Geolocation in Clocking In: What the AEPD Says

Time tracking (control horario) is an unavoidable obligation for any SME with employees in Spain. Since the entry into force of Real Decreto-ley 8/2019, recording each worker's daily working hours (registro de jornada) is a legal requirement that admits no exceptions. In this context, technology offers advanced tools, and one of the most attractive, yet controversial, is geolocation. The possibility of knowing if an employee clocks in (fichar) within their designated workplace using a "geofence" (geofence) (a virtual fence on the map) may seem an ideal solution to guarantee the veracity of the record. However, what exactly does the Spanish Data Protection Agency (AEPD) say about it? Is it legal to geolocate your workers? The answer, as almost always in the legal field, is not a simple yes or no, but is framed within a delicate balance between the legitimate interest of the company and the fundamental rights of the worker.

What is geolocation in time tracking and why is it relevant to you?

Geolocation, applied to time tracking, allows determining the location of a device (normally a smartphone or tablet) at the exact moment a clocking in is performed. In practice, this translates into systems that record not only the entry and exit time, but also the place from which the record was made. One of its most common applications is called "geofencing".

Geofencing consists of defining a virtual geographical area around a specific point, such as your office, your store, or your restaurant. When an employee tries to clock in through the time tracking application, the system verifies if their device is within that virtual perimeter. If it is inside, the clocking in is considered valid and is recorded normally. If it is outside, the system can, depending on its configuration, block the clocking in, mark it as "suspicious," or simply record the actual location.

For you, as an SME owner or manager, this functionality may seem a guarantee that clocking in is done in the correct place, especially if you have employees working in different locations or if you want to ensure physical presence at the workplace. It can help you prevent fraud, optimize team management, and have a more precise view of compliance with working hours. However, the implementation of this technology must be done with a deep understanding of data protection and labor regulations, to avoid incurring serious infractions.

The Spanish Regulatory Framework: A Delicate Balance

The use of geolocation systems in the workplace in Spain is subject to a double layer of regulation: labor and data protection. Both must be scrupulously respected.

On the one hand, labor regulations, mainly art. 34.9 ET (Estatuto de los Trabajadores (Spanish Workers' Statute)), establish the company's obligation to guarantee the daily record of each worker's working hours, which must include the specific start and end times of the working day. This record must be reliable and accessible. Geolocation can be a tool for this, but not at any cost.

On the other hand, and here lies the greatest complexity, we have data protection regulations: the Reglamento General de Protección de Datos (RGPD) (General Data Protection Regulation) (Regulation (EU) 2016/679) and the Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD). These regulations protect worker privacy and require that any processing of personal data, such as location, comply with fundamental principles such as lawfulness, fairness, transparency, purpose limitation, data minimization, and proportionality.

The AEPD has issued clear criteria on the matter, the most relevant being the Guide «La protección de datos en las relaciones laborales» from the AEPD (published in May 2021 and subsequently updated), which dedicates a specific chapter to geolocation. This document is your roadmap to understanding how to apply geolocation without violating your employees' rights and without exposing yourself to sanctions.

The AEPD and the Principle of Proportionality: The Key to Using Geofencing

The principle of proportionality is the central axis around which all of the AEPD's doctrine regarding geolocation at work revolves. For the use of geolocation to be lawful, it must be a measure that is:

Suitable: Capable of achieving the proposed objective (e.g., verifying compliance with working hours or presence at the post).
Necessary: No other less intrusive measure exists that achieves the same objective with the same effectiveness.
Proportionate in the strict sense: The benefits for the company outweigh the sacrifice of workers' rights.

This is where the AEPD makes a crucial distinction between different types of jobs. A waiter is not the same as a sales representative.

Fixed Work Positions: When is it Justifiable?

For those job positions that are carried out exclusively or predominantly in a fixed and determined workplace, without inherent mobility in their functions, the AEPD is very strict. Think of a waiter, a store cashier, an office administrator, or a factory worker.

In these cases, pure geolocation (i.e., constant recording of the employee's GPS coordinates) is generally considered disproportionate. Why? Because there are less intrusive means to verify presence at the post and compliance with working hours, such as biometric clocking in systems, proximity cards, or applications with manual registration on fixed terminals.

