Processing operations involving vehicles used by employees (part 1)

This week’s blog looks at how you track company vehicles, particularly in relation to what data this may give you about the employees who drive them.  It’s a big topic so we’ve split it into two parts – more to follow next week!  Both articles are based on a report on data processing at work by the Article 29 Working Party (‘WP29’), an independent Europeancompany vehicle advisory body on data protection and privacy.

Technologies that enable employers to monitor their vehicles have become widely adopted, particularly among organisations whose activities involve transport or have significant vehicle fleets.                                               

Any employer using vehicle telematics will be collecting data about both the vehicle and the individual employee using that vehicle. This data can include not just the location of the vehicle (and, hence, the employee), but, depending on the technology, a wealth of other information, including driving behaviour. Certain technologies can also enable continuous monitoring both of the vehicle and the driver (e.g., event data recorders).  

Of course, an employer might be obliged to install tracking technology in vehicles to demonstrate compliance with other legal obligations, e.g. to ensure the safety of those who drive those vehicles and their passengers. But, even if employers would have a legitimate interest to achieve these purposes, it should first be assessed whether the processing for these purposes is necessary, and whether the actual implementation complies with the principles of proportionality and subsidiarity.  

Where private use of a professional vehicle is allowed, the most important measure an employer can take to ensure compliance with these principles is the offering of an opt-out: the employee in principle should have the option to temporarily turn off location tracking when special circumstances justify this turning off, such as a visit to a doctor. This way, the employee can on his own initiative protect certain location data as private. The employer must ensure that the collected data are not used for illegitimate further processing, such as the tracking and evaluation of employees.  

The employer must clearly inform the employees that a tracking device has been installed in a company vehicle that they are driving, and that their movements are being recorded whilst they are using that vehicle (and that, depending on the technology involved, their driving behaviour may also be recorded). Preferably such information should be displayed prominently in every vehicle , within eyesight of the driver.  

It is possible that employees may use company vehicles outside working hours, e.g. for personal use, depending on the specific policies governing the use of those vehicles. Given the sensitivity of location data, it is unlikely that there is a legal basis for monitoring the locations of employees’ vehicles outside agreed working hours.  

However, should such a necessity exist, an implementation that would be proportionate to the risks should be considered. For example, this could mean that, in order to prevent car theft, the location of the car is not registered outside working hours, unless the vehicle leaves a widely defined circle (region or even country). In addition, the location would only be shown in a “break-the-glass” way—the employer would only activate the “visibility” of the location, accessing the data already stored by the system, when the vehicle leaves a predefined region.

Vehicle tracking devices are not staff tracking devices. Their function is to track or monitor the location of the vehicles in which they are installed. Employers should not regard them as devices to track or monitor the behaviour or the whereabouts of drivers or other staff, for example by sending alerts in relation to speed of a vehicle. 

Processing location data can be justified where it is done as part of monitoring the transport of people or goods or improving the distribution of resources for services in scattered locations (e.g. planning operations in real time), or where a security objective is being pursued in relation to the employee himself or to the goods or vehicles in his charge.

Leave a Reply

Your email address will not be published. Required fields are marked *