Israeli Privacy Protection Authority Publishes New Statement Concerning Location Data in Workplaces

There has been an uptrend in recent years of employers using a variety of technological tools to supervise their employees and oversee the quality of their work. The use of these tools has become more prevalent due to the shift of many organizations to working from home last year.

For the most part, the use of monitoring systems occurs in instances when keeping track of employees’ work hours is nearly impossible due to the nature of their roles. These include drivers, delivery persons, and sales agents, who do not have a permanent physical workplace. Employers can monitor employees using designated applications they may ask employees to install in their personal cellphones or in phones they provide. Employees’ locations can also be tracked using GPS systems installed in vehicles used by employees that belong to the employer.

As a result of the many queries submitted to the Israeli Privacy Protection Authority on the subject, the PPA has published a draft statement for public comment. The statement presents the ethical and legal dilemmas involved in employers’ use of technologies to collect data on their employees’ location, and attempts to set standards for employers’ use of such technologies.

Main points of PPA statement:

1. Employers seeking to use a GPS system to track their employees’ locations must act in compliance with the provisions and purpose of the Privacy Protection Law and exercise judgment and proportionality when deciding to use such a system. Firstly, employers must properly weigh the benefit derived from using such a system against the damage to and infringement of employees’ right to privacy during work.
   Thus, the use of such location monitoring systems should only occur when there is no other alternative for achieving the purpose of the data collection.

2. According to the principle of proportionality, employers may use GPS systems only when the data collection is happening for a legitimate reason vital to the workplace.
3. Employers seeking to use technologies that collect location data must first consider whether the type of work and the nature of the employee’s role justify tracking the employee’s location data. If at issue is an employee who performs work primarily in a standard office environment, then the employer will have a hard time showing a legitimate reason that justifies tracking that employee’s location data.

If employers fulfill these criteria and have a legitimate and vital reason for collecting employees’ location data, as well as meet the above requirements of proportionality, employers must then comply with the following conditions:

• Employers may not make any use of the information that deviates from the principal reason for its collection.
• Employers must be completely transparent with their employees. Before starting to collect data, they must inform employees in a clear, detailed, and unambiguous manner about the  volume of use of location data, the purposes for collecting the data, the hours during which such data will be collected, how long this data will be retained, and which functionaries will be authorized to view the data.
• Employers must obtain the express, specific, and individual consent of each of their employees to the collection of location data.
• Employers should refrain from collecting employees’ location data after their actual work hours, both from designated applications in cellphones and from GPS systems installed in vehicles that employers allow their employees to use after work. This is due to the concern information will be collected about employees’ families.
• Finally, employers must comply with the data security requirements for the data they collect, as specified in the Privacy Protection Regulations.

Conclusions:

In some sense, the PPA’s statement lags behind the current situation at many employers and the Israeli labor courts’ extensive rulings. Nevertheless, the statement reiterates the need for separation between employees’ personal activities and work-related activities. It focuses on the question of defining “work time” and “personal time” and the extent to which separating the two can be achieved at this time. In addition to the legal aspects of the PPA’s statement, its implementation can help employers manage their labor relations in a way that does not infringe upon their employees’ personal time.

***

This draft statement  emphasizes the fact that there are many aspects of labor relations subject to privacy protection laws. Employers must be prepared to comply with both privacy protection laws and the various labor laws.

If you have any questions, please feel free to contact us for assistance.