Person monitoring and personal data protection

In context of the many discussed Article 35 of Regulation (EU) 2016/64 of the European Parliament and Council on the General Data Protection Regulation (hereinafter referred to as “GDPR”), the Czech Data Protection Office has issued an opinion, which should serve as a guideline for data protection officers, whether if it is necessary to prepare and Impact Assessment (hereinafter “DPIA”) or not. 

This opinion should primarily be provided by data officers (companies, employers) who perform employee monitoring in any form, mainly when there is used camera surveillance for it, or if the company uses tracking of their vehicles, or under certain circumstances, if the presence of the employees is controlled. On several points, the DPIA determines certain criteria under which data officers should prepare the above mentioned DPIA.

If we refer an example to the above mentioned, the employer should avoid employer monitoring via utilities, which could pose a high risk to the employees privacy. These are mainly utilities, which can control the movement of the employee (GPS coordinates) or identify the employee directly (biometric cameras). In case, that the employer uses such utilities to monitor his employees and fulfils the conditions of the Data Protection Office, it will be his duty to prepare an impact assessment.

The opinion of the Data Protection is available at the following address:

https://www.uoou.cz/assets/File.ashx?id_org=200144&id_dokumenty=33193

Following the fact, that the protection of personal data at European level is constantly complemented by individual interpretations and opinions of national authorities, but also by EU institutions, it can´t be guaranteed, that the above mentioned conclusions will remain.