However, the AEPD does open the door to the use of a geofence in these contexts, but with a very particular and restrictive interpretation. It is not about recording the worker's coordinates, but about registering a simple "flag" that indicates whether the clocking in was done INSIDE or OUTSIDE the perimeter established for the workplace. And even so, this measure is only justified if there is a real and concrete need on the part of the company to verify presence at the workplace and there are no equally effective less intrusive alternatives. For example, in a premises with several entrances or if clocking in is done from a personal mobile device.

The key lies in data minimization: geographical coordinates are not saved, only the validation of whether the clocking in location is inside or outside the defined area. This is the approach that Sincrio Fichaje recommends and facilitates with its "soft" geofence mode.

Mobile Work Positions: When is it NOT Justifiable?

For job positions that, by their very nature, involve constant mobility and outside a fixed workplace, the situation is different. We refer to sales representatives, field technicians, delivery drivers, transporters, maintenance personnel who move between different clients, etc.

Paradoxically, although logic might lead you to think that geolocation is more necessary here, the AEPD is even more cautious. The AEPD 2021 Guide states that the use of CONTINUOUS geolocation systems to control the productivity or itinerary of these workers is, in most cases, disproportionate and unlawful if the purpose is merely time tracking or control of work activity. The reason is that geolocation in these cases is perceived as an excessive interference in the worker's privacy and freedom of movement.

The AEPD admits geolocation for these positions only in very specific cases and with very specific purposes, different from time tracking or general activity, such as:

Occupational safety and health: To locate a worker in case of an accident or emergency.
Control of company resources: To verify the proper use of company vehicles or tools, but only during working hours and for very specific purposes.
Route optimization: To improve company efficiency, provided it does not involve constant tracking of the worker and data is minimized.

In any case, geolocation for these purposes must always be necessary, suitable, and proportionate, and always with the minimum indispensable data. For time tracking of these employees, other solutions are usually preferred, such as task-based clocking in, client-site clocking in, or manual recording of working hours.

The legal basis for processing geolocation data in the workplace is usually the legitimate interest of the company (Art. 6.1.f GDPR). To do this, you must carry out a balancing of interests, demonstrating that your interest in time tracking or security outweighs the impact on the worker's privacy. And, fundamentally, this legitimate interest must go hand in hand with the principle of data minimization (Art. 5.1.c GDPR).

Data minimization implies that you should only collect and store the data strictly necessary for the intended purpose. In the context of geofencing for time tracking, this means:

Do not save geographical coordinates: Sincrio's system, for example, does not store the exact latitude and longitude of the clocking in. It simply records a "YES" or "NO" to the question "Is the clocking in within the established perimeter?".
Do not perform continuous tracking: Geolocation is only activated at the moment of clocking in, not throughout the entire working day.
Limit access to information: Only authorized personnel (managers, HR) should have access to these location "flags" and only when strictly necessary to review incidents.

This "soft geofence" approach is the one that best aligns with the AEPD's doctrine and allows you to take advantage of the benefits of geofencing without crossing the red lines of privacy.

Requirements for Implementing Geolocation Legally and Securely

If you decide to implement a time tracking system with geofencing, such as the one offered by Sincrio Fichaje, you must comply with a series of unavoidable requirements to guarantee its legality and protect your SME from possible sanctions.

Clear and Contractual Information to the Employee

This is a NON-negotiable point. Article 5 of the GDPR establishes the principle of transparency. You must inform your employees clearly, in advance, and explicitly about the use of geolocation. This information must include:

What data will be collected: (e.g., an in/out of geofence flag, not exact coordinates).
For what purpose: (e.g., verifying presence at the workplace for time tracking).
Legal basis for processing: (e.g., legitimate interest of the employer).
Who will have access to that data.
How long the data will be retained.
The worker's rights: access, rectification, erasure, restriction of processing, objection, and data portability.

This information must be included in a specific clause in the employment contract or an annex thereto, as well as in the company's privacy policy. A general notice is not enough. The worker must perfectly understand what the geofencing system implies. The AEPD is very strict regarding lack of information or ambiguous information.

Data Protection Impact Assessment (EIPD)

The use of technologies that involve high-risk personal data processing, such as geolocation, requires the performance of a Evaluación de Impacto en la Protección de Datos (EIPD) (Data Protection Impact Assessment), as established by Article 35 of the GDPR. An EIPD is an exhaustive analysis to identify, assess, and mitigate risks to the rights and freedoms of data subjects (your employees) that data processing entails.

This assessment must include:

A systematic description of the processing operations and their purposes.
An assessment of the necessity and proportionality of the processing operations.
An assessment of the risks to the rights and freedoms of the data subjects.
The measures envisaged to address the risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data.

