The permissibility of GPS tracking
A quite important ruling on the use of company vehicles – especially for field staff who are also allowed to use their vehicles privately – has been issued by the Administrative Court of Lüneburg.
Attorneys Anna-Lena Glander and Alexa Finke, LL.M. of Heuking Kühn Lüer Wojtek have written an exciting article about the ruling of the Administrative Court of Lüneburg.
The permissibility of GPS tracking from a compliance perspective.
“Strict data protection requirements apply to the use of tracking systems both in the employment context and in cooperation with other companies. Recently, the VG Lüneburg ruled in a partial judgment dated March 19, 2019, applying the provisions of the General Data Protection Regulation and the new Federal Data Protection Act, that unrestricted tracking of employee vehicles was impermissible.
This ruling gives reason to shed light on the permissibility of using such systems from a compliance perspective: Companies must ensure that when tracking systems are used to process the data of their employees or third parties, there is a data protection law permitting the processing of the tracking data. Otherwise, there is a risk that the company will be prosecuted for breaches of data protection obligations.
In the case underlying the ruling, the plaintiff, which operates a building cleaning company, had equipped its company vehicles, which were used by the property managers, cleaners and janitors employed by the company for both business and private purposes, with GPS systems.
The license plate numbers of the vehicles were recorded, which could be assigned to the respective company users. Over a longer period of time, the tracking systems were used to store every route driven by the respective employees with start and destination points, including the time driven and the status of the ignition. The tracking system could not be switched off or on by the employees; deactivating the system after work and before work was only possible with considerable effort.
The VG Lüneburg ruled
that the constant recording of employees’ position data, even outside working hours, was not in line with applicable data protection law. In this case, such extensive processing of the location data could not be based on the permissive element of Section 26 (1) BDSG, as the data processing was not necessary for the purposes of the employment relationship. The obligation to keep a logbook is sufficient in such cases.
The processing of the tracking data could also not be based on the permissibility of consent pursuant to Section 26 (2) BDSG, as the consent was not sufficiently voluntary. This was already lacking, since the responsible party failed to inform its employees about the comprehensive tracking.”
These are the most important statements of the two lawyers. You can find the complete article here.
The judgment of the VG Lüneburg can be found here.
Further information from law firm Heuking Kühn Lüer Wojtek on the subject of compliance can be accessed or obtained under this link, further information on the subject of data protection under this link.
_________________________________________________________________________________
Would you like to benefit from information, analyses and comments on software products as well as events concerning CRM and DSGVO free of charge twice a month in the future? Then register here for the CRM-Tech.World newsletter!
