Employee monitoring via GPS, smartphones, and corporate apps can affect your daily work and personal sphere. If an app records movements, breaks, routes, deliveries, or response times, it is natural to wonder whether the employer is legally allowed to do so, whether they must explain the system, and whether that data can be used against you. Not every form of tracking is prohibited, but no monitoring is without limits.
I want to help you distinguish between the lawful use of a tool necessary to organize work and monitoring that exceeds the stated purpose. We will examine what safeguards the Workers' Statute requires, what the privacy information notice must indicate, how to request collected data, and why an irregular check does not automatically entitle you to compensation, although it may have significant consequences.
GPS and remote monitoring: the rule starts from the concrete function
GPS can only be used for permitted purposes. Article 4 of the Workers' Statute allows systems and tools from which remote monitoring may also derive when they are needed for organizational and productive requirements, occupational safety, or the protection of corporate assets. A tracker on a vehicle, for example, can be connected to the management of interventions, the safety of goods and vehicles, or the coordination of an external service. The current provision can be consulted in Article 4 of Law no. 300 of 1970.
The purpose must correspond to the actual operation of the system. Simply indicating safety or organization in the abstract is not enough. What matters is the type of data collected, the frequency of geolocation, the people who can consult it, and the period during which the app remains active. Tracking a vehicle while it is performing a service and recording the movements of its driver without interruption even outside of working hours are different situations, because the relationship between the collected data and the work purpose changes.
A preventive safeguard operates for monitoring tools. When the system falls under the first paragraph of Article 4, installation requires an agreement with the unitary or company trade union representation; if an agreement is lacking, authorization from the National Labour Inspectorate is required in the forms provided by the rule. This step does not turn every detection into an abuse, but it prevents a tool capable of remote monitoring from being introduced without a verifiable reason and without safeguards.
Work equipment follows a different distinction. The second paragraph of Article 4 excludes tools used by the worker to perform their work service and those that record access and attendance from the preventive procedure. A smartphone that receives tasks or an app necessary to close a delivery may fall under this provision. The distinction, however, depends on actual use: calling an app a "work tool" does not single-handedly solve the problem if it collects additional data and allows continuous monitoring.
When GPS data can be used in the employment relationship
Collected data is not automatically usable. The third paragraph of Article 4 allows information collected through the tools governed by the first two paragraphs to be used for purposes connected to the employment relationship only if the employee receives adequate information on the use of the tools and checks, in addition to compliance with personal data protection regulations. Therefore, a disciplinary dispute based on a GPS track raises at least two issues: how the data was collected and whether the worker had been adequately informed.
The information must make the monitoring understandable. A generic communication about the possibility of using corporate devices is not sufficient. Those who work must be able to understand, in clear terms, which tool is used, what data it produces, on which occasions geolocation is activated, and for what purposes the information can be consulted. If a policy only talks about an app for tasks, but does not clarify that the app records position and that data can affect work evaluations, that content can be relevant.
GPS data does not always prove what it seems to show. A position recorded in a certain place does not explain by itself why the person was there, what instructions they had received, whether the signal was reliable, or whether the app had functioned correctly. In the disciplinary relationship, it remains important to distinguish between technical data and the meaning the company attributes to it. An unexpected route may depend on a change of delivery, traffic, device malfunction, or circumstances that tracking alone does not convey.
Privacy and transparency: what limits apply to apps and geolocation
The position linked to an employee is personal data. The GDPR requires that processing be lawful, fair, and transparent, that it pursue specified purposes, and that it collect adequate and limited data to what is necessary. These principles do not lapse because the phone belongs to the company or because the app is necessary to receive instructions. The text of the regulation, including Articles 5, 13, 15, 22, 77, and 82, is available in the Regulation (EU) 2016/679.
Minimization requires avoiding excessive collection. If the objective is to verify that a team is available during a shift, the need to store every movement minute by minute does not automatically follow. If it is necessary to certify the completion of an activity, this can be different from creating a permanent history of routes. The verification therefore concerns both the usefulness of the GPS and the quantity of information stored in relation to the stated purpose.
The information notice must indicate the essential elements of processing. Article 13 GDPR requires, among other things, communicating the identity of the controller, the purposes and legal basis of the processing; depending on the case, categories of recipients, retention periods, or criteria for determining them, and exercisable rights must also be made known. For a corporate app, this means you should not have to guess on your own who accesses geolocation, how long it is kept, or whether data is transmitted to external suppliers who manage the service.
Employee consent does not replace other safeguards. At work, signing a form or accepting a policy does not in itself make invasive collection proportionate and does not replace union agreement or authorization when Article 4 requires them. The decisive point remains the compliance of the entire system: concrete purpose, correct classification of the tool, adequate information, and compliance with privacy principles.
Apps that assign scores, shifts, or priorities
An app can limit itself to recording data or it can affect work opportunities. The difference matters when position, response times, breaks, or other indicators are turned into scores that influence assignments, shifts, priorities, or exclusions. In this case, it is not enough to ask whether geolocation is permitted: it is necessary to understand whether the program takes a decision on its own that produces significant effects on the person.
