GPS Vehicle Tracking and UK GDPR: What Employers Should Consider

Can an employer use GPS tracking in company vehicles?

Vehicle tracking is not automatically prohibited. The important question is whether the monitoring is lawful, fair, transparent and proportionate for the purpose the employer is trying to achieve.

The Information Commissioner's Office provides specific guidance on monitoring workers and on tracking work vehicles. Employers should identify their purpose and lawful basis, tell workers about the monitoring and avoid collecting more information than is necessary.

Tell workers what is being monitored

Transparency is fundamental. Drivers should understand what information is collected, why it is collected, how it will be used, who can access it and how long it will be retained.

A written vehicle-tracking or employee-monitoring policy can help establish those expectations and reduce misunderstandings later.

Be particularly careful with private vehicle use

If a company vehicle is also permitted for private use, continuous tracking outside working activity can create a much greater privacy concern. ICO guidance says employers will rarely be able to justify monitoring private use simply because a tracking system is installed in the vehicle.

Businesses should therefore consider how tracking behaves outside working periods and whether workers have an appropriate way to prevent unnecessary private monitoring where the circumstances require it.

Collect only the information you need

A fleet manager may need vehicle location and journey information for dispatch, security or operational control. That does not automatically mean every possible telematics event should be collected and retained indefinitely.

Data minimisation means matching the information collected to the actual business purpose.

Set sensible access controls

Tracking data should not be available to everyone simply because the platform technically allows it. Decide which managers need access and what level of detail is appropriate to their role.

This is especially relevant where journey records could be used in disciplinary, performance or attendance decisions.

Decide how long tracking records are needed

Retention should also be tied to purpose. Some businesses need historic journeys to answer customer queries or verify work, but that does not mean data should be retained forever. Document the retention period and review whether it remains necessary.

When might a DPIA be relevant?

The ICO expects organisations to consider a Data Protection Impact Assessment where monitoring is likely to create a high risk to workers' rights and freedoms. The appropriate assessment depends on the nature, scale and intrusiveness of the monitoring.

Do not treat GPS tracking as secret surveillance

For normal fleet-management use, hidden monitoring is generally the wrong starting point. Employees should normally know that the vehicle is tracked and understand the business purposes for doing so.

Useful operational purposes for fleet tracking

Subject to appropriate data-protection controls, businesses commonly use fleet information for purposes such as:

• Dispatch and vehicle location.
• Journey and route records.
• Customer service and job verification.
• Vehicle security and theft awareness.
• Operational reporting.
• Driver-safety initiatives where appropriately implemented.

Official guidance

For current legal guidance, consult the ICO employment monitoring guidance and the relevant GOV.UK worker-monitoring guidance.