Time tracking and data protection: what is permitted

The legal basis

For time tracking itself, two bases come into consideration: Article 6(1)(b) GDPR, because the processing is necessary for performing the employment contract, and Article 6(1)(c) GDPR, because there is a legal obligation.

Consent should not be relied on. In an employment relationship its voluntariness is doubtful, and it can be withdrawn at any time. A mandatory task must not depend on whether somebody agrees.

Caution is called for as to the role of section 26 BDSG: on 30/03/2023 the European Court of Justice ruled (C-34/21) that a state-law provision with this wording does not meet the requirements of the opening clause in Article 88 GDPR. Anyone wanting certainty bases the processing on Article 6 GDPR and uses a works agreement as a supplementary basis under Article 88(2) GDPR.

Purpose limitation and data minimisation

What may be recorded is what is necessary for the purpose: the start, the end, the breaks, the absence type. What is not necessary is the exact location, the applications used, the number of keystrokes or the duration of individual operations.

The purpose is fulfilling the record-keeping duty, payroll and compliance with the Working Hours Act. An evaluation assessing the performance of individuals is not covered by that and should be expressly excluded in the works agreement.

GPS, fingerprints and cameras

Biometric data such as fingerprints or facial recognition are special categories of personal data (Article 9 GDPR). Processing them is in principle prohibited and permitted only under narrow conditions. For ordinary time tracking the necessity is absent where a badge or a PIN serves the same purpose. Several supervisory authorities and labour courts have therefore prohibited biometric time tracking.

Location data is permitted where it is necessary for the purpose, for instance on assembly or field work to demonstrate the place of work. Continuous tracking throughout working time, let alone beyond it, is not.

The same line applies to cameras and software that watches the screen: permanent monitoring is impermissible, because it creates pressure that is out of proportion to the purpose.

• A badge or a PIN instead of a fingerprint, where both serve the same purpose.
• Location only where the place of work has to be demonstrated, and only at the moment of the booking.
• No continuous tracking, no screen monitoring, no activity measurement.

Deletion periods

Deletion happens as soon as the purpose ceases and no retention duty remains. In practice that means: two years under section 17 MiLoG where applicable, and the tax periods from section 147 AO where the data forms the basis of payroll, so eight years for accounting vouchers.

Retention "just in case" is not a legal basis. The periods belong in the record of processing activities under Article 30 GDPR and in the works agreement, and they should be configured in the system.

Duties that are easily overlooked

Information under Article 13 GDPR: employees have to be told which data is processed for which purpose on which basis, for how long and who receives it. A short employee notice is enough.

A data processing agreement under Article 28 GDPR with the software provider, including a list of sub-processors.

A record of processing activities under Article 30 GDPR. A data protection impact assessment under Article 35 GDPR is usually not required for pure time tracking, but regularly is for location data or biometric features.

And the question that always comes up in the works council: where does the data sit and who runs the servers. A data centre in Germany does not remove the data from US law where the operator belongs to a US group.