2020/36 Employer must pay compensation to an employee for violation of employee’s privacy due to GPS system in company car (AT)

Summary

The Austrian Supreme Court has confirmed that an employer must pay compensation to an employee due to a violation of the employee’s privacy. The employer implemented a GPS system in its company cars without the employee’s knowledge and without legal basis.

Background

In Austria, if an employer wants to implement or change a GPS system in its company cars a works agreement – an agreement between the employer and a competent works council – or an agreement between the employer and every single employee is mandatory.
A GPS system is a technical system. If an employer wants to implement or change an implemented technical system or control measure, it is obliged to conclude a works agreement with the competent works council before implementing or changing the system/control measure according to the Austrian Labour Constitution Act. If there is no works council, the employer is obliged to conclude a written agreement with every employee. These agreements are necessary if the technical system or the control measure affects human dignity.
In this context, the term ‘human dignity’ is not defined in Austrian law nor when it is affected. According to the Austrian Civil Code every person has innate rights, such as freedom of speech, protection of private life and data protection. The term ‘affect’ describes only a certain area of an intrusion. The control measure or the technical system interferes only in a certain area, which is barely acceptable for the employee and is to be potentially observed by the employer. This means, if a technical system or control measure affects the employee’s human dignity, a works agreement with the works council or an individual agreement with every employee is mandatory. It is important to note that if the technical system or control measure violates the employee’s human dignity, the implementation of such a system is not allowed. In this case, the agreement would be null and void.
Furthermore, the employer is not only obliged to conclude the abovementioned agreements but it is also obliged to have a legitimate interest in implementing such systems according to the General Data Protection Regulation (GDPR). According to a verdict of the Austrian Data Protection Authority, such legitimate interest of an employer could include calculating the contribution for the car insurance and calculating routes more efficiently. This means that the employee’s or the works council written consent do not suffice from the perspective of the GDPR and the employer also needs such legitimate interest.
If the employer implements or changes a GSP system in company cars without written consent and a legitimate interest the employee could be entitled to compensation due to a violation of the employee’s privacy.

Facts

The employee was employed as a field worker and was entitled to use a company car. The employee could use the car for private purposes, too. The employer installed a GPS system with which it could track the car, even when the employee used it for private purposes. The GPS system was able to transmit these data around-the-clock to the employer. The employer did not use the GPS system for strategic distribution management. Furthermore, there was no works or individual agreement for the use of this GPS system.
Immediately after the employee noticed the GPS system, he clarified that he had not agreed to its installation, especially the use of the GPS system in his spare time. Often, the employer contacted the employee and asked why he had left home with the company car late in the evening in his spare time.
The employee claimed damages totalling EUR 6,000 (EUR 1,000 per month) for the illegal use of the GPS system which violated his privacy. The employee claimed that he was put under stress because the GPS system registered where he was during his spare time and transmitted these data directly to the employer.
The Labour Court awarded damages totalling EUR 2,400 (EUR 600 per month) to the employee. The Labour Court ruled that the GPS system is a technical system which affects human dignity. Therefore, a works agreement or an individual agreement is mandatory according to the Austrian Labour Constitution Act. Given that there was no such agreement between the employer and the employee, and the employer violated the employee’s privacy, the employer acted unlawfully and was culpable. The Court of Appeal confirmed the verdict.

Judgment

The Austrian Supreme Court confirmed this verdict, too. He who unlawfully and culpably interferes in the privacy of another person must compensate them for the damage done by this violation.
As mentioned above the GPS system is a technical system, which affects human dignity. According to the Austrian Labour Constitution Act the employer needs a works agreement or individual agreement.
The Supreme Court confirmed that there had been a violation of the employee’s privacy due to this GPS system and the lack of written consent. Therefore, the employer acted unlawfully and was culpable.
The Supreme Court also held that the employer had not put forward an argument that it had a legitimate interest for using the GPS system.

Commentary

This is not the first verdict in which the Austrian Supreme Court has confirmed that a GPS system is a technical system which could affect human dignity, so that a works agreement or an individual agreement is mandatory. However, it is the first verdict of the Supreme Court in which it has confirmed damage done due to the violation of an employee’s privacy and has granted compensation to the employee.
It is now clear that an employee is entitled to a monetary compensation if the employer unlawfully and culpably implements or changes a technical system or a control measure which affects or could affect the employee’s privacy while the necessary agreements are lacking, including a legitimate interest.
Moreover, the Supreme Court mentioned that there was no legitimate interest of the employer to implement such a system. This legitimate interest is not only important to conclude a works agreement or an individual agreement, but it is also important to fulfil the duties according to the verdict of the Austrian Data Protection Authority.

