According to a recent decision of the European Court of Human Rights (“ECtHR”), it considered that there was no violation of the employee’s right to privacy (Article 8 of the European Convention on Human Rights) in the context of the use of the employer to provide certain data obtained as a result of monitoring under with the help of the GPS system installed on the official car, in order to issue an order for the dismissal of this employee. In order to make this decision, the ECtHR took into account the particularities of the case, which show that the employer had previously provided relevant information regarding the installation of the GPS monitoring system, and that the processed data had been limited to the minimum necessary to achieve the employer’s legitimate aim of controlling the company’s costs accordingly .

We summarize the key elements that formed the basis of the ECtHR’s decision and include key recommendations that employers using GPS monitoring systems on company cars used by employees should consider.

Actual situation

decision Florindo de Almeida Vasconcelos Gramaxo v Portugal dated December 13, 2022, refers to the situation when the employer installed GPS monitoring systems on the company cars of medical representatives, designed mainly to monitor the distance traveled by employees during the performance of professional activities. In parallel, these employees needed to fill in certain data related to their trips in the customer relationship management (CRM) program.

After comparing the information collected through the GPS system with the information entered by the employee into the CRM program, it was found that he was artificially increasing the distance traveled for work purposes in order to reduce the proportion of trips for personal purposes. The purpose with which the employee acted in this way was to avoid reimbursement of certain expenses established for personal travel which, although allowed, remained the responsibility of the employee.

Thus, the employee was dismissed for artificially increasing the distances traveled in business interests to hide private trips and non-compliance with working hours. In addition, it interfered with the GPS system during the weekend.

The employee appealed the dismissal decision, but the competent national courts recognized this decision as legal both at first instance and on appeal (although the appellate court excluded the reason for monitoring compliance with the work schedule due to the peculiarities related to the labor law of this state). Prior to the dismissal decision, the employee also filed a complaint with the national data protection authority regarding the use of the GPS system, but the complaint was dismissed and the employee did not challenge the decision in court.

1. Relevant aspects in the decision

The ECtHR concluded that, compared to the decisions of national courts, there was no violation of the right to private life in terms of the positive obligations of the state. To reach this conclusion, the ECtHR considered the following key aspects:

• the fact that the employer informed the employee: (i) of the existence of the GPS system and that it is intended to monitor the distances covered by employees during the performance of official duties; and (ii) regarding the possibility of initiating disciplinary proceedings against employees in the event of discrepancies between the mileage data provided by the GPS system and the data provided by the employee through the CRM application;
• because the Court of Appeal took into account only the geolocation data of the distances traveled, it was considered that the interference with the employee’s right to private life was limited to the minimum necessary to achieve the legitimate objective pursued by the employer, namely: to control the costs of the company;
• information obtained from the GPS system was only available to persons responsible for the distribution and approval of visits and expenses, circulation of this information was very limited;
• the employee did not challenge in court the rejection of the complaint submitted to the national data protection authority regarding the GPS system.

In conclusion, the ECtHR concluded that the Court of Appeal had carried out a balanced examination of the proportionality between the applicant’s right to respect for his private life and the employer’s right to ensure the proper functioning of the company, taking into account the legitimate aim pursued by the company, namely the right to control its costs.

2. Recommendations

When employers decide to implement GPS monitoring systems on their employees’ company cars, they must consider their obligations under data protection legislation, which is also highlighted in the ECtHR decision.

In short, employers must:

• fully inform employees about the presence of GPS systems, the purposes for which the data will be used, as well as other information required in accordance with the General Data Protection Regulation (GDPR);
• ensure that the data collected through GPS systems processed by the company is limited to the necessary minimum established by reference to the purpose for which it is collected;
• ensure that appropriate technical and organizational measures are put in place to protect data (for example, limiting access to information only to persons who need to know it in the performance of their duties, technical security of the GPS system, etc.);
• analyze the relationship with the GPS system provider to determine whether a data processing contract is required (for example, when you act as a data processor);
• if the basis of the data processing is the legitimate interest of the company, the company will also have to carry out an analysis to justify its interest, which pursues the implementation of the GPS system, referring to the interests or fundamental rights and freedoms of employees (for example, cost control, when it is suspected that route sheets will inappropriate due to reference to the distance between the points between which movement occurs or the need for a disciplinary investigation for sanctions for deviation from labor discipline).

The employer should also consider the application of the national law on measures to implement the General Data Protection Regulation (Law 190/2018), which provides for certain additional requirements when the monitoring of employees is based on the legitimate interests of the employer. These requirements mainly concern consultation with the trade union or employee representatives, the absence of less intrusive ways to achieve the objective pursued by the employer (according to the principles established by the ECtHR in the case of Bărbulescu v. Romania) and the establishment of a proportionate and limited data retention period.

In conclusion, we are grateful that the review carried out by the ECtHR is fair, and the conclusions drawn from the Court’s analysis can be used by employers to implement GPS-type monitoring systems on company cars, up to the use of the resulting data from these systems both in disciplinary procedures and in courts, with the fulfillment of relevant legal obligations.

The article was signed by Christina Tudoran (advisor) and Diana Havra (senior lawyer)