How should an employer track vehicles under GDPR?
It’s tricky. They need to balance the right to privacy of their drivers against the legitimate rights of their business.
Tracking technology enables employers to ensure vehicles are being driven efficiently and safely. Fuel bills and accidents can be reduced.
A driver has a right to privacy – it needs to be balanced against the legitimate rights of an employer to operate its business.
To continue monitoring, employers need to ensure they comply with 4 of the 6 principles as follows.
Principles of compliance
- Necessity: employers must have demonstrated that the tracking is necessary.
- Legitimacy: the processing must be fair and they must have identified the legal basis upon which they track data.
- Proportionality: the collection and processing must be proportionate to the issue the employer is trying to manage.
- Transparency: employees must be clearly informed.
What the data subject must be informed of
As part of the transparency requirement, employers must inform employees of the following, which may be covered under the ‘Driving on Company Business Policy’:
- Reasons and purposes for which the surveillance is being carried out. If employees can use the vehicles for private use, then reasons for monitoring should be limited and specific such as to ensure security.
- The details of surveillance measures taken.
- The details of any enforcement procedures.
- The details of how and when drivers will be notified that they may have breached policy or procedures .
Do you need consent?
You will not need to rely on consent if you have a ‘legitimate interest’ or another one of the lawful bases for processing personal data.