High hurd­les for pro­ces­sing GPS data from vehicles

In its jud­ge­ment of 17 Janu­ary 2022 (Case 6 K 1164/21.WI) (only in Ger­man), the Admi­nis­tra­ti­ve Court (VG) of Wies­ba­den set high hurd­les under data pro­tec­tion law for GPS moni­to­ring of vehic­les. The decis­i­on is high­ly rele­vant for com­pa­nies that pro­cess loca­ti­on data from vehic­les or machi­nes, and also of inte­rest bey­ond that, as our ana­ly­sis shows.

Sta­te of affairs

The legal dis­pu­te was based on a com­plaint by a logi­stics com­pa­ny against a decis­i­on by the Hes­si­an data pro­tec­tion super­vi­so­ry aut­ho­ri­ty. The lat­ter had pre­vious­ly issued a noti­ce requi­ring the com­pa­ny to bring the pro­ces­sing of GPS data into line with the Gene­ral Data Pro­tec­tion Regu­la­ti­on (GDPR). The reason for the noti­ce was that the logi­stics com­pa­ny had pro­ces­sed data for track­ing its com­pa­ny vehic­les via an SaaS cloud solu­ti­on. The soft­ware used also enab­led mea­su­re­ment of fuel con­sump­ti­on and manage­ment of the tachograph.

Within the frame­work of the offi­ci­al pro­ce­du­re and the rela­ted sub­mis­si­on of the pro­ces­sing list, the com­pa­ny spe­ci­fied as the pur­po­ses of pro­ces­sing that the geo-tracking of the vehic­les ser­ves to faci­li­ta­te inter­ven­ti­on in the case of misu­se or theft and that the moni­to­ring of gaso­li­ne con­sump­ti­on and fuel levels in the tanks ser­ves to detect fuel theft. Coor­di­na­ti­on of sepa­ra­te pick­ups was also spe­ci­fied as an orga­ni­sa­tio­nal pur­po­se for track­ing. In addi­ti­on to the con­sent of the employees con­cer­ned, the com­pa­ny cited a legal obli­ga­ti­on to use a tacho­graph and a legi­ti­ma­te inte­rest as the legal basis.

The data pro­tec­tion super­vi­so­ry aut­ho­ri­ty did not fol­low this reaso­ning and asses­sed the data pro­ces­sing as not GDPR-compliant and unlawful. It issued an order requi­ring the com­pa­ny, among other things, to refrain from sto­ring GPS data and to dele­te the data alre­a­dy coll­ec­ted. In addi­ti­on, the com­pa­ny was requi­red to inform the employees con­cer­ned and to keep an updated regis­ter of pro­ces­sing acti­vi­ties and to sub­mit an up-to-date data pro­tec­tion impact assess­ment (only in Ger­man). The com­pa­ny filed a com­plaint against the decis­i­on with the Admi­nis­tra­ti­ve Court of Wiesbaden.

Court decis­i­on

The Admi­nis­tra­ti­ve Court of Wies­ba­den dis­missed the com­plaint. The decis­i­on of the Hes­si­an data pro­tec­tion super­vi­so­ry aut­ho­ri­ty was lawful, the Admi­nis­tra­ti­ve Court ruled, becau­se the logi­stics company’s data pro­ces­sing vio­la­ted the GDPR. In the Court’s view, the track­ing of vehic­les over­all con­sti­tu­tes  per­so­nal data pro­ces­sing, sin­ce the dri­ver is iden­ti­fia­ble through the allo­ca­ti­on of the vehic­le assi­gned to him. The­re was no legal basis for the pro­ces­sing. The logi­stics com­pa­ny had not obtai­ned the employee’s con­sent. In addi­ti­on, the Court also indi­ca­ted that it has doubts as to whe­ther the draft con­sent sub­mit­ted by the com­pa­ny is per­mis­si­ble at all, as the­re is a lack of a simi­lar inte­rest on the part of the com­pa­ny and the employees.

In the opi­ni­on of the Admi­nis­tra­ti­ve Court, the­re is also no legal obli­ga­ti­on to pro­cess the data. For some employees, for exam­p­le, the com­pa­ny is not even requi­red to keep records of dri­ving and rest times. For employees whe­re the­re is an obli­ga­ti­on to do so, data coll­ec­tion bey­ond that recor­ded by the tacho­graph is not requi­red. In par­ti­cu­lar, it was not requi­red by law to record the exact location.

No legi­ti­ma­te inte­rest of the com­pa­ny could be iden­ti­fied eit­her, as the data pro­ces­sing was evi­dent­ly dis­pro­por­tio­na­te. Accor­ding to the Admi­nis­tra­ti­ve Court of Wies­ba­den, this fol­lows from the fact that the data were stored in secret. The employees would the­r­e­fo­re have no know­ledge of the con­stant moni­to­ring, so that the pro­ces­sing was not being car­ri­ed out in good faith (only in Ger­man). Yet, even in the case of open sur­veil­lan­ce, the Court added, the data pro­ces­sing would be unlawful. Thus, while the inte­rests in effi­ci­ent rou­ting, pre­ven­ti­on of theft, and pre­ser­va­ti­on of evi­dence in civil liti­ga­ti­on are legi­ti­ma­te, data reten­ti­on is not likely to fur­ther tho­se purposes.

Rele­van­ce for companies

The decis­i­on is of inte­rest far bey­ond the logi­stics indus­try. It is par­ti­cu­lar­ly note­wor­t­hy that the Admi­nis­tra­ti­ve Court of Wies­ba­den indi­ca­ted that con­sent in asym­me­tri­cal rela­ti­onships such as tho­se bet­ween employ­ers and employees is pro­ble­ma­tic from the out­set, unless spe­cial cir­cum­s­tances lead to the exis­tence of simi­lar inte­rests. The­r­e­fo­re, com­pa­nies must invo­ke other jus­ti­fi­ca­ti­ons vis-à-vis their employees.

The Court made it clear that per­ma­nent sto­rage of GPS data in vehic­les is only per­mis­si­ble under nar­row pre­re­qui­si­tes. This aspect of the decis­i­on also affects manu­fac­tu­r­ers and ope­ra­tors of all types of vehic­les. Com­pa­nies should the­r­e­fo­re alre­a­dy take into account the data pro­tec­tion requi­re­ments for the pro­ces­sing of the cor­re­spon­ding data during pro­duct deve­lo­p­ment.

Howe­ver, the decis­i­on also shows that the sto­rage of GPS track­ing data is not ruled out in all cases. Com­pa­nies can influence the weig­hing of inte­rests pur­su­ant to Artic­le 6(1)f of the GDPR in their favor by, for exam­p­le, ensu­ring that data is not stored for a dis­pro­por­tio­na­te­ly long peri­od of time by means of an era­su­re con­cept and by ensu­ring trans­pa­ren­cy through the pro­vi­si­on of data pro­tec­tion information.