Employers commonly use GPS geolocation devices to monitor their vehicles or equipment and to analyse fuel consumption, mileage, driving time, idle time, parking time, usage statistics etc. European case law has introduced tighter rules and requirements for personal data processing associated with GPS tracking. There are certain restrictions that companies using these devices for business purposes should be aware of.

A lawful purpose

All GPS tracking must have a lawful purpose, such as analysing fuel consumption, preventing crimes and offences, or protecting property and health. On the other hand, purposes such as monitoring speed compliance or permanent surveillance of workers are not lawful. When it comes to defining your purpose, you need to assess whether the purpose your GPS monitoring is to achieve could be achieved by some other means presenting a lesser invasion of privacy. For example, if you mean to automatically record the distance travelled, then you should not be recording vehicle location details. Remember, if you set out to collect data for achieving one purpose, then that data can no longer be used for another unrelated purpose.

Example: If you are using GPS as a safeguard to help you find vehicles in case of theft, the purpose of processing – to monitor the driver’s efficiency – is not lawful.

An appropriate legal basis

The most common legal basis is the employer’s legitimate interests. Yet this may also be the data subject’s consent or performing an obligation, for instance, with tachographs used in lorries.

Example: A worker is allowed to use a company car during and after working hours. For the performance of job duties, the employer may have a legal basis to obtain details of the route travelled, yet in no event he has a legal basis to process GPS data after working hours. So the employer has to ensure GPS data is processed only during working hours, with an option to switch GPS off if the car is used after working hours.

Informing the worker

Before a worker starts using a company car, the employer is required to inform them of GPS tracking. This means that the employer has introduced his workers to the data processing rules in writing, i.e. for what purposes the data is processed, why such records are necessary, for what purpose the data will be used or released, and for how long it will be kept. The safest way to demonstrate that a worker has been informed of data processing is their signature confirming they have read and understood the rules. Any omission or negligence by the employer in carrying out the duty of notification may be considered a data protection breach.

Appropriate documents

The employer is required to draw up appropriate documents and adopt technical measures to protect the data gathered. In addition to carrying out the duty of notification and the related requirement of documentation, the employer is required to design a data protection impact assessment, with a test assessing legitimate interests to be taken where the legal basis is the employer’s legitimate interests. It is equally important to provide technical protection – the data may be processed only by persons that are specially authorised, so any workers whose job duties do not include controlling or analysing this data will be denied access to it.

However, not all GPS location data is personal data because this depends on the context and the purpose for which the data is used. The collected GPS data set may be neutral in terms of privacy if it is used for tracking as part of logistics optimisation services.

If you have any questions about data processing done as part of GPS, you are welcome to consult a data protection expert. The National Data Office has recently received many complaints from workers about GPS data processing done by their employers, which may signal non-compliance with data processing rules or a data protection breach.