Choosing a fleet management system: a legal perspective

Choosing a fleet management system is an important decision. There are many criteria to consider when deciding. Today I will talk about the legal aspects relating to personal data, which tend to be marginalised even though oversights in this area can result in a heavy fine and reputational damage.

Entrusting the processing of personal data

A fleet management system collects personal data, e.g. of employees and drivers. The controller of that personal data is the entity using the system, e.g. the company.

The controller is responsible for the security and confidentiality of the personal data processed. A leak, a hacking attack or a similar incident exposes the controller to a fine of up to EUR 10 million or 2% of total turnover for the preceding financial year.

If the fleet management system is deployed on the controller's own infrastructure, the controller must take care of its security itself. Choosing a SaaS system, where the provider supplies the infrastructure, can make this easier.

In the latter case, however, it is key to conclude an appropriate data processing agreement with the system provider. Such an agreement must meet the requirements of the GDPR, but does not necessarily have to be in writing; it can also be concluded electronically.

With SaaS services, the data processing agreement is often concluded by accepting terms of service that include the rules of processing. That is why, before deciding on a system, you should read the documentation the provider makes available and make sure that the matter of entrusting data is properly addressed.

Vetting the processor

Concluding a data processing agreement does not in itself guarantee that the fleet management system provider actually takes care of the security of the personal data processed in the system.

The controller's duty is not only to conclude a processing agreement with the processor (the system provider), but above all to choose a processor that provides sufficient guarantees of implementing appropriate technical and organisational measures so that processing meets the requirements of the GDPR and protects the rights of data subjects.

This duty is fulfilled by vetting the processor, which may involve, for example, sending the processor a special questionnaire with questions aimed at establishing whether the processor meets the GDPR requirements.

In the reality of SaaS services, a questionnaire is not always feasible, but the minimum should be reviewing the processor's documentation for the measures applied to ensure the security of personal
data.

Such documentation (e.g. a list of technical and organisational measures to ensure appropriate security of personal data) does not necessarily have to be publicly available on the website, but the processor should provide it to the controller on request.

Vetting the processor matters because the controller may also be held liable for the consequences of the processor's
failings. That is why, when vetting the processor, you should aim for the highest possible level of due diligence.

Managing permissions and access scopes

Because personal data is processed in a fleet management system, the system should provide control over who can perform which operations on that personal data. For example, a manager is authorised to modify certain information, while an employee may only view it to a limited extent.

The scope of access and permissions should correspond to the rules developed in the company at the GDPR implementation stage. Sometimes dedicated rules are developed for a specific system because it differs from the other systems used for data processing. Most often, however, the aim is for procedures developed once to be applied universally, regardless of the technological solutions adopted.

Therefore, when choosing a fleet management system, you should verify what options it offers for controlling access to specific resources and the operations that can be performed on them, and make sure the system's functions allow a configuration that matches the procedures developed in this area.

Accountability for operations on data

One of the basic principles of the GDPR is accountability.

In the context of processing personal data in a fleet management system, this principle is fulfilled by ensuring that every operation performed on the data (e.g. entering information into the system, modifying it, deleting it) can be proven and attributed to a specific user.

For this to be possible, the system must first of all provide the ability to create individual accounts for every person who uses it.

It should never be the case that more than one person uses a single account, because this undermines accountability. Going further, the fleet management system should make it possible to reconstruct, e.g. from logs, which user performed which operations on the data and when.

Therefore, when choosing a fleet management system, you should verify what options it offers for managing users and recording their actions.

Retention of personal data

One of the most neglected areas of personal data is retention.

Businesses tend to keep data indefinitely, whereas a basic principle of the GDPR is to limit processing solely to the period when it is actually necessary, e.g. to perform a contract.

Data retention rules are a subject for an extensive guide, but in the context of choosing a fleet management system the key is to establish what options the system provides in this respect.

Although it seems obvious that a function as basic as deleting data should always be available in every IT system, sometimes the devil is in the detail; for example, it turns out to be impossible to delete a particular piece of information without erasing a larger whole.

Therefore, when choosing a fleet management system, you should verify what options it offers for deleting individual pieces of information stored in it.

Control over data

When using a fleet management system, its user should have full control over the resources they store in the system.

The system provider's role should be limited to performing the operations agreed with the client, most often storing the data.

Although it seems unimaginable that a fleet management system provider would try to use the data entrusted to it for its own purposes, to be sure you should check the terms of service for any questionable provisions on the use of the resources stored in the system. In the age of artificial intelligence, it is increasingly common for some business models to rely on using data provided by the user for machine learning.

Therefore, when choosing a fleet management system, you should verify whether the user has full control over the resources stored in the system and whether the provider might be tempted to make other use of those resources.

Handling data subject requests

The GDPR grants data subjects a number of rights, e.g. the right of access to their data, the right to obtain a copy of it and the right to rectification.

The entity responsible for fulfilling these rights is always the controller. Although the fleet management system provider has no specific obligations here, it may provide additional functions in the system that make handling such requests easier, e.g. easy export of the data stored about a specific user.

The absence of such functions is not a failing, but their presence can be an added value to consider when choosing.

Fulfilling the information obligation

Like handling data subject requests, fulfilling the information obligation under the GDPR can be an area where a fleet management system
offers added value.

For example, the system may offer the option of sending a message fulfilling the information obligation to a person whose data enters the system for the first time. This is admittedly no great revolution, given that the information obligation can be fulfilled in other ways, e.g. by e-mail, an annex to the contract or a document issued to the employee, but in some situations handling this process through the fleet management system may be a factor that makes the offer more attractive to a given entity.

Summary

Choosing a fleet management system is often limited to comparing functions and price. When deciding, however, it is also worth paying attention to the legal issues relating to data protection regulations (including the GDPR), because on the one hand the system can provide added value through certain additional solutions, and on the other, any shortcomings can result in liability, including financial liability, for mishandling personal data.