Introduction
Privacy Protection Authority's statement
Practical implications
Recently, the Israeli Privacy Protection Authority published a statement for public comment regarding the legality of employers using technology that monitors the location of employees, such as GPS applications on company phones or devices in company vehicles.
In most cases, these monitoring systems are used in relation to employees where the employer has difficulty keeping track of their working hours and location due to the nature of their job, such as:
- drivers;
- couriers;
- sales agents; and
- employees whose permanent workplace is not at the employer's premises.
According to the statement, the use of monitoring systems in combination with additional information held by employers may lead to an invasion of employee privacy. Thus, it will be possible to deduce highly sensitive details from the data, such as the employee's financial status and health, which are confidential in accordance with the Privacy Protection Act.
Privacy Protection Authority's statement
According to the statement, an employer should use a monitoring system only in the absence of any other reasonable alternative that does not collect location data. In addition, the employer will be allowed to use a monitoring system only where it has a legitimate and essential purpose for the workplace. Further, it will be difficult for the employer to justify collecting location data outside the employee's working hours. Possible solutions to these limitations include:
- a system that tracks the employee's presence only at geographical landmarks, rather than monitoring their entire journey;
- allowing employees to notify the need to deal with a personal matter during working hours and, therefore, to stop being monitored; and
- encrypting the data so that the employer can see the monitoring data only at pre-defined events, such as a complaint about an employee who did not arrive at the location where their presence was required.
According to the statement, to fulfil the proportionality requirement, the employer must set specific purposes in advance for which the information will be collected. The employer must be transparent with the employees and clearly inform them about the relevant policy on the use of the collected data.
In addition, the employer must obtain specific consent from the employee to collect the monitoring data. An employee's consent to install a theft detection device in the vehicle is not the same as consent to collect data about their location at any time during working hours.
Therefore, the statement requires that the employer explains to the employees:
- the purposes of using the data;
- the times during which it will be collected;
- how long it will be kept; and
- the officials who are authorised to access it.
Also, the employer should refrain from collecting monitoring data outside of working hours as this can lead to the disclosure of personal information about the employee and their family members. In addition, the information must be properly secured.
Employers typically provide a company vehicle to employees whose work requires regular travel, such as field sales agents. In the vehicle, the employer may install a system for collecting location data in order to, for example, prevent theft or respond to a customer's claim that a service was not received.
In the absence of an attendance report, employers may find themselves with limited options to defend themselves from claims demanding overtime hours. This is because the Israeli Working Hours and Rest Act requires employers to ensure that employees report attendance, and the courts tend to take a narrow view of circumstances that fall outside of this obligation, especially in light of the sophistication of the technology available.
Further, when seeking to use data from monitoring systems, compliance with the rules of the use of such systems is necessary to prevent the courts from nullifying the information on the ground that it violates the employee's right to privacy.
For example, if a field sales agent, whose attendance is not recorded, seeks to sue their employer under the Working Hours and Rest Act for overtime pay or special compensation for working during weekly rest periods, according to the statement, the employers will be able to defend against such a claim by using the location data that was collected through the company vehicle, but only if they first received consent from the employee. After all, by using the vehicle data the employer can easily establish when employee worked and when they dealt with personal matters.
Previous rulings in such cases have recognised the legitimacy of employers using technology to monitor employees in roles that require regular travel, to the extent that collecting location data of vehicles during working hours does not infringe on privacy.
Since the publication of the statement, the Privacy Protection Authority has not published any official guidelines. It is expected that the courts will adopt the principles of the directive and the relevant limits to the use of monitoring systems.
For further information on this topic please contact Naama Ratzam at Efrat Deutsch & Co by telephone (+972-3-6096960) or email ([email protected]). The Efrat Deutsch & Co website can be accessed at www.edz-law.co.il.