Commission d’access a la information du Quebec has issued guidance on employee geolocation tracking.

Here are some key takeaways:

• Unless the law expressly provides for it, a company may not require a person to be tied to a device that makes it possible to know where he is.
• Without obtaining valid consent from its employees, an employer cannot require them to use a geolocation-based application.
• Consent must be manifest, free, informed and given for specific purposes and for the time necessary to achieve the purposes for which it was requested. In particular, for it to be free, it must be possible to refuse without incurring consequences.
• A good way to promote free consent is to offer staff an alternative to using an application that uses geolocation to record the arrival and departure times of employees.
• Even with valid consent from its employees, the employer should collect only the personal information necessary to achieve its objectives. The fact that information is useful does not necessarily make it necessary to collect it.
• An employer must demonstrate that the intrusion into the privacy of its employees is proportional to the objective pursued or to the problematic situation that it wishes to counter.
• Each situation is unique. The employer is responsible for carrying out a serious analysis according to his context in order to be able to demonstrate that it is necessary for him to collect geolocation data.
• Remember that in case of doubt, the collection of personal information is deemed unnecessary.

If the collection of geolocation data from its employees is necessary, an employer will have to comply with other obligations. It must:

• Inform its employees of the collection and the use that will be made of the information, the categories of people who will have access to it within the company and their rights of access and rectification.
• Ensure the personal information is up to date and accurate.
• Put in place appropriate security measures to ensure the protection of personal information.
• Destroy personal information in a secure manner as soon as the purpose for which it was collected is fulfilled, subject to the time limit provided by law (e.g. for tax obligations).

[View source.]