The GDPR protects against certain exclusively automated decisions. Article 22 recognizes the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. The rule provides specific exceptions, but does not authorize hiding behind an IT score a decision that concretely determines relevant working conditions.
It matters whether there is an actual human evaluation. A system that provides data to a manager does not necessarily coincide with a decision taken solely by software. If, instead, the app automatically assigns fewer tasks or excludes a person when a threshold is exceeded, the logic used, the information provided to the worker, and the possibility of contesting inaccurate data or a criterion applied without considering concrete circumstances become central.
A score does not replace facts. Delays, deviations, and stops may depend on external conditions, corporate instructions, malfunctions, or safety requirements. The system can provide an element to examine, but it does not cancel the need to understand the real episode. This distinction is important above all if the company links the app's result to warnings, disputes, or choices that affect the relationship.
Access to data, complaints, and defense in the employment relationship
You can ask to know the personal data processed. Article 15 GDPR allows obtaining confirmation of the existence of processing, access to personal data, and information on purposes, categories of data, recipients, retention, and rights. A targeted request can concern geolocation data referring to a specific period, the use made of it, and the applied information notice. It is not a request for every corporate document: it concerns your personal data and the information provided by the regulation.
The response must be provided without undue delay. In general terms, Article 12 GDPR establishes the deadline of one month from receipt of the request, with the possibility of extension in foreseen cases and with the obligation to inform the data subject. A precise question helps obtain a useful response: indicating the app, the time interval, and the type of data requested makes it clearer what you are asking without waiving other rights provided by regulations.
The privacy complaint and the employment dispute have different functions. The GDPR allows lodging a complaint with the supervisory authority when it is believed that the processing violates the regulation. If GPS data was also used for a warning, suspension, or dismissal, the measure adopted in the employment relationship must also be addressed. A privacy issue does not automatically determine the outcome of every employment dispute, but it can affect the lawfulness and usability of the information collected.
Keeping essential elements avoids abstract discussions. The information notice received, communications on app installation, screenshots of required permissions, times when geolocation is active, and acts with which the company recalled data are useful. It is not necessary to reconstruct the technical functioning of the entire system on your own. It is more important to connect the tool, the period, the collected data, and the concrete consequence suffered.
Compensation: violation alone is not enough
Unlawful monitoring does not automatically produce compensation. Article 82 GDPR recognizes compensation for material or non-material damage caused by the violation of the regulation. The Court of Justice of the European Union has clarified that a violation, damage actually suffered, and a causal link between the two are needed; mere non-observance of the rule is not sufficient. This principle emerges in Case C-300/21, Österreichische Post.
Damage must be linked to recognizable facts. Pecuniary loss can consist of a demonstrable economic loss. Non-pecuniary loss instead concerns a non-economic prejudice actually caused by the unlawful processing. An abstract threshold of gravity fixed in general is not required, but anyone claiming compensation must be able to explain what negative consequence they suffered and why it depends precisely on that violation, not limit themselves to indicating the existence of an irregularity.
Authority sanction and compensation are different remedies. Any measure by the supervisory authority concerns compliance with regulations and the powers attributed to the authority itself. Compensation, on the other hand, aims to compensate the damage of the interested person. Even when a violation exists, the choice of remedy depends on the concrete objective: obtaining clarifications and data, stopping a processing method, defending oneself against a labor measure, or claiming compensation for proven damage.
Priority must be identified before acting. If the problem is an app still active outside working hours, the point may be to stop or limit the processing and understand its rules. If GPS was used in a disciplinary dispute, the content of the charge and the possibility of explaining the data are also relevant. If you believe you have suffered damage, you must accurately separate the violation from the prejudice that derived from it. To evaluate which path answers your case, you can contact me.
Frequently Asked Questions
Can the employer locate me with GPS during working hours?
Yes, but only within precise boundaries. GPS can respond to organizational and productive requirements, occupational safety, or the protection of corporate assets. When it also allows remote monitoring, the safeguards of Article 4 of the Workers' Statute and GDPR rules on purpose, proportion, transparency, and data actually necessary must be respected.
If I use a corporate phone, can the company monitor my every movement?
No, the corporate phone does not eliminate data protection. The device may be necessary to work, but collection must remain connected to a determined purpose. Permissions requested by the app, activation times of geolocation, stored data, who consults it, and what the information notice communicates about the use of controls are relevant.
Can I ask to see my geolocation data?
You can exercise the right of access. You can ask for confirmation of processing, a copy of your personal data, and information on purposes, recipients, and retention times or criteria. The request does not give the right to every internal document of the company, but must allow you to know the personal data processed and the information provided by Article 15 GDPR.
Can GPS be used to contest a behavior of mine?
It can happen only in compliance with applicable conditions. Article 4 allows the use of information for purposes connected to the relationship if the worker has received adequate information and privacy rules are respected. The single episode still remains to be evaluated: a position data may be inaccurate or not explain the concrete reasons for a stop or deviation.
Do I automatically receive compensation if monitoring is unlawful?
No, irregularity alone is not enough. For the compensation provided by Article 82 GDPR, a violation, actual material or non-material damage, and the causal link between the two are required. Damage must therefore be described and demonstrated through concrete facts; any measures by the supervisory authority do not automatically constitute personal compensation.