The GPS on the wearable RFID for the pay as you throw waste collection and protection of the operator’s privacy
In the pay as you throw waste collection, the wearable devices for reading the RFID tags are fitted with GPS (Global Positioning System) to detect the coordinates – latitude and longitude – for the point where the collection occurs. The “tools from which even the possibility of remote control of workers’ activities” are quoted in Italian Legislative Decree 151/2015 on the simplification of work and equal opportunities, the decree implementing the enabling act on work 183/2014 (so-called Jobs Act), which sets out that “they can be used exclusively for organisational and production requirements, work safety and the protection of the company assets and can be installed subject to collective agreement stipulated by the unit trade union representatives and the company trade union representatives” (Article 23).
In this regard, the purpose of the GPS on the wearable RFID device is to reveal the position of the waste, which is done by reading the tag on the bag or bin, so that the pay as you throw tariff system can be applied correctly; the wearable, therefore, has no purpose regarding the automatic control of the operator.
Geolocalization and GDPR
What does the GDPR prescribe regarding the detection of the operator’s position? Regulation (EU) 2016/679 on data protection entered into force on 24th May 2016 and became effective in the European Union member states from 25th May 2018. After that date, with provision no. 396 of 28th June 2018, the personal data protection authority, “in implementation of the EU regulation, has ordered a supplier of geolocalization services for the first time to incorporate the ‘right to privacy’ directly into the product’s functionality, complying with the principle of minimizing data and the one on privacy by design and privacy by default” and stressed that “privacy must be protected right from the design stage of a product or service” (Newsletter no. 443 of 31st July 2018).
The concepts of privacy by design and privacy by default are shown in Article 25 of the GDPR, regarding data protection by design and data protection by default:
1. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are designed to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.
2. The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons”.
The localization of the wearable RFID for pay as you throw collection
With regard to localization systems in the context of employment, even before the GDPR came into force, the Italian personal data protection authority in provision no. 370 of 4th October 2011 establishes that “in compliance with the principle of necessity, the position of the vehicle should not normally be monitored continuously by the data controller, but only when this is necessary for achieving the purposes legitimately pursued”. In Regulation EU 2016/679, in place of the principle of necessity – “the information systems and computer programmes are configured, reducing the use of personal data and identification data to a minimum”, Privacy Code (Italian Legislative Decree 196/2003) – there appears the concept of personal data minimisation, which must be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed” Article 5)
Continuous tracking and marking of the position
Tracking is a continuous process: tracking means storing with a set interval – half a second, a second, two seconds, a minute, etc. – the position of a vehicle or object and, consequently, the person using it.
On the other hand, marking the position means storing it after a voluntary action: the wearable for the pay as you throw measuring of wastes does not track the operator’s position and does not store it continuously, but marks it and records through an exclusively voluntary action, i.e. reading the RFID tag on the bag or bin or pressing a button.
GPS for the pay as you throw collection operator
Article 23 of Italian Legislative Decree 151/2015 allows the use of “tools from which even the possibility of remote control of workers’ activities” for “the safety of work”.
Waste collection can be configured as a solitary work condition, an employment mode identified in the DVR, the Risk Assessment Document drawn up by the employer to identify the possible risks in the workplace and the preventive measures for the health and safety of the worker. Solitary work is performed by the operator in total autonomy, without the supervision of a foreman and in isolation from others, and mainly concerns those who operate in the public utility sector, like maintenance men, supervision service employees and – precisely – waste collectors.
The hazard for the solitary worker is linked to the impossibility of receiving immediate help from colleagues in the case of illness, emergency or accident; integrating the wearable for pay as you throw waste collection with suitable components – e.g. one for reporting a man on the ground – designed to guarantee worker safety can make the device an item of Personal Protection Equipment (PPE), i.e. a type of device “intended to be worn and held by the worker for the purpose of protecting him/her from one or more of the risks susceptible of threatening health or safety during work” (Consolidated Act 81/08 on Workplace health and Safety). This, in combination with GPS, the wearable RFID device can become an effective tool for intervening in cases of emergency.