The well-known GDPR protects the privacy of individuals in the context of European legislation during a time of intense technological development and the possible use of biometric, genetic, and other data. However, this also limits the employer’s ability to monitor the work of their employees, which, if pursued, becomes a very complex process.

The issue of protecting workers’ privacy has become particularly relevant after the pandemic caused by the coronavirus disease, which changed the previously known and customary ways of working. Working from a remote location and telecommuting during and after the pandemic have become so widely accepted that they have been incorporated into the legislative framework through amendments to the Labor Law.

New ways of working involve working outside the employer’s headquarters, often right in the workers’ homes, and using work tools that belong to the workers. This organization of work has raised numerous questions regarding the measurement and recording of time spent working and work results, as well as limitations on the control and monitoring of workers, which is challenging given that workers perform their tasks far from the employer’s eyes.

Right to Privacy

The right to privacy is guaranteed by the Constitution, which ensures respect and legal protection of personal and family life, as well as the freedom and confidentiality of correspondence and all other forms of communication as one of the highest values of the social order. These rights can only be limited exceptionally, by law, and only to protect the freedom and rights of others, as well as the legal order, public morality, and health. Moreover, any limitation of freedom or rights must be proportionate to the nature of the need for limitation in each individual case.

The European Convention on Human Rights and Fundamental Freedoms also guarantees the right to protection of private and family life, home, and correspondence, while at the level of the European Union, Regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016, on the protection of individuals regarding the processing of personal data and on the free movement of such data (GDPR) is particularly important. It elaborates the right to the protection of personal data as a fundamental right and ensures comprehensive protection of privacy rights in a manner appropriate to modern times. Namely, the General Data Protection Regulation regulates numerous aspects of privacy rights protection that have emerged as a necessity due to technological development, such as the right to use biometric and genetic data of individuals, recording individuals through video surveillance, processing, storage, and transfer of digitally collected data about individuals, etc. In the Republic of Croatia, the implementation of the Data Protection Regulation is regulated by the Law on the Implementation of the General Data Protection Regulation, and the supervision of the Law’s implementation is entrusted to the Agency for Personal Data Protection (AZOP).

Principles of Labor Law

To ensure the protection of workers’ privacy, the Labor Law prescribes many principles and rules aimed at limiting the collection of data about workers to the narrowest possible and necessary measure. Thus, the law stipulates that personal data of workers may only be collected, processed, used, and provided to third parties if specified by the Labor Law or another law or if necessary for the realization of rights and obligations arising from the employment relationship, or in connection with the employment relationship. If personal data needs to be collected, processed, used, or provided to third parties for the realization of rights and obligations from the employment relationship, or in connection with the employment relationship, the employer must beforehand specify in the work regulations which data will be collected, processed, used, or provided to third parties for this purpose. Personal data of workers may only be collected, processed, used, and provided to third parties by the employer or a person specifically authorized by the employer for this purpose. Personal data for which there are no longer legal or factual reasons for storage must be deleted or otherwise removed. An employer employing at least twenty workers is obliged to appoint a person who must enjoy the trust of the workers and who, besides the employer, is authorized to supervise whether personal data is being collected, processed, used, and provided to third parties in accordance with the law. These are general principles and rules that protect the privacy of individuals in the employment relationship, but in practice, certain issues have emerged as contentious, such as the employer’s right to monitor workers’ emails, to use video surveillance in the course of work, or to employ systems for tracking workers’ movements.

Monitoring of Electronic Mail

The employer’s right to monitor the electronic mail used by the worker for business purposes to perform work for the employer is not unlimited and unobstructed, as one might conclude at first glance. Namely, the employer may only monitor such types of mail in the case of a justified reason, which will be assessed on a case-by-case basis depending on the specific circumstances. AZOP has publicly stated on its website that the employer may access the electronic mail of a business nature generated by workers in connection with their work only to protect certain rights and interests and to protect against possible illegal actions by workers. In such cases, there must be a balance between the employer’s interests and the workers’ right to privacy, meaning certain conditions must be met. Only exceptional circumstances such as security incidents, violations of work duties, disclosure of business information to a competitor, suspicion of abuse, and similar situations can justify the introduction of monitoring over the content of workers’ electronic communications, provided that the value of the good that is to be protected by such monitoring and the degree of threat it faces outweigh the right to privacy protection.

