GPS and worker monitoring in Malta: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Prior information to workers (art. 13) and a strictly necessary and proportionate measure

  Yesrequired

  every monitoring measure must be strictly necessary and proportionate, choosing the least intrusive means, and workers must be clearly informed before the monitoring begins, never afterwards.

  IDPC (Garante maltese), guida al settore del lavoro

• Prior authorisation from an authority before installation

  Nonot required

  no prior authorisation from the IDPC is required; the controller self-assesses and consults the IDPC only if a DPIA reveals a high residual risk.

  IDPC, valutazione d'impatto sulla protezione dei dati

• Basis = legitimate interest (high threshold), not consent

  Yesrequired

  consent is not normally valid in the employment relationship because of the imbalance of power; the usual basis is legitimate interest, but with a high threshold.

  IDPC (Garante maltese), guida al settore del lavoro

• No continuous or permanent tracking; data minimisation

  Yesrequired

  only the minimum of necessary data may be collected; continuous or permanent tracking is presumptively disproportionate.

  IDPC (Garante maltese), guida al settore del lavoro

• Impact assessment (DPIA) for geolocation and for evaluating employee performance (IDPC list)

  Yesrequired

  the IDPC list includes processing involving the use of geolocation data and the evaluation of employee performance among those requiring an impact assessment.

  IDPC, valutazione d'impatto sulla protezione dei dati

The procedure, step by step

1. 1

   Check that the measure is strictly necessary and proportionate and choose the least intrusive means.

2. 2

   Identify a valid legal basis (legitimate interest, not consent).

3. 3

   Carry out the impact assessment (DPIA) for the geolocation of employees.

4. 4

   Inform the workers clearly before the monitoring begins.

5. 5

   Configure the system: no continuous tracking, only the necessary minimum.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• IDPC (Garante maltese), guida al settore del lavoro
• IDPC, valutazione d'impatto sulla protezione dei dati
• IDPC, presentare un reclamo
• IDPC, decisione CDP/COMP/426/2022 (videosorveglianza dei dipendenti)
• Data Protection Act (Cap. 586)
• Regolamento UE 2016/679 (GDPR)