Can Employers Use Social Media Geolocation to Find Absconding Employees?

Introduction

Employers may sometimes need to locate an employee who has stopped reporting for work, retained company property, or failed to respond to formal notices. Public social media posts may reveal a person’s location, travel, workplace, or activities. However, using that information for a corporate investigation must comply with Philippine data privacy law.

The fact that an employee posted information publicly does not give an employer unlimited authority to collect, analyze, disclose, or use it. The employer must still identify a legitimate purpose, limit the investigation to information reasonably necessary for that purpose, observe transparency, and avoid conduct that intrudes disproportionately into the employee’s private life.

What Is Social Media Geolocation?

Social media geolocation refers to identifying or estimating a person’s location from online information. This may involve:

• location tags and geotagged photographs;
• public posts showing recognizable places or landmarks;
• public check-ins and event information;
• timestamps, captions, and travel announcements;
• publicly visible employment or business information; and
• information obtained from public profiles or posts shared by third parties.

These activities may constitute “processing” under the Data Privacy Act of 2012 because processing includes the collection, recording, organization, storage, retrieval, consultation, use, disclosure, or other handling of personal information. The Act applies to personal information processed by private entities, including employers. (Republic Act No. 10173, Sections 3 and 4.)

Does a Public Post Remain Personal Information?

Generally, yes. A public post may still contain personal information if an individual can be identified from the post, account, image, location, date, or surrounding circumstances. Public availability affects the assessment of privacy expectations, but it does not automatically remove the information from the Data Privacy Act.

The Supreme Court has recognized that information collected and shared by government entities may constitute personal information, and that the Data Privacy Act covers both public institutions and private entities. (KAPIT v. City of Manila, et al., G.R. Nos. 261892, 262192, 263752, 2026.)

Employers should therefore avoid assuming that publicly accessible information may be used for any purpose. The relevant questions are whether the collection has a lawful basis, whether it serves a legitimate purpose, and whether the extent of the investigation is proportionate to the business concern involved.

What Lawful Basis May an Employer Rely On?

Consent is not the only possible lawful basis for processing personal information. Depending on the circumstances, an employer may rely on processing necessary for a legitimate interest, or on processing necessary for the establishment, exercise, or defense of legal claims.

Section 12(f) of the Data Privacy Act may support processing necessary for the legitimate interests of the employer or another person, provided that the employer’s interests do not override the fundamental rights and freedoms of the employee. Section 13(f) may apply to sensitive personal information when processing is necessary for the protection of lawful rights and interests in court proceedings, the establishment, exercise, or defense of legal claims, or when provided to a government or public authority.

The National Privacy Commission has clarified that processing under Section 13(f) does not require an existing court or administrative proceeding. It may cover preparatory stages and potential legal claims, but the processing must remain necessary, proportionate, transparent, and within the limits of law. (NPC Advisory No. 2024-02.)

Accordingly, an employer investigating an employee’s unexplained disappearance may have a lawful basis when the investigation is directed toward a defined business concern, such as recovering company property, verifying an asserted emergency, preserving evidence, or preparing a legal claim. The lawful basis does not authorize unrestricted monitoring.

What Privacy Principles Limit the Investigation?

Section 11 of the Data Privacy Act requires compliance with the principles of transparency, legitimate purpose, and proportionality.

Transparency

The employer should maintain a privacy notice or employment policy explaining how employee information may be collected and used for attendance management, security, asset recovery, workplace investigations, and legal claims. The notice should not be misleading or so broad that it effectively authorizes any form of surveillance.

Where appropriate, the employee should be informed that publicly available information was reviewed and why it was relevant. Immediate disclosure may be deferred when it would compromise an investigation, but the employer should be prepared to document the reason for doing so.

Legitimate purpose

The investigation should address a specific and lawful business purpose. Examples include determining whether an employee who stopped reporting for work is still employed elsewhere in violation of a valid agreement, locating company equipment, verifying a claim relevant to leave or attendance, or preserving evidence for a possible proceeding.

Curiosity, retaliation, embarrassment, or an attempt to pressure the employee into returning to work is not a legitimate purpose. The employer should not use location information to harass the employee or publicize the employee’s whereabouts.

Proportionality

The employer should collect only the information reasonably necessary to address the stated concern. A single public post showing a location may be relevant. Continuous monitoring, repeated searches of relatives’ accounts, use of fake accounts, purchase of private data, or combining multiple data sources to construct a detailed movement history may be excessive.

The National Privacy Commission has emphasized that processing based on legitimate interests must be necessary, proportionate, and not overriding of the data subject’s fundamental rights. (NPC 19-1411, MIP v. Colliers International Philippines, 2024.)

Is Public Social Media Monitoring Automatically Lawful?

No. Public accessibility is relevant but not decisive. The employer must still assess the context in which the information was posted, the sensitivity of the information, the purpose of the collection, and the effect of the investigation on the employee.

In a separate opinion in a Supreme Court case, it was observed that information shared with government agencies and local government units may still be personal information subject to the Data Privacy Act. (KAPIT v. City of Manila, et al., G.R. Nos. 261892, 262192, 263752, 2026, separate opinion.) This reinforces the need to distinguish public availability from unrestricted lawful use.

