Location data at work: when may an employer track location

In brief

• Storing location is monitoring carried out by technical means, so the introduction is preceded by a dialogue or a hearing and by informing the staff (section 21).
• Only location data directly necessary for the employment relationship may be collected, and the employee's consent does not widen that (section 3).
• The purpose is named first and the level of precision derived from it: the work site, a geofence, a coordinate or a continuously recorded route.
• The retention period for location data is decided separately from that of the working-time records; what is erased is the location, not the working-time entry.

Location data is personal data when it can be linked to an employee. Before introducing collection, define why it is needed, the legal basis for processing and the precision required. Workplace privacy rules also require a necessity assessment, the appropriate employee consultation process and information.

Storing location is monitoring carried out by technical means

Section 21 of the Act on the Protection of Privacy in Working Life names three forms: camera surveillance, access control and other monitoring carried out by technical means. Reading location from an employee’s phone, from a punch terminal or from a work vehicle belongs to the third group, no matter how coarse the stored data is. Three obligations follow, and they are the same for a small and a large employer: the procedure before the decision, defining the purpose and the methods of the monitoring, and informing the staff.

Section 3 limits processing to data directly necessary for employment. Section 21 covers employee consultation and information about monitoring. Assess the GDPR processing basis and other requirements for the collection method alongside these.

Assess necessity and the legal basis separately

Under section 3 of the Act, an employer may process only personal data that is directly necessary for the employee’s employment relationship and that is connected with managing the rights and obligations of the parties to the relationship or with the benefits the employer provides to employees, or that arises from the special nature of the work duties. For location this means that the purpose is named first and the precision of the data is derived from it. Verifying a working-time entry, confirming a visit at a customer’s site and the basis for a kilometre allowance are all part of managing the rights and obligations of the employment relationship. A general interest in where the staff move around is another matter.

Consent does not replace necessity. Employee consent does not permit collection of data unnecessary for employment (section 3). Necessity alone is not a legal basis under the GDPR either. Separately check the processing basis and consent and information requirements for the collection method. A phone’s location permission is technical access, not a substitute for the employer’s privacy obligations.

The assessment of necessity is worth doing one purpose at a time and writing down, because the same assessment is needed again in two situations: when an employee asks for the grounds and when the system is extended to a new group. The latter is the most common point at which an originally limited practice spreads: the level justified for the installers is taken into use for the salespeople too, whose work does not carry the same grounds.

The levels of precision differ in what they can establish

The levels of location data form a staircase in which every step adds both to the evidential value and to the picture that builds up of the employee. The first three levels are momentary observations; the last two describe movement over time.

The lowest level of the staircase is often overlooked: the work site is recorded as a choice or read from a tag attached to the site, and location is not read at all. That is enough for allocating costs and for reporting, which are the most common reasons for starting the whole discussion.

The top level differs from the others in kind. A momentary observation tells you about one event; a continuous trail tells you how the day went: when the break was taken, where it was taken and how long the journey lasted. Taking it into use requires a purpose that withstands the same scrutiny as any other monitoring, and a data protection impact assessment under the General Data Protection Regulation is an ordinary step in large-scale tracking.

Example: four purposes and the location data each requires

The table illustrates different purposes, not automatically permitted forms of tracking. Assess necessity, the legal basis and sufficient precision for your work. Restrict access by job duties.

For safety use, designate alert recipients and backups. Restrict access for other purposes to those who need it too. Technical access to location does not itself justify using it for another purpose.

A driving log means two different things. The personal driving log under section 31 of the Working Hours Act is for monitoring the working and rest times of the driver of a motor vehicle, and the start and end times of work, rest periods and breaks are entered in it. On the tax side, the basis for a kilometre allowance is a travel claim which, under section 17 of the Prepayment Decree, shows the purpose of the journey, the destination, where needed the route, the mode of travel and the start and end times of the journey, and for kilometre allowances also the number of kilometres and the unit rates. Both requirements are met by the data that is recorded.

Limit tracking to its justified purpose

Private movement should not be recorded for employer tracking. The boundary of working time does not settle every case: data for a reimbursable business trip may be needed even when travel time is not working time. Assess each purpose separately and prevent unrelated location data from being recorded.

In practice the limitation is a technical decision, not an instruction. There are three points at which it either happens or fails to happen:

• The app’s location permission. The permission determines when the app may access location. The app’s implementation determines when it actually reads and stores it. Check separately that collection stops as agreed; the permission’s name alone does not guarantee this.
• The vehicle’s tracking device. Work driving and private driving are separated in the device, because a trail outside the recorded shift serves no named purpose.
• The end of the shift. When the punch or the shift ends, reading location ends with the same event, not with a separate reminder to the employee.

Ordinary commuting between home and the regular workplace is normally personal time. Whether other travel counts as work depends on section 3 of the Working Hours Act and the actual circumstances. Keep working-time classification, expense reimbursement and location-data processing distinct.

