæring for Italia
Mal for personvernerklæring for geolokalisering av ansatte, i samsvar med GDPR art. 13, med landets rettslige grunnlag og tilsynsmyndighet. Fyll ut de tomme feltene og få den sjekket av rådgiveren din.
Vil du også ha de neste praktiske guidene om GPS og styring av feltteam? Legg igjen e-posten din (valgfritt).
Ingen spam, meld deg av med ett klikk.
Garante Privacy, decision no. 755 of 18 December 2025 (Pioneer Hi-Bred Italia Sementi, doc-web 10213711), made public with newsletter no. 542 of 29 January 2026: 5 employees, telematics devices on vehicles with a driving-style score calculated on private trips as well.
https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10213711
Siter denne siden
Du kan fritt sitere dem, så lenge du oppgir kilden med en lenke til denne siden.
GPS og overvåking av ansatte i Italia: hva som skal til for å være i orden - GeoTapp. https://geotapp.com/nb/ressurser/gps-ansatte-eu/italia/Kilde: <a href="https://geotapp.com/nb/ressurser/gps-ansatte-eu/italia/?utm_source=citazione&utm_medium=referral&utm_campaign=risorse">GPS og overvåking av ansatte i Italia: hva som skal til for å være i orden - GeoTapp</a>© 2026 GeoTapp. Data samlet inn og verifisert av GeoTapp. For full republisering av datasettet eller kommersiell bruk kontakt oss.
Kilder
- Garante Privacy, Provvedimento del 16 gennaio 2025, n. 10112287
- Garante Privacy, Provvedimento n. 755 del 18 dicembre 2025, n. 10213711 (Pioneer Hi-Bred Italia Sementi)
- Garante Privacy, Provvedimento n. 382 del 28 maggio 2026, n. 10259916 (Azienda di Tutela della Salute per la Liguria)
- Garante Privacy, Provvedimento n. 135 del 13 marzo 2025 (doc-web 10128005), annullato dal Tribunale di Cosenza con sentenza n. 972 del 1° luglio 2026
- Legge 20 maggio 1970, n. 300 (Statuto dei Lavoratori), art. 4
- Regolamento UE 2016/679 (GDPR), artt. 5, 13, 25, 35, 88
Dette er en informasjonsressurs, ikke juridisk rådgivning. Før du tar i bruk et overvåkingssystem, bør du få situasjonen din vurdert av en fagperson.
Vil du ha et system som allerede er i orden?
GeoTapp registrerer posisjonen kun ved stempling, ikke kontinuerlig, og lager varselet de ansatte skal signere. Prøv det gratis.