Tracking of company vehicles by the employer

Satellite-based tracking systems are becoming increasingly common in vehicles provided for business purposes. On the one hand, this can make work more productive and safer if, for example, a client can see where a delivery driver is currently located and forward new orders in the vicinity accordingly. On the other hand, fears quickly arise that the systems could be used to permanently monitor employees.

To find out the limits within which the use of GPS systems in company vehicles is permissible under data protection law, click here.

What data may be collected?

In the 24th Data Protection and Freedom of Information Report 2019, Helga Block, the data protection commissioner for North Rhine-Westphalia, states that the "use of modern tracking systems such as the Global Positioning System (GPS) to determine the position of vehicles" may not be used for the "seamless monitoring of employees' behavior and performance". Accordingly, it is impermissible to permanently collect and evaluate travel distance and location data or data on the time spent at specific locations.

Under certain legal conditions, however, retrieval of the current location may be lawful. This requires a corresponding legal basis in the individual case.

Which legal bases come into consideration?

By tracking the company vehicle, personal data of the corresponding employee is processed. A legal basis is required for this.

Necessity for the employment relationship

According to Section 26 I BDSG, data may be collected that is required for the performance of the employment relationship. Depending on the area of work, this may include at least the location determination.

Legitimate interest of the employer

According to Art. 6 I 1 lit. f DSGVO, the collection of location data is also lawful if it is necessary to protect the legitimate interests of the controller (the employer). However, it must be ensured that the interests and fundamental rights for the protection of personal data of the employee concerned do not prevail in the specific process.

Consent

Employees can also consent to the collection of GPS data. This consent must then be obtained voluntarily, informed and revocable at any time in accordance with data protection requirements. It should be noted that the employee must also be informed about the purpose of the processing and about his or her right of revocation.

However, such consents are usually invalid in this context, as they are only given by the employee out of fear of losing his or her job if he or she refuses. There is then a lack of voluntariness.

Examples and hints for practice

Accordingly, it is permissible to carry out localization for simple location determination, for example, in order to be able to place new orders close to the location.

It is also permissible to use a tracking system to record working hours. This is necessary for the performance of the employment relationship. However, the employer should note that it does not create and/or store detailed movement profiles.

If route tracking is to be carried out in order to prove or trace an order, this can only be justified on the basis of the employer's legitimate interest. Accordingly, a balancing must then take place with the interests and fundamental rights of the employee to protect personal data. The result then depends on the individual case.

In any case, it must be ensured that the data is not used to monitor the employee's behavior or performance. However, since the location of the company vehicle is regularly suitable for this purpose, the works council must be consulted prior to the decision to equip the vehicles with GPS systems (Section 87 I No. 6 BetrVG). If the parties involved reach an agreement, it is recommended that the limits of the collection and evaluation be described as narrowly as possible. If there is no works council, the employer can issue a written declaration of commitment or formulate an addendum to the individual employment contract.

Conclusion

The extent to which the tracking of company vehicles by the employer complies with data protection requirements depends heavily on the circumstances of the individual case. Likewise, it also depends on the individual case whether a data protection impact assessment is necessary, which in turn may result in an obligation to appoint a data protection officer.

In any case, the employer should consider whether the purpose it is pursuing can also be achieved by less intrusive measures such as keeping a manual logbook.

We will be happy to advise you in deciding whether and how to take action.