GPS tracking of company vehicles and the GDPR: what is allowed?

A GPS tracker records where a vehicle is, when it leaves and which route it takes. As long as that data only relates to a car, it is not personal data. That changes as soon as you can work out who was driving. With a rota, an assigned driver or a job schedule, that is almost always possible for company vehicles.

Location data that can be linked to an employee falls under the General Data Protection Regulation (GDPR). It reveals a lot about a person: where they live, when they start work, where they take breaks and how they drive. That is why strict requirements apply to collecting and using it.

The employer is the data controller. You decide on the purpose and the means, and you are accountable if something goes wrong. The provider of the tracking platform processes the data on your behalf and is usually a processor. Record that division of roles in a data processing agreement, as Article 28 of the GDPR requires.

Every processing of personal data needs a lawful basis. Employee consent may seem the obvious choice, but in an employment relationship it is usually not a suitable basis. Consent must be freely given, and an employee depends on their employer.

In practice, employers usually base GPS tracking on legitimate interest. Examples are protecting vehicles against theft, planning trips and service visits, or the safety of employees who travel alone. That interest must be specific and documented in advance. Public-sector bodies generally rely on a different basis (public task).

A legitimate interest on its own is not enough. You weigh your interest against the employee's privacy and record that assessment in writing, so you can account for it later. The assessment covers these tests:

• Necessity: is tracking genuinely needed to achieve the purpose, or is it mainly convenient?
• Proportionality: is the intrusion on privacy in proportion to the purpose? Watching live during working hours weighs more heavily than reviewing a trip afterwards.
• Subsidiarity: could you achieve the purpose with a less intrusive measure, such as only an alert when the vehicle moves outside working hours?
• Purpose limitation: data collected to prevent theft should not simply be reused for another purpose, such as assessing performance.

Employees must know that their vehicle is tracked before tracking starts. This follows from the GDPR's transparency obligations. Covert tracking does not fit with that. Only in exceptional situations, such as a specific suspicion of a criminal offence, may there be room for it; seek legal advice in that case.

Preferably inform staff in writing, for example in a company car policy or a privacy policy that employees receive and can refer back to. A verbal remark when the keys are handed over is hard to prove later.

Cover at least the following topics in that information:

• Which data the tracker records, such as location, time, speed and trips.
• The purposes you use that data for, and the purposes you explicitly do not.
• Who can see the data, both live and afterwards.
• How long you keep the data.
• How private use is handled, for example with a privacy switch.
• Which rights the employee has, such as access and objection, and who to contact about them.

If your company has a works council (ondernemingsraad, OR), it has a right of consent over any arrangement for a system that can monitor staff. This is laid down in Article 27(1)(l) of the Dutch Works Councils Act (Wet op de ondernemingsraden, WOR), unless the arrangement has already been settled in substance in a collective labour agreement (Article 27(3) WOR). It covers facilities intended for, or capable of, observing or monitoring the attendance, behaviour or performance of employees. A GPS tracker in a company vehicle generally falls within that scope.

The word ‘capable’ matters. Even if you only intend to use the tracker against theft, the system may technically be capable of monitoring employees. In addition, an arrangement on processing employees' personal data may require consent under Article 27(1)(k) of the same Act.

Ask for consent before the system goes live. A decision taken without the required consent can be void if the works council invokes this in writing within one month. Involve the works council early: when choosing the purpose, the settings and the retention periods.

If your organisation has no works council, the obligation to inform employees still applies in full. Consulting employees or an employee representative body helps build support and avoids confusion later on.

If employees may also use the company vehicle privately, tracking becomes more sensitive. Location data outside working hours says something about private life: visits to family, a doctor or a sports club. For most business purposes you do not need that data.

A privacy switch lets the driver indicate that a trip is private. Depending on the platform, the location is then not recorded, recorded only in limited form, or hidden from the employer. Ask each platform exactly how the switch works and what is still stored during a private trip.

An alternative is to restrict tracking automatically outside working hours. For theft prevention, an alert when the vehicle moves at an unusual time may be enough, without following the trip itself.

Keep in mind how this interacts with any trip log you keep for tax purposes. A privacy switch changes what is recorded, so agree on the settings with your tax adviser.

The GDPR requires that you do not keep personal data longer than necessary for the purpose. There is no fixed statutory period for GPS data. Set a retention period for each purpose, justify it and have old data deleted automatically.

Also limit who can see the data. A planner may need live locations, but not a trip history going back months. Define roles and permissions in the platform and use personal accounts, so it is clear who has viewed what.

Where processing is likely to result in a high risk for the people involved, a data protection impact assessment (DPIA) is mandatory under Article 35 of the GDPR. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) lists systematic monitoring of employees and large-scale or systematic processing of location data as situations that require a DPIA. A fleet that is tracked by default can easily fall into that category.

If in doubt, carry out the DPIA anyway. The document also helps in discussions with the works council and when employees ask questions. The AP publishes up-to-date guidance on monitoring employees and on DPIAs on its website.

Carro Automotive installs GPS trackers in company cars and vans at its workshop at Stavorenweg 4 in Gouda. The tracker is hidden and connected to the vehicle battery. In the app you see live locations, trips and alerts when a vehicle moves or leaves a zone you have set.

The decisions described in this article are yours as the employer: the purpose, the balancing test, the arrangements with the works council and the retention periods. Settle them before the first tracker is installed. After handover you receive an overview per vehicle of what was installed, which helps with your own records.