It is the first objection that comes up whenever mobile clock-in is proposed: “isn’t this surveillance?”. And it is a fair objection, because there are ways of doing it that genuinely are unlawful.
The short answer: GPS clock-in is lawful, but only if the system is designed to capture the minimum data at the minimum moment. The difference between compliance and exposure is not whether you use GPS — it is what you store and for how long.
The line that divides everything
Two things sound similar and are legally very different:
Validating where someone clocks in. At the instant the person taps “clock in”, the system checks whether they are inside the perimeter of their workplace. It stores the result of that check. One data point, at one moment, for one purpose.
Knowing where someone is. The device reports its position continuously or periodically throughout the day, and the employer accumulates a trail of movements.
The first is proportionate to the purpose of recording working time. The second exceeds that purpose, and therefore finds no cover in it. If your vendor does not clearly distinguish between the two, that is the warning sign.
What supervisory authorities examine
Proportionality
This is the central test. The processing must be adequate for the purpose, necessary — no less intrusive alternative should exist — and balanced between the employer’s interest and the individual’s rights.
In practice: if you can evidence working time by capturing location only at clock-in, you cannot justify capturing it every fifteen minutes.
Prior information
The employer does not need consent. This surprises many people, but it is coherent: in an employment relationship consent is not considered freely given, because of the dependency between the parties. The legal basis lies in compliance with employment obligations and the employer’s legitimate interest.
What is mandatory is informing staff in advance, expressly and unambiguously: what data is processed, for what purpose, on what legal basis, how long it is retained and how to exercise their rights. That information must also reach worker representatives.
Without prior information the processing is unlawful, however proportionate it may be.
Time limitation
Capture may only occur within working hours. Outside the working day the employer has no legitimate interest and the worker has no expectation of being located. An app that keeps reading position after someone has finished work is a problem, even if nobody looks at the data.
Minimisation
Store the minimum you need for the purpose. In a well-designed clock-in, what you need is that the validation succeeded, not exact coordinates. A system retaining latitude and longitude to metre precision for four years is keeping far more than any inspection will ever ask for.
Where it fits and where it does not
Supervisory authorities have considered geolocation particularly justified where there is no fixed workplace. That is exactly the case for:
- Site workers rotating between projects
- Field technicians and maintenance staff
- Sales teams on the road
- Companies with several premises where it matters which one someone attends
- Presence on temporary sites with no installed clock-in system
Where it fits badly is a single-site office with fixed desks: there, geolocation rarely passes the necessity test, because less intrusive and equally effective alternatives exist.
Designing a system that does not expose you
These are the technical decisions that make the difference. They are the same ones we apply when we build tools of this kind:
Geofencing instead of coordinates. The device calculates whether it is inside the perimeter and sends the result. The server stores “valid clock-in at site A”, not a point on a map. Less data, less risk, same usefulness.
Point-in-time capture, not background. The position is read when the button is pressed. The app does not need background location permission, and not requesting it is in itself a verifiable safeguard.
Defined retention periods. Working time records are kept for years because employment law requires it. The location validation data does not automatically have to inherit that period if keeping it is not necessary.
Role-based access control. Not everyone needs everything. A site manager needs their site; HR needs the totals; almost nobody needs geographic detail.
Transparency towards the individual. Letting workers consult their own entries is not just a right: it is what makes the system defensible. The working time reforms under way across several countries reinforce exactly this point by requiring immediate remote access.
Mistakes that get expensive
In order of frequency:
- Enabling continuous tracking “just in case”. Nobody looks at it, but the processing exists and is disproportionate.
- Not informing, or informing with a generic clause buried in the contract.
- Using the data for another purpose. Collecting location to clock in and later using it in a disciplinary case changes the purpose of processing and usually invalidates the evidence.
- Skipping a risk assessment when the processing affects the whole workforce systematically.
- Delegating responsibility to the vendor. The employer is the controller. A third-party tool does not transfer that responsibility.
In summary
GPS clock-in is not a legal problem in itself. It becomes one when the system captures more than necessary, for longer than necessary, without anyone having explained it beforehand.
If the design answers “where they clock in” rather than “where they are”, most of the risk disappears by construction.
If you are working through full compliance, the guide to working time records in construction covers the remaining obligations, and construction software gives you the sector picture.
This article is indicative and does not constitute legal or data protection advice. Consult your data protection officer or legal adviser before deploying a geolocation system.