Comments from other jurisdictions

Croatia (Dina Vlahov Buhin, Vlahov Buhin i Šourek d.o.o.): According to the official opinion of the Croatian Personal Data Protection Agency, employers in Croatia have a right to install systems for monitoring and control of company cars (tachograph and GPS systems) without an employee’s approval, however, only when this is necessary due to the professional nature of the job or for precautionary measures. When such systems are used, the employer is only obliged to inform the employee of their existence and conditions of use, hence, no explicit approval of the employee is required for installing and use of such systems. It is recommended that the conditions of use are disclosed in the work regulation or other internal act of the employer. Examples of the necessity of setting up such systems include companies for transporting goods and passengers, providing postal services and the like. There is no obstacle to installing similar systems in other vehicles as well, for example to monitor the movement of cars in cases of theft. The use of data obtained via GPS in a company car must be defined by the internal rules of the employer, especially if the employee is allowed to use the car for private purposes. According to the revised judgment of the Supreme Court in judgment number Revr-85/2014 when the employer voluntarily puts a GPS device in the employee’s vehicle, monitoring and tracking must be transparent to the employee or must have the purpose the employee is aware of, whereas data collected should not be used for any other purpose. Hence, although the legal framework covering this subject matter is not clearly established yet and considering the fact that generally different surveillance methods indeed lead to violation of privacy rights of employees, from the perspective of the Croatian authorities and up-to-date practice, adequately applied (transparent) surveillance methods are legal even without explicit approval from the affected employees, as long as the employer has a ‘legitimate’ interest in doing so (which from the current practice seems rather vague and arbitrary).
In light of the above, it is my opinion that in a case where the employer failed to adequately inform the employee of the fact that the GPS system was installed in the vehicle the employee had been provided with for official and private purposes, and on the conditions and purpose of use of such a system, the Croatian courts would interpret this as a violation of the employee's rights and would rule in favour of the employee. On the other hand, if the employee had been informed about the use of the surveillance system (e.g. through the employer’s internal regulation) and the employer claims it has a ‘legitimate’ interest (such as use of a GPS device against the theft), the court would likely rule in favour of the employer.  

Finland (Janne Nurminen, Roschier, Attorneys Ltd): Depending on the circumstances of the situation, the requirements for an employer establishing a GPS monitoring system vary. Positioning information of employees might be considered necessary in order to fulfil the rights and obligations of the employment when work is performed other than a fixed place of work, for example transportation-related work, according to the Finnish Office of the Data Ombudsman. The specifics of the job description may indicate that the gathering of positioning information is necessary and in compliance with the privacy laws. If this is the case an employee’s consent is still required.
If the employer has the required legal basis for processing the data and it wants to monitor the company cars and the employees’ positioning information is a ‘by-product’ of this, in principle no employee consent is needed. However, the data has to be processed in compliance with the privacy regulations and the employees need to be made aware of the plan regarding installation of a monitoring system. As a result if an employer regularly employing at least 20 employees would like to install a GPS system in company cars an employee consultation would have to take place first. According to the Act on the Protection of Privacy in Working Life (759/2004, as amended) the employer is obliged to conduct consultations when introducing a technical monitoring system. In these consultations arranged according to the Co-operation Act (334/2007, as amended), the employer will explain the method and purpose of the monitoring. After the consultations, the employer is entitled to implement the technical monitoring system and no agreement needs to be achieved during the consultations.
Therefore, in Finland, no such collective agreement can or needs to be entered into regarding installation of GPS monitoring systems. Regardless, all the privacy and data protection regulations must be complied with.
There is no case law in Finland concerning an employee’s right to receive compensation for a privacy violation by the employer.

