- Enforcing jurisdiction
- Greece · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
DPA case 7/2024 – Complaint Upheld (Greece, 2024)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A former employee complained that their old employer tracked their vehicle's location outside of work hours without proper notice. The Hellenic Data Protection Authority found that the employer's tracking practices might not have been lawful. This case highlights the importance of informing employees about how their data is used.
What happened
The former employee claimed that their employer unlawfully tracked their vehicle's location outside of working hours.
Who was affected
The former employee whose vehicle was tracked by the employer's geolocation system.
What the authority found
The authority noted that monitoring employee locations outside work hours may lack a legal basis under GDPR due to the sensitivity of such data.
Why this matters
This case emphasizes the need for companies to be transparent about data tracking practices. Employers should ensure they have a valid legal basis for monitoring employees' locations.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A former employee (data subject) submitted a complaint to the Hellenic DPA (HDPA) on 8 November 2018 against its former employer, company "X" (the controller), claiming that the latter unlawfully operated the geolocation tracking system installed on the vehicle provided by the controller. The data subject complained that the controller used data from the geolocation tracking system to track the vehicle outside of working hours and that the data subject had not been adequately informed about this data processing. The controller argued that the purpose of the tracking was to ensure the safety and protection of the employee's and company's vehicles and cargo. The tracking helped verify routes and ensure that the schedule set by the supervisors was followed. The controller stated that after being informed orally about how the geolocation tracking system works, the data subject freely considered the given options. The controller also claimed that the data subject didn't oppose the installation of the geolocation device and also agreed to it. The controller noted that the data subject signed the car delivery protocol on 5 March 2015, which explicitly mentioned the geolocation tracking device. Additionally, the controller referred to a court decision that had found no illegality regarding the controller's operation of the geolocation tracking system. The HDPA first considered the guidance from Opinion 2/2017 of the Article 29 Working Party, emphasising that monitoring employees' vehicle locations outside working hours may lack a legal basis due to the sensitivity of such data. However, to the extent that monitoring is necessary, it must be proportional to the risks, such as recording location only when vehicles leave predefined areas to prevent theft. Additionally, employers should only access location data in emergencies, and controllers must demonstrate GDPR compliance, including maintaining appropriate documentation. Additionally, the HDPA also took into consideration
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 7/2024 in GR
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 7/2024 - Greece (2024). Retrieved from cookiefines.eu
Last updated: