High hurd­les for pro­ces­sing GPS data from vehicles

In its jud­ge­ment of 17 Janu­ary 2022 (Case 6 K 1164/21.WI) (only in Ger­man), the Admi­nis­tra­ti­ve Court (VG) of Wies­ba­den set high hurd­les under data pro­tec­tion law for GPS moni­to­ring of vehic­les. The decis­i­on is high­ly rele­vant for com­pa­nies that pro­cess loca­ti­on data from vehic­les or machi­nes, and also of inte­rest bey­ond that, as our ana­ly­sis shows.

Sta­te of affairs

The legal dis­pu­te was based on a com­plaint by a logi­stics com­pa­ny against a decis­i­on by the Hes­si­an data pro­tec­tion super­vi­so­ry aut­ho­ri­ty. The lat­ter had pre­vious­ly issued a noti­ce requi­ring the com­pa­ny to bring the pro­ces­sing of GPS data into line with the Gene­ral Data Pro­tec­tion Regu­la­ti­on (GDPR). The reason for the noti­ce was that the logi­stics com­pa­ny had pro­ces­sed data for track­ing its com­pa­ny vehic­les via an SaaS cloud solu­ti­on. The soft­ware used also enab­led mea­su­re­ment of fuel con­sump­ti­on and manage­ment of the tachograph.

Within the frame­work of the offi­ci­al pro­ce­du­re and the rela­ted sub­mis­si­on of the pro­ces­sing list, the com­pa­ny spe­ci­fied as the pur­po­ses of pro­ces­sing that the geo-tracking of the vehic­les ser­ves to faci­li­ta­te inter­ven­ti­on in the case of misu­se or theft and that the moni­to­ring of gaso­li­ne con­sump­ti­on and fuel levels in the tanks ser­ves to detect fuel theft. Coor­di­na­ti­on of sepa­ra­te pick­ups was also spe­ci­fied as an orga­ni­sa­tio­nal pur­po­se for track­ing. In addi­ti­on to the con­sent of the employees con­cer­ned, the com­pa­ny cited a legal obli­ga­ti­on to use a tacho­graph and a legi­ti­ma­te inte­rest as the legal basis.

The data pro­tec­tion super­vi­so­ry aut­ho­ri­ty did not fol­low this reaso­ning and asses­sed the data pro­ces­sing as not GDPR-compliant and unlawful. It issued an order requi­ring the com­pa­ny, among other things, to refrain from sto­ring GPS data and to dele­te the data alre­a­dy coll­ec­ted. In addi­ti­on, the com­pa­ny was requi­red to inform the employees con­cer­ned and to keep an updated regis­ter of pro­ces­sing acti­vi­ties and to sub­mit an up-to-date data pro­tec­tion impact assess­ment (only in Ger­man). The com­pa­ny filed a com­plaint against the decis­i­on with the Admi­nis­tra­ti­ve Court of Wiesbaden.

Court decis­i­on

The Admi­nis­tra­ti­ve Court of Wies­ba­den dis­missed the com­plaint. The decis­i­on of the Hes­si­an data pro­tec­tion super­vi­so­ry aut­ho­ri­ty was lawful, the Admi­nis­tra­ti­ve Court ruled, becau­se the logi­stics company’s data pro­ces­sing vio­la­ted the GDPR. In the Court’s view, the track­ing of vehic­les over­all con­sti­tu­tes  per­so­nal data pro­ces­sing, sin­ce the dri­ver is iden­ti­fia­ble through the allo­ca­ti­on of the vehic­le assi­gned to him. The­re was no legal basis for the pro­ces­sing. The logi­stics com­pa­ny had not obtai­ned the employee’s con­sent. In addi­ti­on, the Court also indi­ca­ted that it has doubts as to whe­ther the draft con­sent sub­mit­ted by the com­pa­ny is per­mis­si­ble at all, as the­re is a lack of a simi­lar inte­rest on the part of the com­pa­ny and the employees.

In the opi­ni­on of the Admi­nis­tra­ti­ve Court, the­re is also no legal obli­ga­ti­on to pro­cess the data. For some employees, for exam­p­le, the com­pa­ny is not even requi­red to keep records of dri­ving and rest times. For employees whe­re the­re is an obli­ga­ti­on to do so, data coll­ec­tion bey­ond that recor­ded by the tacho­graph is not requi­red. In par­ti­cu­lar, it was not requi­red by law to record the exact location.

No legi­ti­ma­te inte­rest of the com­pa­ny could be iden­ti­fied eit­her, as the data pro­ces­sing was evi­dent­ly dis­pro­por­tio­na­te. Accor­ding to the Admi­nis­tra­ti­ve Court of Wies­ba­den, this fol­lows from the fact that the data were stored in secret. The employees would the­r­e­fo­re have no know­ledge of the con­stant moni­to­ring, so that the pro­ces­sing was not being car­ri­ed out in good faith (only in Ger­man). Yet, even in the case of open sur­veil­lan­ce, the Court added, the data pro­ces­sing would be unlawful. Thus, while the inte­rests in effi­ci­ent rou­ting, pre­ven­ti­on of theft, and pre­ser­va­ti­on of evi­dence in civil liti­ga­ti­on are legi­ti­ma­te, data reten­ti­on is not likely to fur­ther tho­se purposes.

Rele­van­ce for companies

The decis­i­on is of inte­rest far bey­ond the logi­stics indus­try. It is par­ti­cu­lar­ly note­wor­t­hy that the Admi­nis­tra­ti­ve Court of Wies­ba­den indi­ca­ted that con­sent in asym­me­tri­cal rela­ti­onships such as tho­se bet­ween employ­ers and employees is pro­ble­ma­tic from the out­set, unless spe­cial cir­cum­s­tances lead to the exis­tence of simi­lar inte­rests. The­r­e­fo­re, com­pa­nies must invo­ke other jus­ti­fi­ca­ti­ons vis-à-vis their employees.

The Court made it clear that per­ma­nent sto­rage of GPS data in vehic­les is only per­mis­si­ble under nar­row pre­re­qui­si­tes. This aspect of the decis­i­on also affects manu­fac­tu­r­ers and ope­ra­tors of all types of vehic­les. Com­pa­nies should the­r­e­fo­re alre­a­dy take into account the data pro­tec­tion requi­re­ments for the pro­ces­sing of the cor­re­spon­ding data during pro­duct deve­lo­p­ment.

Howe­ver, the decis­i­on also shows that the sto­rage of GPS track­ing data is not ruled out in all cases. Com­pa­nies can influence the weig­hing of inte­rests pur­su­ant to Artic­le 6(1)f of the GDPR in their favor by, for exam­p­le, ensu­ring that data is not stored for a dis­pro­por­tio­na­te­ly long peri­od of time by means of an era­su­re con­cept and by ensu­ring trans­pa­ren­cy through the pro­vi­si­on of data pro­tec­tion information.


Stay up-to-date

We use your email address exclusively for sending our newsletter. You have the right to revoke your consent at any time with effect for the future. For further information, please refer to our privacy policy.