GPS and worker monitoring in Nederland: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Works council (OR) consent before installing the system (WOR art. 27)

  It dependsonly in certain cases

  Where a works council (ondernemingsraad, OR) exists, the employer needs its prior consent (instemmingsrecht) before introducing a system that processes staff data or monitors attendance, behaviour or performance (WOR art. 27, points k and l). If the OR does not consent, the employer cannot proceed. This applies where an OR exists: it is mandatory from 50 employees upwards.

  Wet op de ondernemingsraden (WOR), art. 27 (diritto di consenso del consiglio aziendale)

• Authorisation from a labour authority before installing

  Nonot required

  The Netherlands does not require prior authorisation from a labour authority. The gatekeepers are OR consent and the GDPR. The data protection authority (AP) must be consulted beforehand only in the case of art. 36 GDPR, that is, if the DPIA reveals a high risk that cannot be mitigated.

  Eurofound, monitoraggio dei lavoratori nei Paesi Bassi

• Prior information of workers (art. 13 GDPR)

  Yesrequired

  Workers must be informed in advance and fully about what is monitored and why.

  Autoriteit Persoonsgegevens, condizioni per il controllo dei dipendenti

• Valid legal basis (legitimate interest with balancing; employee consent is usually not valid) and ban on continuous tracking

  Yesrequired

  For the AP, monitoring must be necessary and proportionate; the basis is usually legitimate interest with a balancing test, not the employee's consent (because of the imbalance of power). GPS on company vehicles is allowed for work trips, but not to systematically track private or off-duty movements.

  Autoriteit Persoonsgegevens, condizioni per il controllo dei dipendenti

• Impact assessment (DPIA) for employee monitoring and location data

  Yesrequired

  The AP's DPIA list expressly cites GPS systems in employees' vehicles and the systematic monitoring of workers' activities, as well as the large-scale processing of location data: in these cases the DPIA is mandatory.

  Autoriteit Persoonsgegevens, lista dei trattamenti che richiedono una DPIA

The procedure, step by step

1. 1

   If an OR exists, obtain its consent (instemmingsrecht) before activating the system (WOR art. 27).

2. 2

   Identify a valid legal basis under the GDPR: usually legitimate interest with a balancing test, not the employee's consent.

3. 3

   Carry out the impact assessment (DPIA): for GPS on employees' vehicles and for large-scale location data it is required.

4. 4

   Inform workers in advance and fully (art. 13 GDPR).

5. 5

   Configure the system with data minimisation: work trips only, no continuous tracking or tracking of private movements.

6. 6

   If the DPIA reveals a high risk that cannot be mitigated, consult the AP beforehand (art. 36 GDPR).

7. 7

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Wet op de ondernemingsraden (WOR), art. 27 (diritto di consenso del consiglio aziendale)
• Autoriteit Persoonsgegevens, lista dei trattamenti che richiedono una DPIA
• Autoriteit Persoonsgegevens, condizioni per il controllo dei dipendenti
• Autoriteit Persoonsgegevens, sanzione per il trattamento delle impronte dei dipendenti
• Eurofound, monitoraggio dei lavoratori nei Paesi Bassi
• Regolamento UE 2016/679 (GDPR)