Introduction and purpose of
Technology that gives the employer the opportunity to monitor the employees' vehicles is becoming more and more widespread, especially in transport companies with large vehicle fleets. Employers who have several vehicles out in traffic, and need an overview of where the vehicles are at all times in connection with operational planning in real time, can achieve this by GPS logging/"fleet management". This can typically apply to transport activities; where the purpose is to make the business more efficient through good planning in real time, so that inquiries are served and followed up in the most efficient way possible. In these situations, GPS logging may be legal. It is nevertheless an absolute requirement that the information that is stored is not more extensive than the purpose dictates. GPS logging/"fleet management" cannot legally be used to log what speed the individual driver had at any given time, or how long breaks the person has taken. If GPS logging/"fleet management" is the purpose, only the recording of the car's and then also the driver's location in real time is relevant personal data. It will therefore not be necessary to store the information. The Norwegian Data Protection Authority points out that employers should choose solutions that enable employees to move freely in those cases where certain private errands must be carried out during working hours. This could mean, for example, the possibility to switch off the tracking device during a doctor's visit or the like.
Regulations
§ 9-1. Conditions for control measures in the business
(1) The employer can only implement control measures against the employee when the measure has a factual basis in the company's circumstances and it does not entail a disproportionate burden on the employee.
(2) The Personal Data Act applies to the employer's processing of information about employees in connection with control measures, unless otherwise stipulated in this or another Act.
§ 9-2. Discussion, information and evaluation of control measures
(1) The employer is obliged as early as possible to discuss the need, design, implementation and significant change of control measures in the business with the employees' union representatives.
(2) Before the measure is implemented, the employer must provide the affected employees with information on:
the purpose of the control measure,
practical consequences of the control measure, including how the control measure will be carried out,
the assumed duration of the control measure.
(3) The employer must, together with the employees' representatives, regularly evaluate the need for the control measures that are implemented.
2. In addition, there are the requirements in the Personal Data Protection Ordinance. Here we will highlight some of these requirements.a. It is important to provide sufficient information
WorkID providers have a duty to provide employees with good information.
This will particularly mean providing good information about the purpose of the monitoring. The purpose must be specified and expressly stated. What the purpose is will govern what the information can be used for. Collected information cannot be used for new, incompatible purposes.b. There must be at least one legal basis for the processing to be legal.
The employer may also have a so-called legitimate interest in locating the vehicles.
The interest may be to make the operation of the vehicle fleet more efficient, for example through operational planning in real time, so-called fleet management.
In order for such monitoring measures to be legal, a number of requirements in both the Working Environment Act and the Personal Data Protection Regulation must be met. The introduction of monitoring measures in the company's vehicles is normally considered a control measure, and the requirements in the Working Environment Act Sections 9-1 and 9-2 on control measures will then apply.
Checklist for subcontractors or customers/clients before monitoring measures can be introduced:
1. Has the control measure been introduced in accordance with the requirements of Chapter 9 of the Working Environment Act?
2. Has the introduction been transparent for the employees, i.e. is there transparency about the introduction? Is the obligation to provide information to the employees fulfilled?
3. Is the measure necessary? Can the same result be achieved with less invasive methods?
4. Is the measure legal? What legal basis is there?
5. Are requirements for built-in privacy met when designing the system?
6. Has an assessment of privacy consequences been carried out? If no, why not?
Effective date: January 15, 2022
