The use of geolocation systems and telematics monitoring in the workplace is one of the issues that raises the most questions for companies and HR managers, especially when the devices used are company-owned.
For years, the prevailing interpretation seemed clear. However, the evolution of case law particularly the influence of the Court of Justice of the European Union, is now reshaping the limits of employer monitoring in a significant way.
The Telepizza Precedent and the Constitutional Court
The judgment of the Spanish Constitutional Court dated 8 February 2021, which declared Telepizza’s “Tracker” project to be unlawful, is well known among labour law practitioners.
This internal project required employed delivery drivers to install an application on their personal mobile phones in order for the company to geolocate its workforce.
At an initial stage, the Spanish Supreme Court held in Judgment No. 766/2020 that the employer’s conduct was fully lawful. With regard to the more or less sensitive nature of geolocation data, the Supreme Court stated that such data “do not allow any circumstances relating to the individuals concerned to be captured, nor does their use reflect nor is it capable of reflecting, any personal circumstances”, thereby ruling out any infringement of the right to privacy, as they “are limited to location data and vehicle movements”.
However, once the Supreme Court’s decision was appealed, the case reached the Constitutional Court, which overturned the ruling and declared the obligation imposed by the company null and void. This is essentially on the grounds that the employer could not compel employees to use their own personal devices.
What if the phone is company-owned?
As might be expected, many legal scholars inferred by reasoning a contrary that the geolocation of employees would be permissible provided that it was carried out exclusively through devices owned and provided by the company.
This interpretation led many companies to assume that ownership of the device automatically legitimized the monitoring of an employee’s location.
However, this assumption is now beginning to falter.
The CJEU’s shift and geolocation as sensitive data
At present, and in light of the interpretation of the CJEU judgment of 6 November 2025 in Guyvan v. Ukraine, together with the emergence of technologies that significantly expand data-processing capabilities such as Artificial Intelligence and other neurotechnologies, geolocation data may, per se, constitute an interference with an employee’s right to privacy.
In that case, the employer had informed employees that the corporate tools made available to them could be monitored.
In this context, the company detected that an employee had made international roaming calls, which led the employer to request detailed call records from the telecommunications provider relating to the phone assigned to that employee. A few days later, the employee was dismissed for unjustified absences.
The CJEU’s position versus the traditional doctrine
According to the traditional doctrine of the Constitutional Court, employer monitoring does not infringe any rights when it is carried out using company-owned devices.
However, the CJEU takes a different view. From its ruling, the following conclusions can be drawn:
Geolocation data do qualify as personal data, since even when they relate to working time and/or workplace location, they may contain or reveal other sensitive information capable of identifying traits, ideology, religion, habits, customs, preferences, or behavioural patterns from which personal characteristics may be inferred.
The CJEU itself acknowledges that, although a single data point might appear to be of limited relevance when considered in isolation, the use of Artificial Intelligence allows virtually any data to be exploited in order to generate enriched information through inferences derived from the combination of multiple data sources.
Employer obligations: information and proportionality
Consequently, the fact that monitoring is carried out exclusively through company-owned devices does not exempt the employer from complying with:
(i) the duty to provide prior information.
(ii) the proportionality test (appropriateness and necessity) required to assess the lawfulness of such monitoring, as established in the Bărbulescu and López Ribalda case law.
As regards the outcome of applying these criteria, in light of the CJEU’s reasoning:
The duty to provide prior information was breached, inter alia, because although employees were informed of the possibility of monitoring, no clear information was provided regarding the specific disciplinary consequences. The scope of the monitoring, or the possibility of resorting to an external source, namely, the telecommunications provider.
Likewise, the proportionality test (appropriateness and necessity) was not satisfied, as the means used did not meet the necessity requirement. Location data are not sufficiently precise to verify whether the employee is actually at their workstation, and other, less intrusive and more appropriate measures were available.
The impact of Artificial Intelligence on workplace monitoring
In conclusion, telematic monitoring of employees is set to undergo a profound transformation with the progressive implementation of Artificial Intelligence. The range of capabilities these technologies encompass emotional monitoring, hyperconnectivity, predictive analysis, among others, means that almost any employee-related data may qualify as personal data. This, in turn, triggers the safeguards required by the CJEU:
(i) clear and prior information
(ii) proportionality control (necessity and appropriateness).
Ownership of the device is no longer sufficient to legitimise any form of monitoring. Geolocation must now be analysed as potentially sensitive personal data, particularly in a context of large-scale data exploitation enabled by Artificial Intelligence.
Poorly designed monitoring systems may result not only in the exclusion of evidence, but also in the infringement of employees’ fundamental rights.
We advise companies and HR managers on the design and implementation of workplace monitoring and control systems, helping them assess when it is lawful to review an employee’s location even where the phone is company-owned, and how to do so in compliance with the criteria established by the Constitutional Court and the CJEU.
We review corporate device-use policies, privacy policies, prior information obligations, and proportionality tests, adopting a preventive approach aimed at avoiding labour disputes, evidentiary nullities, and sanctions for breaches of fundamental rights.
Contact our team to receive specialised advice and ensure the legal certainty of your workplace monitoring systems.
