(vi) the employer shall not undertake a permanent and systematic control of its
employees’ access to the internet;
(vii) any limitations on employees’ use of the internet shall be done in a global
way, i.e., not individualized, in relation to all accesses within the employer’s
organization, with reference to the web connection time; and
(viii) the employer is entitled to process data about the most visited websites, but
without identifying the place of origin of the access. A certain level of
tolerance is expected in relation to employees’ use of the internet for private
purposes, in particular if the use occurs outside working hours.
The Portuguese DPA adopted Decision no. 7680/2014,
6 concerning the
processing of personal data collected by geolocation technologies in a labour
context. According to the Comissão Nacional de Proteção de Dados:
(i) the technology of geolocation, notably GPS devices, processes personal data in
a way that may affect private life;
(ii) by using remote control devices, it could be possible for employers to develop a
permanent control of employees, during their working time and even in their
leisure time;
(iii) the consent given by employees is not, in general, relevant to authorize the
processing of personal data by employers because it is not considered as being
free in the context of a labour contract; and
(iv) personal data collected by geolocation technologies cannot be used in order to
evaluate the performance of an employee (Article 20 of the Portuguese
Labour Code).
Some courts, however, have a different perspective.
The Supreme Court of Justice (Supremo Tribunal de Justiça) decided that data
collected by GPS devices is not considered as being the object of “distance surveillance” because this expression is only applicable to CCTV cameras (ruling of the
Supremo Tribunal de Justiça of 13 November 2013).
7
The Court of Appeal of Guimarães decided that data collected by GPS devices
cannot be used for the purposes of evaluating the performance of employees but may
be used in disciplinary proceedings (ruling of 3 March 2016).
8
Law no. 41/2004 contains several rules on data breaches and the security of
personal data processed by electronic means.
According to Article 3, companies that make electronic communications services
accessible to all must adopt all appropriate technical and organizational measures to
protect personal data (section 1).
6 https://www.cnpd.pt/bin/orientacoes/DEL_7680-2014_GEO_LABORAL.pdf.
7 http://www.dgsi.pt/jstj.nsf/954f0ce6ad9dd8b980256b5f003fa814/
e32eab3444364cb980257c2300331c47?OpenDocument.
8 http://www.dgsi.pt/jtrg.nsf/86c25a698e4e7cb7802579ec004d3832/
302fdd824b16519780257f85004f8071?OpenDocument.
276
A. S. Pinheiro
employees’ access to the internet;
(vii) any limitations on employees’ use of the internet shall be done in a global
way, i.e., not individualized, in relation to all accesses within the employer’s
organization, with reference to the web connection time; and
(viii) the employer is entitled to process data about the most visited websites, but
without identifying the place of origin of the access. A certain level of
tolerance is expected in relation to employees’ use of the internet for private
purposes, in particular if the use occurs outside working hours.
The Portuguese DPA adopted Decision no. 7680/2014,
6 concerning the
processing of personal data collected by geolocation technologies in a labour
context. According to the Comissão Nacional de Proteção de Dados:
(i) the technology of geolocation, notably GPS devices, processes personal data in
a way that may affect private life;
(ii) by using remote control devices, it could be possible for employers to develop a
permanent control of employees, during their working time and even in their
leisure time;
(iii) the consent given by employees is not, in general, relevant to authorize the
processing of personal data by employers because it is not considered as being
free in the context of a labour contract; and
(iv) personal data collected by geolocation technologies cannot be used in order to
evaluate the performance of an employee (Article 20 of the Portuguese
Labour Code).
Some courts, however, have a different perspective.
The Supreme Court of Justice (Supremo Tribunal de Justiça) decided that data
collected by GPS devices is not considered as being the object of “distance surveillance” because this expression is only applicable to CCTV cameras (ruling of the
Supremo Tribunal de Justiça of 13 November 2013).
7
The Court of Appeal of Guimarães decided that data collected by GPS devices
cannot be used for the purposes of evaluating the performance of employees but may
be used in disciplinary proceedings (ruling of 3 March 2016).
8
Law no. 41/2004 contains several rules on data breaches and the security of
personal data processed by electronic means.
According to Article 3, companies that make electronic communications services
accessible to all must adopt all appropriate technical and organizational measures to
protect personal data (section 1).
6 https://www.cnpd.pt/bin/orientacoes/DEL_7680-2014_GEO_LABORAL.pdf.
7 http://www.dgsi.pt/jstj.nsf/954f0ce6ad9dd8b980256b5f003fa814/
e32eab3444364cb980257c2300331c47?OpenDocument.
8 http://www.dgsi.pt/jtrg.nsf/86c25a698e4e7cb7802579ec004d3832/
302fdd824b16519780257f85004f8071?OpenDocument.
276
A. S. Pinheiro