Data protection: Caution with GPS tracking in company vehicles

GPS tracking supports fleet management but raises several data protection concerns. Companies must comply with legal requirements and transparency obligations, according to a report by the Bavarian State Office for Data Protection Supervision.

This article is part of the special topic "Current Data Protection Law".

GPS tracking can support companies in fleet management , but it also presents a challenge from a data protection perspective. Here you can read about the most important data protection obligations . This is based on the fifteenth activity report of the Bavarian State Office for Data Protection Supervision, which provides concrete guidance for practical application.

Goals and Functioning of GPS Tracking

Companies primarily use GPS tracking to protect vehicles and cargo, as well as to optimize operational processes. Technically, the system is based on a tracking device that determines the vehicle's position via satellite systems . In addition to location, it records time, speed, and distance, transmits this data at short intervals via mobile network or satellite to a server, and displays it visually in web applications.

In the event of theft or unauthorized use, GPS data enables rapid location. This is particularly relevant for companies transporting high-value or hazardous goods. Beyond theft protection , location data allows for more efficient route planning, fewer empty runs, and more accurate arrival time predictions.

Why is this a data privacy issue?

The almost complete tracking and analysis of movement profiles, however, raises data protection concerns. The General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG) provide the relevant guidelines . Personal data, as defined by the GDPR, is created as soon as the data can be attributed to a specific driver . The Bavarian State Office for Data Protection Supervision also emphasizes this point: Employees can be identified via their assigned vehicle . Therefore, the GDPR rules apply.

You might also be interested in:

Operations management

Pension insurance: Minijobbers now have a choice

Operations management

Optician wins against data privacy challenger

Operations management

Online shops: The cancellation button is now mandatory

Legal basis and data protection information

Every processing of personal data requires a legal basis in accordance with Article 6(1) GDPR . In the employment context, the following legal bases are particularly relevant:

• Fulfillment of the contractThe supervisory authority clarifies that this basis rarely applies. Tracking is usually not objectively essential for fulfilling the contract.
  
  
• Legal obligationExtensive GPS tracking is only permitted if companies can prove that it is necessary for legal documentation requirements. A tachograph is often sufficient.
  
  
• Legitimate interestsThis is often the central legal basis. Employers or third parties must demonstrate a current and verifiable interest, such as the protection of hazardous materials. A careful balancing of company interests and employee rights is essential. Consent is usually unsuitable in the employment relationship, as its voluntariness is questionable.

Adhere to the principles of necessity and proportionality.

Necessity and proportionality are key criteria for review. Employers must demonstrate that the specific design of the tracking system is suitable, necessary , and appropriate . Simply stating the purpose is insufficient. They must verify:

• Whether continuous recording is required or occasional access is sufficient,
• whether the accuracy of the data can be reduced,
• whether shorter storage periods or restricted access rights are sufficient,
• whether alternative, less intrusive measures would achieve the same purpose.

Particular sensitivity applies to the private use of company vehicles.

If private use of the vehicle is permitted, GPS tracking during private trips is prohibited . In cases of mixed use, it must be possible to deactivate tracking during private trips. If a vehicle becomes exclusively a private vehicle, all tracking measures must cease.

In exceptional cases, tracking may be permissible, as demonstrated by the Bavarian State Office for Data Protection Supervision. In one case involving the transport of explosives , the authority deemed targeted evaluations of GPS data lawful in cases of specific deviations, because a recognizable threat existed.

Transparency, co-determination and impact assessment

Employers must inform employees about the use of GPS trackers no later than when data collection begins ( Article 13 GDPR ). Incomplete or missing information can lead to complaints. Operating tracking systems with real-world data on a trial basis is not permitted without informing employees. The information must include: purpose, legal basis, any legitimate interests, data categories, recipients, storage periods, and the right to object ( Article 21 GDPR ).

According to the BayLDA's experience, many complaints stem from a lack of or insufficient transparency.

If a works council exists, it has a right of co-determination according to Section 87 Paragraph 1 No. 6 of the Works Constitution Act . However, a works agreement does not replace a separate legal basis, but rather regulates the specific details.

A data protection impact assessment is required before implementation. The geolocation of employees is considered particularly risky. Employers must document the risks and the technical and organizational countermeasures in place.

Conclusion

GPS tracking in company vehicles is not a routine tool, but rather the exception. It requires a sound legal justification , a data-minimizing design, and maximum transparency towards employees. Companies must examine and document on a case-by-case basis why and how they use GPS tracking.

Activity report of the Bavarian State Office for Data Protection Supervision. You can download the report for free here . DHB now also available digitally! Simply click here and register for the digital German Crafts Journal (DHB)!