A new sales rep’s first day. “Your company phone will take a couple of weeks; in the meantime, download these three apps on yours.” It is a familiar scene in many companies. And the Spanish Data Protection Agency (AEPD) has made clear it can be very costly.
In March 2026, the AEPD fined a company €200,000 for requiring work apps on an employee’s personal phone when no company phone was provided. Those apps had permissions to track location continuously and to access photos, contacts, voice recordings and fitness data. The company paid a monthly allowance for using the personal phone, and it was still sanctioned.
In this article we will discuss...
The case: €200,000 over work apps on an employee’s personal phone
What happened
Ares Capital, a ride-hailing (VTC) company, required its drivers to use four apps for work: internal communication, the service platform and location tracking. Under their contract, each driver could request a company phone or use their own in exchange for a monthly payment. But the company admitted that company phones were provided depending on availability and budget. Until then, drivers had to install the apps on their own phones.
In July 2024, a driver complained to the AEPD. He said the apps continuously monitored his location, messages, calls and other activity data, and that he had not been properly told what data they collected.
What the AEPD decided
In decision PS/00454/2024, signed on 4 March 2026, the AEPD imposed three fines:
| Infringement | What went wrong | Fine |
|---|---|---|
| Data minimisation (Art. 5(1)(c) GDPR) | The apps collected far more data than the work required | €100,000 |
| Lawfulness (Art. 6(1) GDPR) | There was no valid legal basis for processing data on the personal phone | €80,000 |
| Transparency (Art. 13 GDPR) | Staff were not told what data the apps collected or how to switch them off at the end of the working day | €20,000 |
It also ordered the company to show within two months that it had fixed all three.
Why the employee’s “consent” is not enough
The company argued that using a personal phone was voluntary and compensated. The AEPD rejected this. Because a company phone was not available from the outset, employees had no real alternative, so their consent was not freely given.
This is the key point of the case. In an employment relationship, consent rarely works as a legal basis, because of the clear imbalance between employer and employee. If the only alternative to installing the app is not being able to work, there is no choice.
The company can rely on other bases, such as performance of the employment contract or legitimate interest. But they only cover what is strictly necessary. Here, the apps requested access to photos, contacts, audio and health and fitness data, none of which had anything to do with driving.
What this case means for any company
Although it involves a ride-hailing company, the same issue arises in any sector with apps such as:
- Messaging apps like WhatsApp or Telegram to coordinate teams. We cover this in our post on WhatsApp groups in the company.
- Clock-in or time-tracking apps on mobile phones, often with geolocation.
- CRM, route and visit management apps for sales staff and technicians.
- Authenticator apps to access email or the VPN.
- Email and corporate tools installed on the employee’s own phone.
Not all carry the same risk. An authenticator app barely accesses phone data. A route app with permanent geolocation and access to the photo gallery does.
Geolocation, the most sensitive point
Article 90 of the Spanish Data Protection Act (LOPDGDD) allows employers to use geolocation to monitor work. But they must first inform employees expressly, clearly and unequivocally about its existence and characteristics. Article 88 recognises the right to digital disconnection. An app that keeps tracking employees after their shift clashes with both.
Can an employer require use of an employee’s personal phone?
From a data protection perspective, the practical answer is this: an employer can ask for a specific app to be installed on a personal phone if four conditions are met.
- It is necessary for the job and there is no reasonable less intrusive alternative, such as a company device.
- It relies on a legal basis other than consent, and that basis is documented.
- Its permissions are limited to the essentials. No gallery, contacts or microphone unless the job requires them.
- The employee is informed about what data is collected, why, for how long and how to switch it off at the end of the working day.
If the app is intrusive by nature, such as continuous geolocation, the safest solution is a company device from day one. That is exactly what was missing in this case.
Company phone or employee’s personal phone: how to decide
The useful question is not whether a personal phone may be used, but what each app does and what data it needs. With that information, the decision is usually straightforward:
| Type of tool | Personal phone | Better on a company phone |
|---|---|---|
| Authenticator app for email or VPN | Yes, with prior information | Only if the employee prefers |
| Corporate email and calendar | Yes, within a separate work profile | If sensitive data is handled |
| Team messaging | Yes, with clear usage rules | If client data is shared frequently |
| Clock-in with location only at the moment of clocking in | Possible, with information and location limited to clocking in | To avoid any doubt |
| Routes or continuous geolocation | Not recommended | Yes |
| Apps with unnecessary access to gallery, contacts or microphone | No | Review whether the tool is suitable |
The table does not replace a case-by-case analysis, but it reflects the AEPD’s approach in this decision: the more intrusive the app, the harder it is to justify on a phone that belongs to the employee.
There is also a practical argument. A company device lets the employer manage and wipe work data when someone leaves, without touching their personal photos or conversations. On an employee’s personal phone, that separation depends on the apps being properly configured.
Common mistakes with an employee’s personal phone
- Assuming that if the employee agrees, everything is covered. In an employment relationship, that “yes” is rarely free.
- Installing the app with all default permissions. Many request gallery, contacts or microphone access even when the job does not need it.
- Not explaining what each tool does. A generic clause in the contract is not enough: employees must know what data is collected and why.
- Leaving geolocation on outside working hours. It is the most common complaint and what the AEPD looks at first.
- Forgetting the exit. When an employee leaves, their access to apps and corporate data on their phone must be removed, just as with a former employee’s email account.
How to get it right: checklist
- An inventory of apps the company asks staff to install, with the permissions each one requests.
- A permissions review: disable those that are not needed. If the app does not allow this, consider another tool.
- Separate personal and work use, for example with a work profile on the phone, so the company does not access private data.
- A device use policy covering personal phones, with the involvement of employee representatives where they exist.
- A specific privacy notice for each tool that processes data, including geolocation.
- Disconnection after work: geolocation and notifications must be able to be turned off outside working hours.
- Consider a data protection impact assessment if there is systematic monitoring of employees, such as continuous location tracking.
How we can help
As external data protection officers, at Auratech Legal Solutions we review the apps your employees use on their phones. We draft the device use policy and the information for staff, and assess whether an impact assessment is needed. Tell us about your case.
Frequently asked questions
Can my employer make me install an app on my personal phone?
They can ask if the app is necessary for the job, has a valid legal basis, limits its permissions and you are properly informed. They cannot rely on your consent if they do not offer a real alternative, such as a company phone.
Does paying an allowance for using my own phone solve the problem?
No. In the sanctioned case the company paid a monthly amount and still received a €200,000 fine. Compensation does not replace a legal basis or data minimisation.
Can my employer track my location through my phone?
They can use geolocation to monitor work after informing you beforehand, expressly, clearly and unequivocally. They must also explain how to switch it off at the end of the working day, as the AEPD required in this case.
What about using WhatsApp to talk to colleagues?
It is common, but the company should regulate it: which groups are for work, who manages them and what data is shared. If use is mandatory, the same rules apply as for any other app.
What can I do if my employer requires intrusive apps?
You can ask the company what data the apps collect and raise it with employee representatives or the data protection officer. If it is not resolved, you can complain to the AEPD, as the driver in this case did.
This article provides general information and is not a substitute for legal advice on a specific case.
