What information can a device collect?
Wearable devices in occupational safety and health (OSH) can record movement, proximity, location, or physiological signals. Their processing must be analyzed according to the data and inferences actually generated. A seemingly technical identifier can allow for the identification of a person when combined with shifts, zones, or histories. Removing the name does not automatically anonymize a record.
Environmental measurement must also be distinguished from individual monitoring. A fixed sensor measuring temperature in a warehouse raises different issues than a wristband that continuously tracks each worker. The system design, the possibility of linking records, and subsequent use determine the actual extent of the impact on privacy.
Purpose and preventive need
The organization must describe the problem it intends to solve before choosing the equipment. Detecting entry into a hazardous area, studying postures, or assessing thermal conditions are different objectives and require different data. If the same protection can be achieved through physical separation, redesign, or less intrusive environmental measurement, that alternative should be examined.
Sensors used for safety and security (OSH) should not automatically become performance ranking tools. The project needs explicit limits: which events it triggers, how much detail it retains, and what decisions it allows. A generic purpose like “improving safety” is insufficient to justify any collection or reuse of personal information.
Health data and consent
The GDPR distinguishes between personal data and special categories, including health data. The existence of an employment-related purpose does not eliminate this protection. The Spanish Data Protection Agency’s (AEPD) guide on employment relationships specifically warns about health monitoring using wearable devices and the issues of legitimacy, proportionality, and freedom of consent in an unequal relationship.
Therefore, an acceptance checkbox alone does not resolve the legality of the system. The basis for the processing must be identified and, where applicable, the exception applicable to health data. Furthermore, the protection of health data in occupational safety and health (OSH) requires separating clinical information from any preventive conclusions that the company may have.
Design, access and conservation
A prudent design minimizes data from the outset. A local alert without personal history may be preferable to retaining all movements for months. The sampling frequency, spatial accuracy, and logging duration should correspond to the defined use. Minimization is not achieved simply by deleting files at the end of the project.
It is advisable to specify access profiles, query traceability, security measures, and retention rules. Providers, data processors, potential data transfers, and the final destination of data upon termination of the contract should also be reviewed. When processing may entail a high risk, a data protection impact assessment and the necessary safeguards should be analyzed before implementation.
Participation and user experience
Consulting and involving workers helps uncover effects that might not appear in a commercial demonstration. The device may generate pressure, physical discomfort, or questions about who is observing the activity. Its functions should be explained in clear language, and channels should be provided for reporting malfunctions, misattributions, and unexpected uses.
The pilot test should study both its preventive usefulness and people’s experience with it. It is important to ask whether the alert is understood, whether it interferes with protective equipment, and whether it encourages behaviors that prevent recording. A system that incentivizes concealing incidents may worsen the effectiveness of preventive information, even if it produces more data than the previous method.
Practical example
In a hypothetical example, a logistics center wants to reduce encounters between forklifts and pedestrians. Before assigning a device to each worker, it reviews routes, intersections, visibility, and physical separation. The safety team identifies a point that needs immediate redesign and considers a proximity alert system as additional support during the transition.
The pilot program is configured to warn of the encounter without compiling individual productivity rankings. Participants are informed, access to necessary records is restricted, and the timeliness of alerts is verified. The final decision considers avoidable collisions, false alarms, and data exposure, along with the effectiveness of the implemented physical measures.
How to evaluate the project
The review must have defined criteria before data collection begins. These criteria may include the detection of relevant situations, the proportion of incorrect alerts, the operational response, and the volume of data retained. A designated person must be responsible for stopping or modifying the pilot program if unforeseen effects or unnecessary information arise.
If AI is used to interpret signals, the risk assessment of AI use must consider errors, biases, and the consequences of inferences. An estimate of fatigue or stress does not automatically equate to a diagnosis, nor does it allow for attributing a health status without adequate checks and safeguards.
Mistakes to avoid
Common mistakes include activating all available functions, storing data indefinitely, and confusing pseudonymization with anonymity. It is also a mistake to present a wristband as the primary solution to a risk that can be eliminated through organization or engineering. The ease of measurement alone does not create a need for prevention.
The decision must document expected benefits, alternatives, limitations, and periodic review. If the purposes, recipients, or functions of the device change, the processing must be re-examined. Privacy is an integral part of the project design and management; it cannot be reduced to a notice delivered after monitoring has begun.
