To verify whether the said conditions are met, the controller must carry out Data Protection Impact Assessment (DPIA).
In the presented Case study, our Partners Ivan Milošević and Jelena Nikolić, together with Senior Associate Andrea Cvetanović, describe a process in which the Controlling company intends to install the application on companies’ mobile phones used by terrain employees, to enable electronic measurement of working hours of employees and record their planned and performed activities.
The study provides a comprehensive analysis of the case and answers whether the intended business goals and purposes of processing are legitimate under applicable labour regulations, as well as whether the intended processing of personal data is absolutely necessary and proportional to achieving intended business goals or, the business goal and proposes of processing can be achieved by less intrusive measures.
Our complete Case Study is available HERE.