GPS and worker monitoring in Danmark: what you need to stay compliant

What you need

For each obligation we tell you whether it applies in this country: Yes means required, It depends means only in certain cases, No means not required.

• Objective reason (saglig grund) and proportionality of the monitoring

  Yesrequired

  Monitoring of employees must have an objective and legitimate reason and be proportionate; mere performance surveillance is not allowed.

  Datatilsynet, guida sul controllo dei dipendenti (Kontrol af medarbejdere)

• Legal basis: collective agreement on monitoring, or legitimate interest

  It dependsonly in certain cases

  If a collective agreement on monitoring (e.g. the DA/LO agreement) covers the surveillance, the basis is the Danish data protection law; in its absence, the basis is the legitimate interest of the private employer. Collective agreements impose their own notice rules.

  Datatilsynet, guida sul controllo dei dipendenti (Kontrol af medarbejdere)

• Prior authorisation from an authority before installation

  Nonot required

  No prior authorisation from the Datatilsynet is required; what applies is accountability plus the duty to inform.

  Datatilsynet, guida sul controllo dei dipendenti (Kontrol af medarbejdere)

• Prior information to workers (at the latest at activation, art. 13 GDPR)

  Yesrequired

  Workers must be informed, at the latest when the monitoring is activated, of the purpose, scope and use of the data, in a clear and accessible form.

  Datatilsynet, guida sul controllo dei dipendenti (Kontrol af medarbejdere)

• GPS only for a legitimate purpose, with no reuse to monitor the driver behaviour or location; switchable off for private use

  Yesrequired

  GPS on vehicles is allowed to plan routes, monitor transport or for the safety of employees, but the data cannot be reused to monitor the driver behaviour or location; if private use is permitted, the employee must be able to switch the GPS off.

  Datatilsynet, guida sul controllo dei dipendenti (Kontrol af medarbejdere)

• Impact assessment (DPIA) for location data combined with another criterion

  Yesrequired

  The Danish list always requires an impact assessment for the processing of location data in combination with at least one other criterion (WP248 guidelines).

  Datatilsynet, lista dei trattamenti che richiedono una valutazione d'impatto

The procedure, step by step

1. 1

   Verify an objective reason (saglig grund) and the proportionality of the monitoring.

2. 2

   Identify the legal basis: collective agreement on monitoring, or legitimate interest; observe any notice periods set by the collective agreement.

3. 3

   Inform the workers at the latest when the monitoring is activated (art. 13 GDPR).

4. 4

   Carry out the impact assessment (DPIA) for the location data.

5. 5

   Configure the system: declared purpose only, no reuse to monitor the driver, switch-off for private use.

6. 6

   If you switch systems: when you change your monitoring system or software, update and re-issue the privacy notice, and check whether the national agreement or authorisation for remote monitoring needs renewing. The provider (data processor), the data collected and the methods often change: the one provided earlier is not enough.

Who to contact

What you risk

Sources

• Datatilsynet, guida sul controllo dei dipendenti (Kontrol af medarbejdere)
• Datatilsynet, lista dei trattamenti che richiedono una valutazione d'impatto
• Datatilsynet, controlli 2020 sull'obbligo di informazione (GPS e videosorveglianza)
• Datatilsynet (autorita garante danese)
• Regolamento UE 2016/679 (GDPR)