Germany I (Nina Stephan, Luther Rechtsanwaltsgesellschaft mbH): The decision of the Austrian Supreme Court is quite convincing and presumably also a strong signal for Germany and German employers. Although so far there is no published German court decision that has had to deal with claims for damages in the case of illegal GPS monitoring by the employer, it can however be assumed that the German courts would decide in a similar way to the Austrian Supreme Court.
The reason for this assumption is, on the one hand, that the regulations regarding the implementation and use of GPS systems in the company seems to be largely the same in Austria as in Germany. According to German law a works agreement is also mandatory if the employer wants to implement a GPS system in its company cars. Besides the employer also has to comply with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”). In addition, under German law, human dignity and, in view of the present decision, in particular the right to privacy, are of course also legally protected. In fact, they are even fundamental rights. If these rights are violated, the affected person may be entitled to damages under Section 823 of the German Civil Code (Bürgerliches Gesetzbuch, “BGB”).
A further clear indication is the German jurisdiction concerning undercover video surveillance of employees by the employer. In this respect, the Regional Labour Court of Hessen (Hessisches Landesarbeitsgericht, “LAG Hessen”) had already decided in 2010 that a permanent (video) surveillance usually constitutes a disproportionate encroachment on the employee’s general right to privacy and personality which justifies payment of compensation by the employer (here EUR 7,000) (cf. LAG Hessen, judgment of 25 October 2010, file no. 7 Sa 1586/09). The Regional Labour Court of Rhineland-Palatinate (Landesarbeitsgericht Rheinland-Pfalz, “LAG Rheinland-Pfalz”) came to a similar conclusion. This Court also decided in its ruling of 23 May 2013 (file no. 2 Sa 540/12) that video surveillance of a workplace could trigger surveillance pressure on the employee which could obligate the employer to pay compensation for pain and suffering. In this respect, the LAG Rheinland-Pfalz also based its decision on a violation of the employee’s general right to privacy and personality, as the Austrian Supreme Court also did in its decision, which is in Germany part of human dignity or is derived from the basic right of human dignity.
The fact that the illegal use of GPS surveillance also constitutes an encroachment into the general right of personality has now also been confirmed by a German court. Hence, the Administrative Court of Lüneburg (Verwaltungsgericht Lüneburg, “VG Lüneburg”) decided in March 2019 (cf. partial judgment of 19 March 2019, file no. 4 A 12/19) that at least in the case of permitted or tolerated private use of company cars the use of GPS surveillance would constitute a violation of the right to informational self-determination – which is part of the general right of personality because there would be no general need for monitoring by the employer. According to the decision of the VG Lüneburg, GPS surveillance of company cars was considered to be a violation of employee data protection law. However, it remains to be seen how the German courts will deal with the assessment of claims for damages in connection with GPS surveillance in the end.

Germany II (Nikita Bretz, Ahlers & Vogel Rechtsanwälte PartG mbB): The use of a GPS system promises reliable tracking of geoposition and allows better control of employees. However, its increasing popularity among employers is also encountering increasing legal problems in Germany. According to case report 2020/36, this was the first time that the Austrian Supreme Court confirmed compensation for illegal GPS monitoring. Following on from this, the German legal situation is described below.
1. General admissibility of GPS monitoring
In general, the use of GPS in company vehicles is not prohibited. The processing of personal data of employees by means of GPS positioning may be permissible according to Section 26(1) of the Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”). However, the measures would have to be necessary and be able to withstand a weighing-up of interests. An open, suspicion-independent full control during working hours or in the private sphere is incompatible with Section 26(1) BDSG and fails due to the principle of proportionality. It should also be noted that the relevant works council must be asked prior to introducing a GPS monitoring system in accordance with Section 87(1) no. 6 of the Works Constitution Act (Betriebsverfassungsgesetz, “BetrVG”) if the employee’s behaviour can be individualized and can, therefore, be specifically assigned. The processing of personal data is also permitted under strict conditions in order to uncover criminal offences.
2. The admissibility of secret GPS monitoring
Particularly controversial is the admissibility of secret GPS monitoring. The admissibility is questionable precisely because of Article 13(1) of the General Data Protection Regulation (GDPR), which contains the obligation to inform the affected person. However, since there were also previously duties to inform contained in the Federal Data Protection Act, the Federal Labour Court (Bundesarbeitsgericht, “BAG”) will probably continue to uphold the known case law. The BAG allowed undercover monitoring within narrow limits. This was assumed, for example, in the absence of other possibilities for gathering evidence for a criminal offence or other severe violations of the employment contract by the employee.
3. Obligation to pay compensation for unlawful GPS monitoring
Irrespective of the possible fines under the GDPR, in the event of serious violations of the general right of personality by GPS monitoring, monetary compensation payable to the affected employee is possible.
In general, in the case of serious violations of personal rights, the payment of compensation under contract law or tort law may be considered. The right of personality is derived from the dignity of the human being, among other things (Article 1.1 of the Basic Law). Such a claim presupposes that the impairment cannot be satisfactorily compensated in any other way. The granting of monetary compensation in the case of a serious violation of personality rights is based on the idea that without such a claim violations of human dignity and honour would often remain without sanction with the consequence that the legal protection of personality would wither away. This compensation regularly focuses on the satisfaction of the victim and on prevention. Whether such a serious violation of the right of personality exists, which makes monetary compensation necessary, must be considered based on the overall circumstances of the individual case. In this context, the significance and scope of the intervention, the reason and motive for the action as well as the degree of culpability are to be considered (BAG 19 February 2015 – 8 AZR 1007/13). The amount of compensation is also determined by the intensity of the intervention. Case law on GPS monitoring and the associated obligation to pay compensation is still awaited. In any case , in the case cited, the BAG has awarded, for instance, an employee compensation in the amount of EUR 1,000 because the employee was observed by a detective for four days during her sick leave and was also recorded with a camera.