Performing an EIPD is not a mere formality; it is an essential tool to ensure that your geofencing system complies with regulations and to be able to demonstrate your diligence before the AEPD or the Spanish Labour Inspectorate (Inspección de Trabajo).

Data Minimization: Sincrio's 'Soft Geofence'

As we have mentioned, the principle of data minimization is critical. Sincrio Fichaje has designed its geofencing functionality precisely with this principle in mind. Our system does not record or store the exact GPS coordinates of your employees. Instead, when a worker clocks in through the mobile app:

The system detects their location at that instant.
It compares that location with the geofence perimeter you have defined for your workplace.
It records a simple "YES" (inside the perimeter) or "NO" (outside the perimeter) alongside the clocking in record.
It does not save geographical coordinates.

This "soft" approach allows the SME manager or owner to review clockings in marked with a "NO" (outside the perimeter) as potential incidents, without having access to the employee's precise location. The review of these "suspicious" cases is carried out manually by the manager, who may require the employee to provide justification if necessary. This guarantees effective control without disproportionate intrusion into privacy.

Technical and Organizational Security Measures

In addition to the above, you must implement robust security measures to protect your employees' data, as required by Article 32 of the GDPR. This includes:

Data encryption.
Access controls to ensure that only authorized personnel can view clocking in and geofencing information.
Regular backups.
Security audits.
Training of personnel who manage this data.

These measures are fundamental to prevent unauthorized access, data loss, or any other security breach that could compromise your employees' privacy.

Consequences of Misuse: Sanctions from the AEPD and the Spanish Labour Inspectorate

Ignoring regulations regarding geolocation or data protection can lead to serious consequences for your SME, both from the AEPD and the Spanish Labour Inspectorate.

Infractions in Data Protection (GDPR/LOPDGDD)

The AEPD is the body responsible for ensuring compliance with the GDPR and the LOPDGDD. Sanctions for non-compliance with these regulations are very high and are classified as:

Minor infractions (art. 74 LOPDGDD): minor formal defects. They are graduated according to the criteria of art. 76 LOPDGDD.
Serious infractions (art. 73 LOPDGDD): for example, not adequately informing the data subject or carrying out processing without a legal basis. Fines of up to 10 million euros or 2% of the global annual turnover, whichever is higher (art. 83.4 GDPR).
Very serious infractions (art. 72 LOPDGDD): for example, processing data without a lawful basis when explicit consent is required, or not performing a mandatory EIPD. Fines of up to 20 million euros or 4% of the global annual turnover, whichever is higher (art. 83.5 GDPR).

Disproportionate use of geolocation, lack of information to employees, or the absence of an adequate legal basis can be considered serious or very serious infractions, with the consequent economic and reputational impact for your company.

Infractions in Time Tracking (LISOS)

In addition to the AEPD's sanctions, the Spanish Labour Inspectorate (Inspección de Trabajo y Seguridad Social) can also impose fines if it detects irregularities in the time tracking system, even if these irregularities derive from an inadequate use of geolocation.

The Real Decreto Legislativo 5/2000, de 4 de agosto, por el que se aprueba el texto refundido de la Ley sobre Infracciones y Sanciones en el Orden Social (LISOS) (Spanish Statute of Labour Infractions and Sanctions), establishes:

Minor infractions (art. 6 LISOS): formal defects in the record that do not prevent verification of working hours. Fines between 70 and 750 euros.
Serious infractions (art. 7.5 LISOS): not recording working hours, not retaining records for four years, or not providing information to workers' legal representatives. This is the usual classification for not keeping a record of working hours. Fines between 751 and 7.500 euros.

If your geolocation system is so restrictive that it prevents or hinders the effective recording of working hours or if the information obtained is considered unlawful, it could lead to a serious infraction regarding time tracking, in addition to possible AEPD sanctions.

Practical Cases and Real Examples

To clarify the application of these principles, let's look at some scenarios:

Example 1: Hospitality with Justified Geofence

Situation: A restaurant with 15 employees (waiters, cooks, cleaning staff) uses the Sincrio Fichaje app on their personal smartphones to record working hours. The premises have several entrances, and employees sometimes clock in from the street or from areas near the establishment before entering.