—

—

Thus, monitoring of electronic mail used by workers for business purposes can only be justified by exceptional circumstances, and in the case of introducing such monitoring, the employer is obliged to detail the rules and conditions of monitoring in an internal act. It is important to emphasize that the employer cannot avoid these limitations by seeking the workers’ consent for monitoring electronic mail. Namely, AZOP considers that, taking into account the specifics of the employment relationship between employees and employers, seeking consent would merely be a formality, and the absence of consent could place workers in an unequal position. Therefore, even if the employer has obtained the workers’ consent for monitoring electronic mail, this would not nullify the limitations and conditions imposed on the employer regarding the permissibility of monitoring electronic mail.

What About Video Surveillance

The Law on the Implementation of the General Data Protection Regulation stipulates that video surveillance may only be conducted for purposes that are necessary and justified for the protection of persons and property, provided that the interests of the subjects do not prevail over the processing of data through video surveillance. Video surveillance may cover premises, parts of premises, the external surface of the building, as well as internal spaces in public transport, where monitoring is necessary to achieve the stated purpose. Work premises may only be subject to video surveillance if additional conditions established by regulations governing occupational safety are met, and if employees have been appropriately informed in advance about this measure and if the employer has informed employees before making the decision to install the video surveillance system. Moreover, video surveillance of work premises must never include rest areas, personal hygiene areas, and changing rooms.

The Law on Occupational Safety stipulates that if monitoring devices track all movements of workers during work hours, or if monitoring devices are set up so that workers are in the field of view of monitoring devices at all times during work, the employer may use monitoring devices only based on the prior consent of the workers’ council. Thus, video surveillance of work premises is permitted only if it is necessary and justified for the protection of persons and property and if, in the specific case, the interests of workers in protecting their privacy do not prevail. Employers who use video surveillance must detail the purpose of monitoring in their internal acts depending on their activities and establish the reason why the need for video surveillance outweighs the protection of workers’ privacy.

Automated Movement Monitoring

The issue of the employer’s right to monitor workers’ movements has also become relevant during and after the pandemic, which led to a rapid growth in the market for food delivery and other goods as well as passenger transport. Before the pandemic, systems for checking and controlling official cars and vehicles for transporting passengers, such as tachographs and GPS systems, were most commonly used to monitor workers’ movements. However, today many service providers in transportation and delivery operate using various digital platforms that automatically and in real-time collect various data, including tracking workers’ movements.

According to AZOP’s publicly published opinion, the employer has the right to install monitoring and control systems for vehicles without the workers’ consent in certain cases, but only when it is necessary due to the professional nature of the job or the implementation of precautionary measures. When such systems are used, the employer is obliged to inform workers about their existence and conditions of use. Additionally, the employer is required to regulate the use of such systems through internal rules, and the data collected in this manner may only be processed for the purpose for which the monitoring is justified.

It is also important to mention the employer’s obligation to conduct an impact assessment before introducing monitoring systems regarding their effect on the protection of workers’ privacy. Thus, the employer, in addition to specifying the conditions and methods of monitoring in internal acts and providing detailed information to workers about the conditions of monitoring, has an additional obligation to conduct a proportionality test regarding the introduction of such monitoring systems in relation to the workers’ right to privacy.

Advice and Recommendations Be Very, Very Cautious

– Every employer must approach the issue of protecting workers’ privacy systematically and seriously, considering the legally prescribed levels of privacy protection currently in force.

– It should be kept in mind that the employer does not have the right to monitor the workers’ private electronic mail, and the right to monitor the electronic mail used by the worker for business purposes is limited and possible only in the case of a specially justified reason.

– The employer may only use video surveillance when it is necessary and justified for the protection of persons and property. Moreover, video surveillance of work premises must never include rest areas, personal hygiene areas, and changing rooms.

– The employer has the right to install automated systems for monitoring and controlling movements without the workers’ consent, but only when it is necessary due to the professional nature of the job or the implementation of precautionary measures.

– If employers use monitoring and tracking of electronic mail, video surveillance, or automated movement tracking systems in work processes, it is essential that they detail the purpose and scope of monitoring in internal acts and transparently inform workers about such measures.