Illicit employees geolocation and video surveillance: a French tale from CNIL

From September to October 2023, the French DPA (CNIL) has been dealing with illicit employee geolocation and video surveillance. Overall, CNIL fined both private and public-sector entities for a total amount of 97,000 euros. In particular, the fined entities contravened:

• The data minimization principle because of geolocation and continuous video surveillance of employees;
• The duty to inform employees about the processing carried out and its purposes;
• The obligation to respect the rights of individuals, and in particular to respond to a request for objection

Employee geolocation and video surveillance are not always illicit

When it comes to employee surveillance it is important to consider the imbalance of power between the employer and the employees. In particular, article 88 GDPR encourages Member States to:

• Protect the rights and freedom of the employees when their personal data are processed by the employer
• Safeguard the employees’ human dignity, legitimate interests, and fundamental rights when monitoring systems are deployed at the workplace

Employee geolocation

Regarding the monitoring of the employees’ geolocation, the main issues addressed by the CNIL were the following:

• the continuous recording of geolocation data
• the impossibility for employees to stop or suspend the tracking system during break times

However, the French DPA also stated that these activities do not always result in illicit activities subjected to sanctions. CNIL reaffirmed the principle that if there is a special justification, such activities can be carried out without causing an excessive infringement of employees’ freedom and their right to privacy.

Employee video surveillance

About the video surveillance of employees, the main issue was the implementation of video surveillance systems that constantly film employees at their workstations, without any particular reason. In deciding against the employers, the French DPA stated that the prevention of accidents in the workplace and the gathering of evidence do not per se justify the surveillance measures.

However, the DPA conclusions do not exclude employee surveillance measures, as long as:

• the employer sets out a clear and reasonable purpose for implementing the measure
• the measures are not disproportionate to the aims pursued

What to do to implement employee geolocation and video surveillance

By an analysis of the CNIL’s decisions, it emerges that there is room for employers to implement employee geolocation and video surveillance. Companies may need these measures for very different reasons:

• prevent misconduct or improve the company’s security
• prevent accidents and employee’s security
• optimize resources and reduce costs

However, choosing a legitimate purpose and proportionate measures is not sufficient.

Does your organization have any questions about employee surveillance or already have such measures in place, but have not conducted PIAs or DPIAs? Contact us, the Experts in Data Privacy at info@dpoconsultancy.nl for assistance, we are happy to help you!