Greece (Effie Mitsopoulou, Effie Mitsopoulou Law Office): Such an issue on the use of a GPS system in a company car has not to our knowledge yet reached the Supreme Court of Greece. It has however, on several occasions, been brought before the Greek Data Protection Authority following complaints made by employees. The Greek Data Protection Authority in its most recent decision (37/2019) has defined the conditions under which the use of such a system is allowed, namely that the legality of the processing of personal data through a GPS system is evaluated in the framework of the legitimate purpose sought by the company and on the basis of the principle of proportionality, and always with prior notification given to the affected employee(s). In the case under consideration the operation of the GPS system had not been limited strictly to the working hours schedule, and the employee had not been notified in advance about such GPS installation and the relevant processing of his personal data. The Data Protection Authority issued a recommendation for compliance by the company but did not impose a fine, given that the company had already notified the Authority about the GPS implementation.
Civil courts in Greece would most probably adopt a similar position to the Austrian Supreme Court’s one. In such a direction, a recent decision (Piraeus Court of Appeal’s decision no. 328/2018) has awarded EUR 5,800 as moral damages due to the violation of privacy to the owner of a flat who had been under CCTV surveillance by his next door neighbours through the installation of cameras in the common areas of the building.

Romania (Andreea Suciu and Gabriela Ion, Suciu I The Employment Law Firm): Our legislation does not provide for an obligation on an employer to conclude an agreement with a competent works council – or an agreement with every single employee if the employer wants to implement or change a GPS system in its company cars.
The processing of personal data by a GPS system may be done based on legal grounds provided by Article 6 of the General Data Protection Regulation. If the processing of personal data is based on a legitimate interest, additional conditions are required as follows: the employer must (a) perform a legitimate interest analysis; (b) provide mandatory, complete and explicit prior information to employees; (c) consult the union or the employees’ representatives before the introduction of the monitoring systems; (d) prove that other less intrusive forms and ways of achieving the goal pursued by the employer have not previously proven their effectiveness; and (e) store the personal data proportional to the purpose of processing, but for not more than 30 days, except for situations expressly regulated by law or duly justified cases.
Similar to the Austrian Data Protection Authority, the Romanian Data Protection Authority established by Decision no. 174/2018 that the controller must perform a Data Protection Impact Assessment (DPIA) when they pursue large-scale and/or systematic processing of traffic and/or location data of natural persons (such as Wi-Fi monitoring, processing of geographic location data of passengers on public transport or other similar situations) when processing is not necessary for the provision of a service requested by the data subject. The DPIA is not mandatory when the processing is performed on the basis of a controller’s legal obligation or for the performance of a task which serves a public interest or which results from the exercise of an employer’s public authority.
However, we may assume that GPS monitoring may be carried out by the employer only during working hours. Monitoring the employee’s location in his/her spare time on the basis of legitimate interest could interfere with the employee’s right to privacy if the employer’s legitimate interest is not well founded.
Even if no court decision has been issued in this regard so far, we consider that non-compliance with the obligations provided by law can trigger fines for the employer and an obligation to pay damages to the unlawfully monitored employee.

Subject: Privacy
Parties: Anonymous
Court: Austrian Supreme Court
Date: 21 January 2020
Case number: 9 ObA 120/19s
Internet publication: https://www.ris.bka.gv.at/Dokument.wxe?ResultFunctionToken=c203b286-18dd-42a1-b9fe-933972d853c6&Position=1&SkipToDocumentPage=True&Abfrage=Justiz&Gericht=&Rechtssatznummer=&Rechtssatz=&Fundstelle=&AenderungenSeit=Undefined&SucheNachRechtssatz=True&SucheNachText=True&GZ=9oba120%2f19s&VonDatum=&BisDatum=02.07.2020&Norm=&ImRisSeitVonDatum=&ImRisSeitBisDatum=&ImRisSeit=Undefined&ResultPageSize=100&Suchworte=&Dokumentnummer=JJT_20200122_OGH0002_009OBA00120_19S0000_000