Spain: Can an Employee’s Mobile Phone Location be Reviewed if the Phone is Company Property?

It is well known among labour law practitioners that the Constitutional Court Judgement of 8 February 2021 declared Telepizza’s “Tracker” project to be unlawful.

This internal Company project required delivery drivers to install an application on their personal mobile phones so that the Company could geolocate them.

At first instance, the Spanish Supreme Court held in its Judgement no. 766/2020 that the employer’s conduct was fully lawful and, regarding the more or less sensitive nature of geolocation data, stated that such data “do not allow any circumstances of their occupants to be captured, nor does their use reflect—nor have the capacity to reflect—any personal circumstance,” which led it to conclude that there had been no invasion of privacy, since they were “limited to data on the location and movement of the vehicle.”

However, the Supreme Court judgement was appealed and the case reached the Constitutional Court, which overturned the ruling and declared null and void the obligation that the Company sought to impose, essentially on the grounds that the Company could not force the employee to use their own personal means.

As a result, many legal practitioners, by negative implication, understood that it was possible to geolocate employees provided that geolocation was carried out using means owned exclusively and predominantly by the Company.

However, it appears that at present, interpreting the CJEU Judgement of 6 November 2025, Case Guyvan v. Ukraine, together with the emergence of other technologies that expand data-reading capabilities—Artificial Intelligence and other neurotechnologies—geolocation data may, in and of themselves, constitute an infringement of the employee’s sphere of privacy.

In that case, the Company informed employees that the corporate tools made available to them could be monitored.

In this context, the Company noted that an employee had made international roaming calls, which led the Company to request detailed information from the telecommunications provider regarding the calls made from the employee’s phone. Days later, the employee was dismissed for unjustified absences.

It seems clear, under the doctrine of the Constitutional Court itself, that employer monitoring does not infringe any rights when carried out on tools owned by the Company.

However, the CJEU disagreed, and from its ruling the following conclusions can be drawn:

• Geolocation data ARE considered personal data because, even if they correspond to working time and/or place, they may contain other sensitive information defining traits, ideology, religion, customs, or even tastes or habits from which personality traits, ideology, etc. may be inferred.
  • The CJEU itself acknowledges that, although the data considered in isolation might be of limited relevance, Artificial Intelligence could extract any type of data to obtain enriched final information through data inference.

 

• Consequently, the fact that monitoring is carried out exclusively on Company-owned tools does not exclude the need for the Company to carry out: (i) prior information; and (ii) a proportionality test (appropriateness and necessity) to determine the legality of such employer action, derived from the application of the Barbulescu and López Ribalda cases.

 

• Regarding the outcome of applying the tests of (i) prior information and (ii) proportionality, the conclusions in light of the CJEU are as follows:
  • The duty of prior information was breached, among other reasons, because although monitoring was mentioned, clear information was not provided on the specific disciplinary consequences, the scope of the monitoring, nor was there any warning of the possibility of resorting to an external resource—the telecommunications provider.
  • The proportionality test (appropriateness and necessity) was also breached, since the means used for the intended purpose did not meet the necessity requirement (location data are not entirely precise to verify whether the employee is at the workplace, and there are other more suitable and less intrusive means).

In conclusion, telematic monitoring of employees is set to be completely transformed with the progressive implementation of Artificial Intelligence, since the possibilities and technologies it encompasses—emotional control, hyperconnectivity, etc.—turn almost any employee data into personal data, thereby triggering the safeguards articulated by the CJEU: (i) clear prior information; and (ii) proportionality control (necessity and appropriateness).