Germany – GPS location of company vehicles: what is allowed?

0

By Jessica Jacobi, Firm: Kliemt.HR Avocats

A German court has provided helpful guidance on when employers can use GPS tracking of employee vehicles.

In its judgment of March 19, 2019, the Lüneburg Administrative Court became the first German court to issue a decision under the new data protection law (EU General Data Protection Regulation (GDPR) and applicable German law) regarding GPS tracking of company vehicles by the employer. By way of explanation, the German legislator has introduced a modified national law implementing the GDPR, called the Federal Data Protection Act, Bundesdatenschutzgesetz (“BDSG-new”). This law replaces the previous version of the German Data Protection Act (“BDSG-old”), which was in force until May 24, 2018.

The judgment basically confirms the decisions made under the previous German Data Protection Act (BDSG-old). Employers operating similar systems or considering the introduction of GPS tracking systems should be aware of this ruling, as it further clarifies the conditions for using GPS tracking for employment purposes and provides criteria for useful assessment.

Background

The plaintiff, a building cleaning company, had equipped 18 of its company vehicles, used by cleaners and janitors, with GPS systems. For a period of 150 days, these systems recorded all distance traveled with start and end points, including time traveled and ignition status (on or off). Since the system also stored the license plates of the vehicles, the data obtained could be clearly attributed to the respective operational users.

In this lawsuit, the cleaning company challenged a restriction issued by the local data protection authority regarding their use of GPS tracking in legal proceedings. On March 30, 2017, the Data Protection Authority issued an order to the cleaning company:

“design the collection, processing and use of employment data by positioning systems in such a way that personal positioning during the correct operational use of vehicles does not take place no later than May 5, 2017 .”

Such an order to comply with applicable data protection law falls within the powers of the data protection authorities as granted by Article 58 (2) (d) and (f)) of the GDPR . After an unsuccessful protest against the order, the plaintiff company filed a lawsuit against it in the Administrative Court. The company defended its use of the tracking system, saying it was operationally necessary and that it only used it three to four times a year per vehicle. She relied, first, on the argument that the data collection was necessary for employment purposes, including scheduling visits and coordinating vehicles, preventing theft or recovering stolen vehicles, proof that work has been carried out for customers, control of weekend driving bans and personal driving bans. Second, written consent had been obtained from some of the affected employees.

The decision: GPS positioning is an inadmissible processing of personal data

The Court dismissed the action as unfounded. The collection, storage and evaluation of GPS position data constitutes processing of personal data for employment purposes in accordance with Art. 88 (1) GDPR and Art. 26 BDSG-new. The court decided that the control of this data by the company is neither necessary for the purposes of the employment relationship under § 26 paragraph 1 BDSG nor covered by the effective consent of the employees under the § 26 paragraph 2 BDSG.

It should be noted that although this legal action relates to an order issued by the Data Protection Authority on March 30, 2017, the court applied the new legal situation which entered into force in May 2018, after the issuance of the arrangement. The court concluded that the instruction is an administrative act with continuing effects for the future, so the GDPR, which entered into force on May 25, 2018, could be applied to assess the legal situation. This appears to be one of the first court rulings on GPS tracking in an employment context that has come down under the new legal situation.

Not required for employment purposes

According to the Court, none of the data processing purposes claimed by the applicant could justify the need to process GPS position data for the following reasons:

  • Information about the current or past location of vehicles is not relevant to future visit planning and vehicle coordination in the building cleaning industry; Unlike the transport of goods or people, for example, the coordination of vehicles and personnel for a cleaning company is not urgent, and short-term changes must be overcome by using less restrictive measures such as the call employees on their mobile phones.
  • To prevent theft, an argument put forward by the requesting company and the subcontractor, permanent monitoring of the GPS location of vehicles is totally unsuitable because it alone will not prevent theft. As for the recovery of stolen vehicles, a one-time GPS location tracking will be sufficient.
  • Vehicle location data is completely unsuitable as evidence work has been done for the company’s customers, as it would not provide any evidence of the employee’s activity for the customer, but would indicate at best that a vehicle of the business was nearby.
  • Monitoring of compliance with the ban on weekend driving and the ban on private driving could also be carried out by less onerous means, such as handing over vehicle keys and keeping road books.

The Court also found that the fact that the company had only used stored position data three or four times a year for the purpose of locating vehicles contradicted the company’s argument regarding the need for a permanent GPS positioning. It is precisely this fact that demonstrates that a system that locates vehicles on a case-by-case basis would be perfectly suited to the company’s objectives.

Ineffective consents

The consent to data processing (Art. 26 para. 2 BDSG-new) obtained from some of the affected employees was ineffective in this case, since the legally required notice of the possible revocation of consent (Art. 7 para. 3 BDSG- new) was omitted, and the employees were only partially informed about the purpose of the data processing.

Conclusion

As mentioned above, this is most likely one of the first decisions on the use of GPS location tracking in an employment context that was made under the GDPR (and its implementing legislation). in German implementation, BDSG-new). This judgment shows that an assessment of the need for permanent and personal GPS tracking of company vehicles will be closely linked to the organizational requirements of the industry in question. In companies where the coordination of company vehicles is not subject to a particularly tight schedule (as here in the cleaning company), the introduction of GPS positioning must be carefully considered and, in the event of doubt, the GPS location of vehicles should only take place on an ad hoc basis. The Court explicitly mentions that this can be seen differently in cases where the transport of goods or people may require exact knowledge of the location and an immediate reaction. In any case, before implementing constant GPS tracking in an employment context, it is advisable to carry out a data processing impact assessment (Article 35 GDPR) in order to assess the purposes of the processing. and the likely risks involved.

Share.

Comments are closed.