As time tracking applications become more common, the question of the employee’s technical location as part of the time tracking service increasingly arises. Storing the employee’s location data is always a matter of personal data processing and therefore must take into account both the Act on the Protection of Privacy in Working Life and the General Data Protection Regulation of the EU. An interesting precedent was set in July 2021 when the Office of the Data Protection Ombudsman issued a decision in a case concerning the legality of location data collected in the work time tracking of a Finnish higher education institution. In the case, a penalty payment was imposed on the university for unnecessary processing of location data. It is noteworthy that the consent given by the employees was not sufficient in the decision to override the necessity requirement under the Personal Data Act. Therefore, consent was not considered a legal basis for the collection of location data.
What does the employer need to know and take into account in order for the processing of personal data for the purpose of work time tracking to be lawful?
Can location data be used in the time tracking system at all if the employee’s consent does not comply with the principle of legality? The short answer is: yes. The employer must only be careful and understand the rights of both the employee and the company and the nature of their own activities. In addition, this can be extended as a good basic guideline for all personal data collection. The processing of all personal data always requires a processing basis in accordance with the General Data Protection Regulation. Simply put, this means that personal data that the company does not need to fulfil its own obligations must not be collected from employees.
The Office of the Data Protection Ombudsman has given a few examples of what the legal basis for processing is in the work time tracking system. These include, for example, ensuring the safety of employees and allocating resources to the right place. In the monitoring of working time and other labour law obligations, the processing of location data is possible if the employee works entirely or mostly outside the employer’s premises, and there are no other means available for the monitoring of working time that are less intrusive in the protection of privacy. If location related to the time tracking service is to be used for monitoring and tracking working hours, it must be defined in advance as the purpose of location.
Cooperation procedure and impact assessment as key for good processing of location data
The employer must remember that the employee locating carried out in the work time tracking program is considered technical supervision, which must be reviewed in the workplace cooperation procedures. In practice, this means creating common rules for locating employees. This must be communicated and the practices and rules relating to the work time tracking must be covered. In addition, location by means of a mobile phone requires consent in accordance with the Electronic Communications Services Act.
It is equally important to conduct an impact assessment before processing location data. It describes the processing of personal data and assesses the necessity, proportionality and risks of the processing. The objective is to assess whether the risk arising from the processing of personal data is justified and acceptable in the circumstances at hand.
Processing of location data in the Duunissa service
In the Duunissa work time tracking service, it is also possible to save location information in the work shift clocking entries. It is important to understand that the service and applications do not constantly monitor the employee, but the clocking entry only includes the location at the time of making the entry.
As described above, the collection of location data by means of electronic time tracking is fully possible in accordance with the law, as long as preparations for this are carefully made. We are happy to help our customers with questions related to the collection of location data, as well as other personal data, in connection with the Duunissa service.
It is also important that the collection of location data can be removed from the settings, if necessary. This way, the company does not accidentally collect location information for which it has no grounds for processing. In addition, it is possible to delete location data in our service as a mass deletion from those work shifts where it is no longer appropriate to keep the data. In this way, the rights of all parties have been taken into account as much as possible in our service.
