Can you track equipment with employees' phones under GDPR?

Using staff phones to read equipment tags is efficient. It is also a fair question for any employee: if my phone reports what it hears, does my employer know where I am all day?

The answer depends on how you set it up. Below is what GDPR generally asks of an employer in this situation, and how to set up phone-based tracking that respects it. It is general guidance. For your own setup, talk to your data protection officer or legal adviser.

Track equipment, not people

The key choice is what the phone reports.

• Tag sightings only. The phone reports which tags it heard. Hirro places the asset in a zone. Nothing is stored about the person carrying the phone.
• Tag sightings and phone location. The phone also reports its own position. That can help, for example for lone-worker safety, but it is personal data about the employee and needs a clear reason.

Hirro supports both. You set the mode per company or per team. Many employers start with tag sightings only, because it answers the equipment question without touching the employee question.

What GDPR generally asks

A lawful basis

Most employers rely on legitimate interest (Article 6(1)(f) GDPR) for equipment tracking: knowing where company assets are is a reasonable business need. That basis requires you to weigh your interest against the privacy of staff, and the lighter the data you collect, the easier that balance is. The EU data protection authorities explain how that balance works for monitoring at work in Opinion 2/2017 on data processing at work.

Collect only what you need

Data minimisation (Article 5(1)(c)) means collecting what the purpose needs and no more. If the purpose is “where is the breaker”, tag sightings only is the natural fit.

Tell people

Staff need to know what the app does, what it reports, who sees it and how long it is kept (Articles 13 and 14). A short, plain notice works better than a long policy nobody reads.

Check whether you need a DPIA

A data protection impact assessment (Article 35) is required when processing is likely to pose a high risk, and systematic monitoring of employees can fall under that. If you report phone locations, plan for one. Your data protection officer can tell you whether tag sightings only also needs one in your case.

Follow national employment rules

Article 88 lets member states set extra rules for data at work. In several countries that means involving the works council or employee representatives before you introduce new monitoring tools.

A rollout that works

1. Decide the purpose in one sentence, for example “find equipment on our yards and sites”.
2. Choose the privacy mode that fits that purpose.
3. Write a one-page notice for staff: what the app does, what it reports, who sees it.
4. Agree the mode with your works council or employee representatives where that applies.
5. Sign the data processing agreement with your supplier.
6. Review after a few months, and adjust the mode if the purpose changes.

Where the data lives

Hirro hosts its data on AWS in the European Union. Every customer signs a standard data processing agreement, under which Hirro processes data only on your instructions. We are working toward ISO 27001.

Questions

Is it legal to track equipment with employees' phones under GDPR?

It can be, when the purpose is tracking equipment and you limit what is collected, inform staff, and have a lawful basis such as legitimate interest. Check your setup with your data protection officer or legal adviser.

Does Hirro track where employees are?

Only if you choose to. The app can report tag sightings only, so you see where assets are and nothing about the person carrying the phone. If your policy allows it, you can also report the phone's location.

Where is the data stored?

Hirro hosts its data on AWS in the European Union, and every customer signs a data processing agreement.

Next step See how Hirro tracks equipment with tags and phones.

All posts