Vehicle Tracking & Data Protection Laws

When can you process data?

The lawful basis for processing data is set out in Article 6 of the General Data Protection Regulation (GDPR). Most lawful bases require that processing is ‘necessary’ for a specific purpose. If you reasonably achieve the same purpose without the processing of the data, you will not have a lawful basis.

To lawfully process data at least one of the below must apply:

1. Consent – the individual has given clear consent for you to process their personal data for a specific purpose;
2. Contract – the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract;
3. Legal obligation – the processing is necessary for you to comply with the law (not including contractual obligations);
4. Vital interests – the processing is necessary to protect someone’s life;
5. Public task – the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law; and/or
6. Legitimate interests – the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data, which overrides those legitimate interests (this cannot apply if you are a public authority processing data to perform your official tasks).

Vehicle tracking and data protection laws

Business vehicle tracking

Provided you can prove that one of the above bases applies as an employer you can legally track your employees’ business vehicles.

By tracking an employees’ business vehicle you are processing their personal data in line with the Data Protection Act 2018 (DPA 2018) and GDPR. You therefore need to ensure that you are compliant with both the DPA 2018 and GDPR.

As an employer, you must clearly inform your employees that there is a tracking device installed on their company vehicle and that their location is being tracked whilst using the vehicle.

It becomes more difficult where the employer allows private use of a business vehicle. The employer is unlikely to be able to prove that it is necessary to monitor the locations of the vehicle outside of working hours. It is therefore good practice as an employer to ensure that the employee can turn off the location tracking services outside of working hours.

Private vehicle tracking

Tracking someone’s personal vehicle without his or her consent is illegal.

Not only is it illegal, it is also contrary to the DPA 2018 and GDPR as it could not fall within one of the six lawful circumstances in which you can process personal data. In such circumstances, the GDPR gives a Data Subject the right to request that the data is erased in its entirety and/or that they are compensated accordingly.