In its judgement of 17 January 2022 (Case 6 K 1164/21.WI) (only in German), the Administrative Court (VG) of Wiesbaden set high hurdles under data protection law for GPS monitoring of vehicles. The decision is highly relevant for companies that process location data from vehicles or machines, and also of interest beyond that, as our analysis shows.
State of affairs
The legal dispute was based on a complaint by a logistics company against a decision by the Hessian data protection supervisory authority. The latter had previously issued a notice requiring the company to bring the processing of GPS data into line with the General Data Protection Regulation (GDPR). The reason for the notice was that the logistics company had processed data for tracking its company vehicles via an SaaS cloud solution. The software used also enabled measurement of fuel consumption and management of the tachograph.
Within the framework of the official procedure and the related submission of the processing list, the company specified as the purposes of processing that the geo-tracking of the vehicles serves to facilitate intervention in the case of misuse or theft and that the monitoring of gasoline consumption and fuel levels in the tanks serves to detect fuel theft. Coordination of separate pickups was also specified as an organisational purpose for tracking. In addition to the consent of the employees concerned, the company cited a legal obligation to use a tachograph and a legitimate interest as the legal basis.
The data protection supervisory authority did not follow this reasoning and assessed the data processing as not GDPR-compliant and unlawful. It issued an order requiring the company, among other things, to refrain from storing GPS data and to delete the data already collected. In addition, the company was required to inform the employees concerned and to keep an updated register of processing activities and to submit an up-to-date data protection impact assessment (only in German). The company filed a complaint against the decision with the Administrative Court of Wiesbaden.
The Administrative Court of Wiesbaden dismissed the complaint. The decision of the Hessian data protection supervisory authority was lawful, the Administrative Court ruled, because the logistics company’s data processing violated the GDPR. In the Court’s view, the tracking of vehicles overall constitutes personal data processing, since the driver is identifiable through the allocation of the vehicle assigned to him. There was no legal basis for the processing. The logistics company had not obtained the employee’s consent. In addition, the Court also indicated that it has doubts as to whether the draft consent submitted by the company is permissible at all, as there is a lack of a similar interest on the part of the company and the employees.
In the opinion of the Administrative Court, there is also no legal obligation to process the data. For some employees, for example, the company is not even required to keep records of driving and rest times. For employees where there is an obligation to do so, data collection beyond that recorded by the tachograph is not required. In particular, it was not required by law to record the exact location.
No legitimate interest of the company could be identified either, as the data processing was evidently disproportionate. According to the Administrative Court of Wiesbaden, this follows from the fact that the data were stored in secret. The employees would therefore have no knowledge of the constant monitoring, so that the processing was not being carried out in good faith (only in German). Yet, even in the case of open surveillance, the Court added, the data processing would be unlawful. Thus, while the interests in efficient routing, prevention of theft, and preservation of evidence in civil litigation are legitimate, data retention is not likely to further those purposes.
Relevance for companies
The decision is of interest far beyond the logistics industry. It is particularly noteworthy that the Administrative Court of Wiesbaden indicated that consent in asymmetrical relationships such as those between employers and employees is problematic from the outset, unless special circumstances lead to the existence of similar interests. Therefore, companies must invoke other justifications vis-à-vis their employees.
The Court made it clear that permanent storage of GPS data in vehicles is only permissible under narrow prerequisites. This aspect of the decision also affects manufacturers and operators of all types of vehicles. Companies should therefore already take into account the data protection requirements for the processing of the corresponding data during product development.
However, the decision also shows that the storage of GPS tracking data is not ruled out in all cases. Companies can influence the weighing of interests pursuant to Article 6(1)f of the GDPR in their favor by, for example, ensuring that data is not stored for a disproportionately long period of time by means of an erasure concept and by ensuring transparency through the provision of data protection information.back