GPS and worker monitoring in Эстония: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Prior information to workers and a documented legal basis (legitimate interest, not consent)

  Yesrequired

  The employer must explain to workers on which legal basis the GPS is installed; in the employment relationship consent is not normally a valid basis because of the power imbalance.

  AKI (Garante estone), FAQ sui rapporti di lavoro (GPS)

• Mandatory consent or agreement of the works council before installing

  Nonot required

  Estonia does not require mandatory consent from a works council; the filters are the GDPR, the AKI's guidelines and the principle of necessity and proportionality.

  AKI (Garante estone), FAQ sui rapporti di lavoro (GPS)

• Prior authorisation from an authority before installing

  Nonot required

  No prior authorisation from the AKI is required; the controller assesses the legal basis and proportionality on its own.

  AKI (Garante estone), FAQ sui rapporti di lavoro (GPS)

• Proportionate GPS, only during working hours, no real-time tracking outside working hours, switchable off

  Yesrequired

  Processing at the workplace must be proportionate to the risks; the employer cannot follow workers in real time outside working hours.

  AKI (Garante estone), FAQ sui rapporti di lavoro (GPS)

• Impact assessment (DPIA) for systematic monitoring of employees activities and real-time location tracking (AKI list)

  Yesrequired

  The AKI list includes large-scale systematic monitoring of employees activities and real-time tracking of a person location among the cases that require an impact assessment.

  AKI, valutazione d'impatto (capitolo 5)

The procedure, step by step

1. 1

   Identify a valid legal basis (legitimate interest, not consent) and document it.

2. 2

   Check that the processing is proportionate to the actual risks.

3. 3

   Carry out the impact assessment (DPIA) for systematic monitoring or real-time tracking.

4. 4

   Inform workers in advance (Art. 13 GDPR), explaining the legal basis of the GPS.

5. 5

   Configure the system: only during working hours, no real-time tracking outside working hours, switchable off.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• AKI (Garante estone), FAQ sui rapporti di lavoro (GPS)
• AKI, materiale sul trattamento dei dati nel rapporto di lavoro
• AKI, valutazione d'impatto (capitolo 5)
• AKI, presentare un reclamo
• AKI (Garante estone), pagina ufficiale
• Regolamento UE 2016/679 (GDPR)