Sincrio Fichaje Solution: A 50-meter geofence is configured around the restaurant. In the contractual clause and privacy policy, employees are informed that the system will verify if the clocking in is done within that perimeter, recording a "YES" or "NO". No coordinates are saved. If a clocking in is marked as "NO", the restaurant manager reviews the case. If it is recurrent or unjustified, the employee is spoken to to understand the situation and take measures. The AEPD would consider this proportionate, as the objective is to ensure presence at the fixed workplace, the measure is minimal (only a flag), and information is provided adequately.

Example 2: Service Company with Unjustified Geofence

Situation: A renovation company with 10 technicians who travel to clients' homes to perform work. The company wants them to clock in upon arrival at the client's home and upon leaving, and considers using constant geolocation to verify that they comply with routes and times for each service.

Problem: Constant geolocation for controlling the activity and routes of technicians is considered disproportionate by the AEPD for time tracking. Technicians have inherent mobility in their position, and continuous tracking is an excessive intrusion into their privacy. The company's purpose may be legitimate (optimizing routes, controlling productivity), but the measure is not strictly necessary, as less intrusive alternatives exist (clocking in at the start/end of service in the app, task-based clocking in, manual recording of kilometers or work reports).

Sincrio Fichaje Alternative: Technicians clock in at the start and end of their working day, and also at the start and end of each service at the client's home, from the app itself, but without continuous geolocation. If the location of the start/end of service is to be verified, a location "flag" can be recorded at that specific moment (soft geofence type), but not continuous tracking. The company must very well justify this need.

Example 3: Sincrio's "Soft" Approach in Action

Situation: A chain of clothing stores with several points of sale in a city. Store managers and sales assistants use their mobiles to clock in at the start and end of their working day. The area manager wants to ensure that clocking in is effectively done from the assigned store and not from home or another location.

Sincrio Fichaje Solution: A geofence is defined for each store. When an employee clocks in, the Sincrio Fichaje system verifies their location. If the employee is within their store's geofence, the record is marked as "Location: Inside". If they are outside, it is marked as "Location: Outside". The system does not save exact GPS coordinates. The area manager can view a consolidated report and, if they detect "Outside" clockings in recurrently or without justification (for example, an employee clocking in from home), they can open an internal investigation and request explanations from the employee. This approach is proportionate, respects privacy, and allows for effective control of presence at the fixed workplace.

Frequently Asked Questions

Is it mandatory to inform the employee about geolocation?

Absolutely yes. Transparency is a fundamental pillar of the GDPR. You must inform your employees clearly, in advance, and in writing (ideally in the contract or an annex) about the use of geolocation, its purpose, the legal basis, the data collected (or not), the retention period, and their rights.

Can I geolocate my employees outside of their working hours?

Absolutely not. Geolocation can only be used during working hours and for strictly work-related and justified purposes. Monitoring an employee's location outside of their working hours is a very serious intrusion into their privacy and is prohibited by data protection regulations.

What is the difference between geolocation and geofencing?

Geolocation is the ability to determine the location of a device. Geofencing is a specific application of geolocation that creates a virtual perimeter on a map. When a device enters or exits that perimeter, an action is triggered or an event is recorded. In time tracking, geofencing is used to verify if clocking in is done within a defined area, without necessarily recording exact coordinates.

What happens if an employee refuses to use the clocking in system with geolocation?

If the geofencing system is correctly implemented, is proportionate, and the employee has been adequately informed, their unjustified refusal could be considered a breach of their employment obligations. However, it is crucial that the company has offered clocking in alternatives if geolocation is disproportionate for their position or if the employee has a reasonable objection. The key is the proportionality and justification of the need for that measure for that specific position.

What data should I save if I use geolocation?

You must apply the principle of data minimization. If you use a "soft" geofencing system like Sincrio's, you do not need to save the exact geographical coordinates. It is sufficient to store an indicator (a "flag" or "YES/NO") that confirms whether the clocking in was done inside or outside the defined perimeter. Additionally, you must save the clocking in time, the employee identifier, and the date, as required by time tracking regulations.

Managing time tracking with geolocation legally and efficiently is possible, but it requires a deep knowledge of regulations and the choice of software that prioritizes privacy and data minimization. Ensure compliance in your SME and avoid fines with Sincrio's sanctions calculator: https://controlhorariopymes.es/calculadora-sanciones

Legal notice: This guide compiles public regulations and criteria from official bodies. It does not replace personalized legal advice for your specific case. We recommend consulting with a data protection and labor law expert for proper implementation.