French Supreme Court (Mar 18, 2026) — Geolocation and working time

Verifiable fact. On 18 March 2026, the French Supreme Court (Social Chamber, No. 24‑18.976) allowed the use of a geolocation system to control working time where employees lack freedom to organize their schedules and no other « objective, reliable and accessible » means exists. See the decision on Légifrance.

The case

An employer used a tool recording distributors’ positions « every ten seconds » during rounds to monitor working time. The Court upheld lawfulness because (i) employees had no real autonomy over their schedules and (ii) no alternative could provide an « objective, reliable and accessible » control as required by C‑55/18 (CCOO), based on Directive 2003/88/EC and Framework Directive 89/391/EEC.

Legal reasoning

• Proportionality and necessity. French Labor Code L.1121‑1 (proportionality of restrictions) is interpreted in light of C‑55/18: where working-time control is required, the employer must use an « objective, reliable and accessible » system. Geolocation is lawful only if necessary (no practicable alternative) and if the employee does not freely organize their time. Reference: Cass. soc., 18 March 2026.
• GDPR legal basis and minimization. Consent is generally invalid in employment (power imbalance); legitimate interest (Art. 6(1)(f) GDPR) is the typical basis, subject to necessity/balancing tests and safeguards (off-hours deactivation, limited granularity). See EDPB 05/2020. For Luxembourg compliance artifacts, see GDPR obligations (records and DPIA).
• Mobility data: EDPB requirements. The « connected vehicles and mobility » guidelines require strict data minimization, purpose separation, and privacy-protective defaults: EDPB 01/2020.
• Luxembourg: DPIA mandatory. The CNPD lists geolocation as a typical DPIA case (tracking individuals) under Article 35(4) GDPR: CNPD — DPIA. A certified DPO mandate can help structure the assessment and governance.

What this changes in practice (Luxembourg)

1. Primary, documented purpose. Working-time control is legitimate if you prove lack of employee autonomy and the absence of any other « objective, reliable and accessible » method (badging, self-declaration app, tooled scheduling). Embed the C‑55/18 criteria in your necessity analysis and DPIA. Reference: 18/03/2026 decision.
2. GDPR legal basis. Prefer legitimate interest (Art. 6(1)(f)), backed by a robust balancing test (continuous tracking risks, disciplinary effects). See EDPB 05/2020.
3. DPIA mandatory. Expect to justify proportionality (areas, sampling frequency — avoid « every 10 s » if 1–2 min suffice), automatic off-hours/zone deactivation, and minimized access. Reference: CNPD — DPIA. For local expertise, consult our Luxembourg DPO.
4. Technical settings (privacy by design). Log only within working windows, provide a « private pause », strictly separate purposes (HR ≠ safety/marketing), and audit access logs. See EDPB 01/2020.
5. Transparency and rights. Provide specific information (period/frequency, purposes, legal basis, retention, potential disciplinary criteria) and enable rights (reasonable history access, sensor error rectification). Maintain Art. 30 records and retention policy.

Frequent pitfalls

• Confusing « effectiveness » with « necessity ». A merely « less effective » alternative cannot be discarded; document alternatives and technical reasons for unsuitability (see Cass. soc., 18/03/2026).
• Employment-context consent. Acceptance banners rarely yield valid consent due to imbalance (see EDPB 05/2020).
• Intrusive default settings. Excessive sampling, off-hours tracking, no « private pause » violate by design/by default principles (see EDPB 01/2020).
• Thin DPIAs. Avoid copy‑paste DPIAs lacking necessity/legitimacy tests and abuse scenarios; CNPD expects a contextualized DPIA (Art. 35(4) list).
• Lack of effectiveness evidence. Without access logs and internal audits, you cannot demonstrate proper authorizations or timely deletion.

Bottom line

The 18 March 2026 ruling offers an exacting operational framework to justify geolocation for working-time measurement: legitimate interest as legal basis, documented DPIA, EDPB‑compliant settings, enhanced transparency, and verifiable access controls. For hands‑on support, contact us.

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.