On the 25th of May, the Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) came into effect. As most of the transport companies have applications allowing them to determine the location of their vehicles, the questions appear if using such solutions is personal data processing.
Firstly, it is worth revisiting the definition of personal data. According to GDPR, it is the information about an identified or identifiable natural person. And an identified or identifiable natural person is someone who can be directly or indirectly identified by reference to an identifier such as a name, an identification number, location data, an online identifier (…).
The definition contained in GDPR clearly states that data about the location is personal data. Of course, a question may arise: how can it be considered as personal data if we track a vehicle? The answer is simple: a particular vehicle can be connected with a particular employee.
If the data about the location are personal data, then using systems or applications allowing to track vehicles, and thus employees will be personal data processing. So, how to process these data in accordance with the law?
When is the employee’s consent necessary?
The basic question which arises in the light of GDRP, when processing such personal data, is whether we need the consent of the employee to process data or it is sufficient to simply inform them about it. As usual, the answer is not straightforward: in some cases, consent will be required and in some not.
Let’ start with a situation when such consent is not necessary. If the system tracks the employee only when they perform their duties, that is during driving, it is sufficient to inform them about it.
A problem comes up when our system/application works non-stop, and usually, this is the case, and there is a possibility to track the vehicle and, at the same time, also the employee during their breaks at work. In such a case, processing location data may violate their privacy.
Does it mean that we cannot use such systems? The answer is: yes, we can, but it is not enough to only inform the employee about processing their location data. We need an express consent that we (employer), as an administrator, may process their data.
To sum up, in case of having a vehicle tracking system, the best solution is to receive consent from the employee for processing their personal data. We should remember that the consent has to be express and unequivocal and that the document given to the employee to be signed should include, among other things, the information about the aim of such data processing.
Photo: Pixabay.com/CC0 Creative Commons