GPS and worker monitoring in Portugal: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Informing workers of the existence and purpose of the surveillance (art. 20 Codigo do Trabalho)

  Yesrequired

  The employer must inform workers of the existence and purpose of the surveillance measures used.

  Codigo do Trabalho, art. 20 (mezzi di sorveglianza a distanza)

• Prohibition on using remote surveillance to monitor the worker's performance (art. 20 CT)

  Yesrequired

  Remote surveillance may not be used to monitor professional performance; it is allowed only for the protection and safety of people and property or for particular needs of the activity.

  Codigo do Trabalho, art. 20 (mezzi di sorveglianza a distanza)

• Prior authorisation from an authority before installation

  Nonot required

  With the GDPR the old prior authorisation by the CNPD has fallen away; an a posteriori review remains. Note: art. 21 CT has not been expressly repealed and legal opinion is divided, but in practice prior authorisation is no longer required.

  Lei 58/2019, art. 28 (relazioni di lavoro)

• Proportionate geolocation, limited to working hours, with a private mode outside those hours

  Yesrequired

  According to the CNPD, geolocation may not locate the worker nor monitor their performance, may not extend to breaks and rest periods, and the worker must be able to switch to private mode outside working hours. The worker's consent is not a valid legal basis.

  CNPD, Deliberacao 7680/2014 (geolocalizzazione nel contesto lavorativo)

• Impact assessment (DPIA) for tracking the location of workers

  Yesrequired

  The CNPD list requires an impact assessment for processing that allows tracking the location or behaviour of workers with an evaluation or classification effect.

  CNPD, valutazione d'impatto sulla protezione dei dati

• Opinion of the workers' committee, where one exists

  It dependsonly in certain cases

  Where a workers' committee exists, its opinion must be requested.

  Lei 58/2019, art. 28 (relazioni di lavoro)

The procedure, step by step

1. 1

   Inform workers of the existence and purpose of the surveillance (art. 20 CT).

2. 2

   Check the purpose: allowed only for the safety of people/property or particular needs of the activity, never to monitor performance.

3. 3

   If a workers' committee exists, request its opinion.

4. 4

   Carry out the impact assessment (DPIA) for location tracking.

5. 5

   Configure the system with data minimisation: no tracking of whereabouts, private mode outside working hours, limited retention.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Codigo do Trabalho, art. 20 (mezzi di sorveglianza a distanza)
• CNPD, Deliberacao 7680/2014 (geolocalizzazione nel contesto lavorativo)
• Lei 58/2019, art. 28 (relazioni di lavoro)
• CNPD, valutazione d'impatto sulla protezione dei dati
• CNPD, presentare una segnalazione
• Regolamento UE 2016/679 (GDPR)