This article covers Polish regulations and market practice. The principles apply elsewhere, but check the rules in your country.
Business owners and fleet managers who want to implement GPS tracking systems often run into a barrier: a lack of knowledge about which provisions of the GDPR and the Labour Code apply to vehicle tracking, and what obligations arise from these regulations.
This leads to questions about how the applicable regulations should be interpreted and applied in the context of modern tracking technology. We explain the key information that will help you understand how to implement GPS tracking systems in fleets correctly, while remaining fully GDPR-compliant.
What does GPS tracking give you?
A GPS tracking system collects a range of important information from vehicles, opening up broad opportunities to improve management and decision-making. Among other things, GPS tracking makes it possible to:
- Record employees' working time
- Monitor routes and analyse data
- Verify drivers' driving style
- Increase safety
- Optimise costs
- Prevent abuse
- Settle journeys conveniently
Many arguments speak in favour of equipping a fleet with GPS systems. But is it always allowed? Which legal guidelines must we pay attention to when making such a decision?
When can GPS tracking be introduced?
Introducing GPS tracking in company vehicles must be justified by the company's specific organisational and operational needs. The GDPR does not prohibit the use of GPS tracking in company vehicles, but the employer must above all bear in mind the protection of employees' privacy and compliance with the applicable labour law and the GDPR.
Under the regulations, vehicle tracking may be used to:
- ensure an organisation of work that allows working time to be used effectively,
- ensure proper use of the work tools made available to the employee,
- protect the employer's property.
Article 22(3) § 1 of the Polish Labour Code clearly states that GPS tracking may be introduced only when it is necessary to ensure an organisation of work that allows full use of working time and proper use of the work tools made available to the employee. In practice this means that tracking an employee's location must be justified by specific needs related to the organisation of work and the efficient and safe use of company vehicles.
In the context of GPS tracking, permissible purposes include:
- planning drivers' tasks in a way that allows working time to be used to the full, for example by optimising routes,
- ensuring proper use by the driver of the work tools entrusted to them, which may include an eco-driving policy promoting an environmentally friendly driving style.
Which regulations apply to GPS tracking?
Among the regulations, the General Data Protection Regulation (GDPR) and the provisions of the Labour Code occupy a key place. These two sets of legal norms define when and how an employer may monitor its employees, and what conditions must be met for such action to be lawful.
What is the GDPR and why does it apply?
The GDPR, the General Data Protection Regulation (in Poland known as RODO), is the key document for the protection of personal data in the European Union. Its main aim is to harmonise the rules on personal data protection, guaranteeing all natural persons control over their own data.
In the context of GPS tracking, the GDPR applies because the geolocation data collected makes it possible to identify the employee, which makes this information personal data. Consequently, all activities related to GPS tracking of company vehicles must comply with the requirements of the GDPR, which ensures the protection of employees' privacy and the lawfulness of processing their data.
In which situations does the Labour Code apply?
Under Article 22(3) § 4 of the Labour Code, the rules on the use of monitoring laid down for video surveillance and email also apply to other forms of monitoring, such as GPS, provided their use is necessary to achieve the purposes set out in the regulations. It is important to remember, however, that where an employee also uses a company vehicle for private purposes, the employer needs to obtain the employee's consent to GPS tracking. This is related to the protection of the employee's privacy outside working hours.
The employer's obligations
When implementing GPS tracking in company vehicles, employers face a number of obligations that must be met for the whole process to comply with the applicable legal regulations. Key here is the information obligation under the GDPR, which concerns the processing of personal data as part of GPS tracking.
What must the employee be informed about?
Informing employees about the purposes, rules and manner of GPS tracking is a key element. Every employer is obliged to provide employees with detailed information about the processing of their personal data collected by the GPS tracking system. This information should be communicated in the way customary in the organisation: in the work regulations or in other documents governing the relationship between employee and employer. It is worth stressing that these provisions can be expanded in the fleet policy.
The communication to employees should clearly state:
- Who will process the data: Identifying the entity responsible for data processing is key. If tracking is entrusted to an external company, its details must also be provided.
- How the data will be processed: The employer must describe how GPS tracking works, including how location data is collected and processed.
- What rights the employee has: This should include an explanation of the employee's rights regarding data processing, including the right to access, rectify and erase data, to restrict processing, and the right to data portability.
- How long the data will be stored: Specifying the retention period for location data is essential so that employees know how long their information will be kept in the system.
In addition, employees must be informed about the introduction of the GPS tracking system no later than 2 weeks before it starts. Every newly hired person should receive information about GPS tracking before starting work, which guarantees that from the very start of their employment they are aware of the existence of such a system and the rules associated with it.
It is extremely important that the employer ensures appropriate labelling of vehicles subject to GPS tracking. This step is intended not only to meet legal requirements but also to ensure transparency and openness in relations between the employer and employees. The label should be clear and legible so that every vehicle user is aware that their movements are being tracked.
When is the employee's consent required?
In the context of GPS tracking in company vehicles, simply informing the employee that such a system is in use is not always sufficient. There are situations in which the employee's explicit consent to the processing of their data as part of the tracking is essential. This need arises above all when the company car is used not only as a work tool but also constitutes a form of benefit.
In such cases, for GPS tracking to be lawful, the employee's consent to such processing of their personal data must be obtained. This consent must be explicit, informed and voluntary, which means the employee must be fully informed about the purposes and scope of the tracking before giving consent.
Private mode
With a dispersed and large fleet, collecting consent from all employees is a daunting task for the fleet manager. That is why GPS tracking solutions use a private mode feature. Private mode is a feature that protects drivers against tracking of private journeys, that is, the use of vehicles for private purposes. Once private mode is switched on, the application hides the current position and route history (including in individual reports and other features). When private mode is implemented for GPS tracking of fleet vehicles, the employee's consent is not required.
Summary
Implementing a GPS tracking system in a company is a great way to streamline fleet management, offering not only access to current odometer readings and control of private mileage but also verification of vehicle locations. To enjoy the full benefits of this solution, however, it is key not only to invest in the right devices and applications but above all to comply with the GDPR and the Labour Code.
The checklist below will help you make sure you do not overlook anything on the way to building an effective, compliant GPS tracking system:
- Define the purpose of tracking: is GPS tracking necessary for the organisation of work and the use of vehicles?
- Describe the tracking rules: scope, data processing methods and retention period.
- Inform employees about GPS tracking at least 2 weeks before its implementation.
- Remember to inform new employees about tracking before they start work.
- Label tracked vehicles clearly and legibly.
- Obtain consent from employees when the car is also used for private purposes and your tracking system has no private mode.
