Monitoring employees between geolocation and video surveillance: what is lawful and what is not?

Smart working and geolocation: the data protection authority’s intervention

In its decision of 13 March 2025, the Italian Data Protection Authority fined a company € 50,000 for monitoring the location of over 100 employees (out of 540) working remotely through a clock-in app. Sampled workers were invited to activate their device’s geolocation, clock in via the app, and declare their physical location by email.

In many cases, a comparison followed between the workplace(s) declared in the individual remote working agreement, the email declaration, and the location recorded by the app.

This could lead to disciplinary action for “failure to comply with the procedures set out in the Regulation on remote working” or “discrepancy between the declared location and the one verified by the Inspection Office during checks.”

The company claimed that the system was for internal reporting purposes (i.e. clocking in) for smart working employees and had been ratified through a specific union agreement.

However, the Authority found several unlawful elements in the process:

• Lack of a valid legal basis: the location data processing lacked a legitimate justification or freely given consent.
• Inadequate privacy notice: employees were not properly informed of the nature and purposes of data processing.
• Disproportionate control: the monitoring was direct, continuous, and pervasive – even if union-approved – thus violating the Workers’ Statute and constitutional principles.
• Intrusion into private life: real-time geolocation infringed upon the employee’s freedom and dignity, undermining the autonomy that smart working is meant to ensure.

The outcome? A €50,000 fine, an obligation to delete all collected data, and a complete overhaul of company procedures.

GPS systems on company vehicles: when they are unlawful

Another example of unlawful data processing is described in Decision no. 7 of 16 January 2025, where a logistics company was fined for the improper use of GPS tracking systems on its fleet, despite having obtained prior authorization from the Labour Inspectorate.

Among the most serious breaches noted by the Authority were violations of the principles of data minimization and storage limitation, under Article 5(1)(c) and (e) of the GDPR. The GPS system used by the company tracked vehicles continuously, including during breaks, and stored the data for 180 days. These methods were deemed excessive and disproportionate to the stated purposes, which could have been achieved using less invasive means and less detailed data.

Furthermore, the processing was inconsistent with the conditions set out in the Labour Inspectorate’s authorization, which had expressly allowed non-continuous tracking and identification of the driver only when strictly necessary (e.g. in case of anomalies or accidents). In practice, the company was able to constantly associate each vehicle with the respective employee by cross-referencing IT systems and company data – thus circumventing the protections required by the authorization itself.

Video surveillance: safety tool or hidden control system?

Similar caution must be applied in the management of video surveillance systems. Article 4 of the Workers’ Statute fully applies in this area as well. The employer can install cameras only following a union agreement or authorization from the Labour Inspectorate, and never for the continuous monitoring of individual workers.

The purposes must be legitimate and well-documented: asset protection, theft prevention, and workplace safety.

It follows that:

• cameras must not be pointed directly at desks or individual workstations;
• they cannot be used to monitor breaks, colleague interactions, or internal movements;
• they must be signposted with clear signage;
• images must be stored for the minimum necessary time, typically no more than 24 – 48 hours.

Thus, managing video surveillance lawfully requires not only formal authorization, but also alignment between declared purposes and actual usage methods.

In our daily work, we frequently support companies in drafting internal policies for the lawful use of digital systems, and we represent employees who discover they have been monitored without proper notice or safeguards.

It’s not about demonizing technology, but about using it wisely and responsibly. Every digital tool introduced in the workplace – from GPS to video surveillance – requires informed decisions, accurate documentation, and transparent management.