Co-operation and informing the staff before the introduction

Technical monitoring must be discussed before the decision under the cooperation rules applicable to the employer. Businesses with 20–49 employees have lighter dialogue rules. State, municipal and other public employers follow their own cooperation provisions. Outside cooperation legislation, employees or their representatives must have an opportunity to be heard (section 21 of the Act on the Protection of Privacy in Working Life).

After the procedure, the employer must under section 21 define the purpose of the monitoring and the methods used in it, and inform the employees of the purpose, the introduction and the methods. On a timeline these are three separate events, each of which leaves its own record: the hearing or the dialogue, the decision with its definitions, and the notice. Under section 4 of the same Act, the collection of personal data on recruitment and during the employment relationship must be dealt with in the dialogue referred to in the Co-operation Act, so taking location data into use belongs on the agenda on this ground as well.

Section 23 of the Act obliges the employer to keep the Act on the Protection of Privacy in Working Life available to employees at the workplace. The same place is a natural one for the location practice too: the written practice is then where the employee looks for it.

Example: an outline for the notice to employees

The notice answers the questions the employee would otherwise put to their supervisor one at a time. The order is deliberate: the grounds first, then the scope, and the rights last.

1. What location is used for. One sentence per purpose, and after each of them what happens if location is not available.
2. What is stored and at what precision. The site name, at site or not, a coordinate or a route; the level is named for what it is.
3. When location is read. The event that triggers the reading (a punch, the start of a visit, a travel entry) and the time span within which it happens.
4. Who the practice applies to. The duties or groups in which the level is in use, and on which devices.
5. Who sees the location. The roles by name, and what each role sees.
6. How long the location is kept. The retention period and what is left of the data once it has ended.
7. How an incorrect location is corrected. Who is told, within what time the correction is made and how the correction is shown to the approver.
8. How to see your own data. Who the request is addressed to and within what time it is answered.
9. Where the practice is found and when it takes effect. The date of entry into force and the place where the written practice can be read.

New employees get the same information at induction, and a change of level is always a notice of its own. Raising the level while the system is in use takes the matter back to the procedure in section 21: a new method means a new hearing or a new dialogue.

The retention period is decided separately from the working-time records

Keep personal data only as long as justified purposes and applicable duties require. There is no single retention period for all location data. Assess visit verification, expense-claim support and any legal claim separately.

Raw location history and the time or expense records derived from it may need different retention periods. Do not automatically retain the full route as long as a statutory accounting record. Set retention according to purpose, necessity and any legal duties.

Erasure is worth implementing automatically, because a clean-up done by hand is the first thing left undone in a busy month. What is erased is the location, not the working-time entry: the times of the punch remain in the records, and next to them the information about where the punch was made disappears.

The employee may see their own location data

Under section 4 of the Act, the employer must collect personal data concerning the employee primarily from the employee themselves, and the controller’s duty to provide information to the data subject and the data subject’s right of access are laid down in the General Data Protection Regulation. If location data is collected from somewhere other than the employee themselves, for example from a vehicle’s tracking system or from the lessor of the equipment, the employee’s consent is needed for the collection, and the data obtained must be reported to them before it is used in decision-making concerning them. Consent here concerns the source of the data; what data is necessary is still settled under section 3. This is the point at which location data typically turns into a dispute: the trail exists in a third party’s system, and it is brought out only once something has happened.

On the working-time side the right is more precise. Under section 32 of the Working Hours Act, an employee is entitled on request to a written account of the entries concerning them in the shift rosters and the working-time records, and the employer must on request provide a copy of the working-time records to the occupational safety and health authority and to the shop steward, elected representative or other representative acting for the employee. When location is attached to a punch, it is part of the very entry the account covers.

It is worth trying out how such a request is answered before the first one arrives: who collects one person’s location entries, in what form they are given and how long it takes. A list showing the time, the level stored and the site is understandable even to someone seeing their data for the first time.

Checklist

Before you take location data into use:

• The purposes are written out, one sentence for each, and for each of them the decision or the obligation the data serves is named.
• For each purpose the coarsest level has been chosen at which the purpose is met, and the choice is justified in writing.
• Necessity and the legal basis are assessed separately. Consent does not replace necessity, and necessity alone is not a processing basis.
• The source of the data is known. Data collected from the employee themselves is separated from data obtained from an outside system, which is covered by the consent and notification duty of section 4.
• The hearing or the dialogue was held before the decision and recorded with its participants and dates (section 21).
• The purpose and the methods were defined after the decision and the notice has been sent to everyone the practice applies to.
• Tracking is limited to justified use. Private movement is excluded. Business-trip records and tracking during shifts are assessed separately.
• Viewing rights are named by role and for every role it is known what it sees.
• The retention period has been decided separately from the retention period of the working-time records, and erasure happens by itself without a separate action.
• The way of correcting an incorrect location is described and the correction leaves a record.
• Answering an access request has been tried out with one person: who collects it, in what form and within what time (section 32).
• The Act on the Protection of Privacy in Working Life is available to employees at the workplace, and the location practice is in the same place (section 23).