Social media posts also differ in sensitivity. A photograph of a public event may present a lower privacy concern than information revealing a medical condition, religious activity, family relationship, home address, or precise real-time location.

What May an Employer Lawfully Do?

Subject to the facts and the employer’s privacy policies, the following measures are generally less intrusive:

• reviewing information visible to the general public without bypassing access restrictions;
• preserving a relevant public post through a dated screenshot or evidence log;
• recording only the information necessary to verify a specific employment concern;
• comparing the post with attendance records, leave applications, or company property records; and
• using the information to send a formal notice or initiate an authorized internal process.

The employer should identify who accessed the information, when it was accessed, what was collected, why it was relevant, and where it was stored. Access should be limited to personnel with a legitimate need to know.

What Conduct May Create Liability?

Potentially problematic conduct includes creating a deceptive account to gain access to restricted posts, asking coworkers or relatives to obtain nonpublic information, tracking an employee continuously, contacting unrelated persons about the employee’s location, or circulating screenshots beyond the investigation team.

The unauthorized processing of personal information may result in criminal liability under Section 25 of the Data Privacy Act when personal information is processed without the data subject’s consent or without authority under the Act or another law. The provision distinguishes personal information from sensitive personal information and imposes different penalties. (Republic Act No. 10173, Section 25; Azarraga v. Jalbuna, A.C. No. 13678, 2023.)

The Supreme Court has also recognized that processing sensitive personal information for litigation may be lawful when it is necessary for the protection of lawful rights. In Azarraga v. Jalbuna, the Court held that the use of personal information in connection with a legal proceeding was not, on the facts presented, a violation of the Data Privacy Act where the processing was necessary and authorized.

Can an Employer Use a Former Employee’s Public Post?

Possibly, but the employer should first determine whether the post is genuinely public, whether the person remains connected with the company, and whether the intended use relates to a legitimate employment or legal concern.

The National Privacy Commission has ruled that continued posting of a former agent’s personal information in online advertisements after resignation may constitute unauthorized processing. The decision illustrates that authorization connected with employment does not necessarily continue after the employment relationship ends. (NPC 20-026, 2022.)

A former employee’s public post may be preserved to document a matter directly related to company property, a contractual dispute, or a pending legal claim. It should not be used as a basis for public accusation, unrelated background investigation, or disclosure of personal details to customers, coworkers, or the public.

Does Social Media Evidence Prove Absconding?

Not necessarily. A post may be scheduled, reposted, outdated, misleading, or uploaded by another person. A photograph showing a particular location does not by itself establish that the employee was present at the stated time, intentionally abandoned work, or committed a breach of contract.

The employer should corroborate the post with attendance records, notices, delivery records, company property inventories, employment policies, and the employee’s explanations. The employer must also observe due process where the investigation may lead to disciplinary action or termination.

As a general matter, the evidence should establish the employment obligation, the employee’s failure to report or respond, the notices sent, the relevance and authenticity of the social media material, and the employee’s opportunity to explain.

Recommended Investigation Procedure

1. Define the concern. Identify whether the purpose is attendance verification, recovery of property, protection of confidential information, or preparation for a legal claim.
2. Check the privacy policy. Confirm that the company disclosed relevant employee-monitoring and investigation practices.
3. Use only authorized access. Review information visible to the public and do not circumvent privacy settings.
4. Minimize collection. Preserve only the posts, dates, locations, and surrounding information relevant to the concern.
5. Restrict access. Allow only authorized human resources, legal, security, or management personnel to review the material.
6. Verify authenticity. Record the account name, URL, date, time, visible context, and method of preservation.
7. Give the employee an opportunity to respond. Do not treat a social media post as conclusive without considering an explanation.
8. Dispose of irrelevant data. Delete or securely destroy information that is no longer necessary, subject to applicable retention duties.

What Should a Corporate Policy Contain?

A company policy should state that publicly available information may be reviewed only for defined employment, security, compliance, or legal purposes. It should identify authorized personnel, retention periods, access controls, escalation procedures, and the circumstances requiring consultation with the data protection officer or legal counsel.

The policy should also prohibit deceptive access, unnecessary monitoring, disclosure to unrelated persons, discriminatory investigations, and use of personal information for retaliation. Employees should be told how to raise privacy concerns and how the company will respond to requests for access, correction, or deletion when applicable.

Final Observations

Using public social media posts to locate an absconding employee is not automatically prohibited, but it is not automatically lawful either. The employer should be able to show a defined legitimate purpose, a lawful basis, transparency, proportionality, secure handling, and a direct connection between the information collected and the employment or legal issue being investigated.

The safest approach is targeted review rather than continuous surveillance. Employers should preserve only relevant public information, avoid sensitive personal details unless legally necessary, limit internal circulation, corroborate social media evidence, and give the employee a fair opportunity to explain.

About Nicolas and De Vega Law Offices

 Nicolas and de Vega Law Offices is a full-service law firm in the Philippines.  You may visit us at the 16th Flr., Suite 1607 AIC Burgundy Empire Tower, ADB Ave., Ortigas Center, 1605 Pasig City, Metro Manila, Philippines.  You may also call us at +632 84706126, +632 84706130, +632 84016392 or e-mail us at [email protected]. Visit our website https://ndvlaw.com.