Employee vehicle tracking: navigating UK Data Protection Laws

As vehicle tracking becomes increasingly prevalent in business operations, employers must navigate the complexities of the UK Data Protection Laws to ensure compliance when implementing tracking systems on employees vehicles.

The legal background

Many businesses use global positioning systems (GPS) to track employee vehicles, for improving efficiency and ensuring certain targets or metrics are achieved. However, employers need to ensure that any vehicle tracking does not fall foul of the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (together, the “UK Data Protection Laws”). Fines under the UK Data Protection Laws can be up to £17.5 million or 4% of a business’ total worldwide annual turnover, whichever is greater. 

Under the UK Data Protection Laws, any data that can be used to identify an individual, including location data, is considered personal data (as defined in the UK Data Protection Laws). This means that vehicle tracking data cannot be processed without a lawful basis for doing so.

It is important to note that vehicle tracking technology cannot be used to monitor employees generally, the data must be used for a legitimate business purpose and within the context of the employee’s job. On that basis, the grounds which are likely to be relevant in a vehicle tracking context are explored below:

Consent

An employee’s consent must be given for vehicle tracking to be enabled, however, it is unlikely to constitute a lawful basis under the UK Data Protection Laws on its own due to the nature of the power imbalance in the employee and employer relationship.  Consent can only be relied upon in very exceptional circumstances and where this is applicable employees must have a genuine choice on whether they consent to the tracking of their vehicle and they must be able to withdraw this consent at any time.

Necessity to comply with legal obligation

Certain employers have statutory obligations to fulfil. For example, recording information about driving time, speed, and distance to ensure compliance with the rules on drivers' working hours.

Legitimate interests

In deciding whether there is a legitimate interest for processing vehicle data, an employer must balance its legitimate interests and the necessity of collecting such data against the rights and freedoms of its employees. Employees have the right to object to any processing carried out on the grounds of a “legitimate interest”, in which case employers can only continue with tracking where it is necessary to achieve a compelling legitimate interest which overrides the employees’ rights. 

Implementing a Vehicle Tracking Policy

Accordingly, it is essential that any business intending to use vehicle tracking should have a relevant policy in place, linked to the principles of data protection. Any vehicle tracking data should be:

Processed in a lawful, fair and transparent manner

The data should only be monitored in a way which employees would reasonably expect. Carrying out a Data Protection Impact Assessment (DPIA) can help employers decide if vehicle tracking is fair in the circumstances. 

Collected for a specified, explicit or legitimate interest

Before implementing vehicle tracking, employees need to be clearly informed about what data is being collected, the reason for its collection, and how this data will be used. The data cannot be used for any further purposes without first informing the employees. 

Limited to what is necessary

If the employee uses the vehicle for personal use outside of work hours, then it is unlikely the collection of this data would be for a legitimate purpose. Therefore, employees should have the ability to disable GPS tracking outside of working hours.

Accurate and kept up to date

An employer should take reasonable steps to ensure the data is accurate and be able to justify the length of time the data is retained.

Processed in a manner that ensures appropriate security of the personal data

Access to the vehicle tracking data should be limited to those trained to handle the collected data.

Key points for employers

In conclusion, businesses that use GPS to track employee vehicles must ensure compliance with the UK Data Protection Laws. Employers need to establish a valid lawful basis to collect such data and implement a vehicle tracking policy that adheres to the data protection principles. It is key to ensure transparency by informing affected employees of how and why their vehicles are being monitored, including how the collected data is to be used.  Obtaining employee consent is crucial, and tracking should be strictly limited to working time only. By following these guidelines, businesses can ensure good data protection practices when utilising vehicle tracking systems.