High hurd­les for pro­ces­sing GPS data from vehicles

In its jud­ge­ment of 17 Janu­a­ry 2022 (Case 6 K 1164/21.WI) (only in Ger­man), the Admi­nis­tra­ti­ve Court (VG) of Wies­ba­den set high hurd­les under data pro­tec­tion law for GPS moni­to­ring of vehi­cles. The decisi­on is high­ly rele­vant for com­pa­nies that pro­cess loca­ti­on data from vehi­cles or machi­nes, and also of inte­rest bey­ond that, as our ana­ly­sis shows.

Sta­te of affairs

The legal dis­pu­te was based on a com­p­laint by a logistics com­pa­ny against a decisi­on by the Hes­si­an data pro­tec­tion super­vi­so­ry aut­ho­ri­ty. The lat­ter had pre­vious­ly issued a noti­ce requi­ring the com­pa­ny to bring the pro­ces­sing of GPS data into line with the Gene­ral Data Pro­tec­tion Regu­la­ti­on (GDPR). The rea­son for the noti­ce was that the logistics com­pa­ny had pro­ces­sed data for tracking its com­pa­ny vehi­cles via an SaaS cloud solu­ti­on. The soft­ware used also enab­led mea­su­re­ment of fuel con­sump­ti­on and manage­ment of the tachograph.

Wit­hin the frame­work of the offi­cial pro­ce­du­re and the rela­ted sub­mis­si­on of the pro­ces­sing list, the com­pa­ny spe­ci­fied as the pur­po­ses of pro­ces­sing that the geo-tracking of the vehi­cles ser­ves to faci­li­ta­te inter­ven­ti­on in the case of misu­se or theft and that the moni­to­ring of gaso­li­ne con­sump­ti­on and fuel levels in the tanks ser­ves to detect fuel theft. Coör­di­na­ti­on of sepa­ra­te pick­ups was also spe­ci­fied as an orga­ni­sa­tio­nal pur­po­se for tracking. In addi­ti­on to the con­sent of the employees con­cer­ned, the com­pa­ny cited a legal obli­ga­ti­on to use a tacho­graph and a legi­ti­ma­te inte­rest as the legal basis.

The data pro­tec­tion super­vi­so­ry aut­ho­ri­ty did not fol­low this rea­so­ning and asses­sed the data pro­ces­sing as not GDPR-compliant and unlaw­ful. It issued an order requi­ring the com­pa­ny, among other things, to refrain from sto­ring GPS data and to dele­te the data alrea­dy collec­ted. In addi­ti­on, the com­pa­ny was requi­red to inform the employees con­cer­ned and to keep an updated regis­ter of pro­ces­sing acti­vi­ties and to sub­mit an up-to-date data pro­tec­tion impact assess­ment (only in Ger­man). The com­pa­ny filed a com­p­laint against the decisi­on with the Admi­nis­tra­ti­ve Court of Wiesbaden.

Court decisi­on

The Admi­nis­tra­ti­ve Court of Wies­ba­den dis­mis­sed the com­p­laint. The decisi­on of the Hes­si­an data pro­tec­tion super­vi­so­ry aut­ho­ri­ty was law­ful, the Admi­nis­tra­ti­ve Court ruled, becau­se the logistics company’s data pro­ces­sing vio­la­ted the GDPR. In the Court’s view, the tracking of vehi­cles over­all con­sti­tu­tes  per­so­nal data pro­ces­sing, sin­ce the dri­ver is iden­ti­fia­ble through the allo­ca­ti­on of the vehi­cle assi­gned to him. The­re was no legal basis for the pro­ces­sing. The logistics com­pa­ny had not obtai­ned the employee’s con­sent. In addi­ti­on, the Court also indi­ca­ted that it has doubts as to whe­ther the draft con­sent sub­mit­ted by the com­pa­ny is per­mis­si­ble at all, as the­re is a lack of a simi­lar inte­rest on the part of the com­pa­ny and the employees.

In the opi­ni­on of the Admi­nis­tra­ti­ve Court, the­re is also no legal obli­ga­ti­on to pro­cess the data. For some employees, for examp­le, the com­pa­ny is not even requi­red to keep records of dri­ving and rest times. For employees whe­re the­re is an obli­ga­ti­on to do so, data collec­tion bey­ond that recor­ded by the tacho­graph is not requi­red. In par­ti­cu­lar, it was not requi­red by law to record the exact location.

No legi­ti­ma­te inte­rest of the com­pa­ny could be iden­ti­fied eit­her, as the data pro­ces­sing was evi­dent­ly dis­pro­por­tio­na­te. Accord­ing to the Admi­nis­tra­ti­ve Court of Wies­ba­den, this fol­lows from the fact that the data were stored in secret. The employees would the­re­fo­re have no know­ledge of the con­stant moni­to­ring, so that the pro­ces­sing was not being car­ri­ed out in good faith (only in Ger­man). Yet, even in the case of open sur­veil­lan­ce, the Court added, the data pro­ces­sing would be unlaw­ful. Thus, while the inte­rests in effi­ci­ent rou­ting, pre­ven­ti­on of theft, and pre­ser­va­ti­on of evi­dence in civil liti­ga­ti­on are legi­ti­ma­te, data reten­ti­on is not likely to fur­ther tho­se purposes.

Rele­van­ce for companies

The decisi­on is of inte­rest far bey­ond the logistics indus­try. It is par­ti­cu­lar­ly note­wor­thy that the Admi­nis­tra­ti­ve Court of Wies­ba­den indi­ca­ted that con­sent in asym­metri­cal rela­ti­ons­hips such as tho­se bet­ween employ­ers and employees is pro­ble­ma­tic from the out­set, unless spe­cial cir­cum­s­tan­ces lead to the exis­tence of simi­lar inte­rests. The­re­fo­re, com­pa­nies must invo­ke other jus­ti­fi­ca­ti­ons vis-à-vis their employees.

The Court made it clear that per­ma­nent sto­rage of GPS data in vehi­cles is only per­mis­si­ble under nar­row pre­re­qui­si­tes. This aspect of the decisi­on also affects manu­fac­tu­rers and ope­ra­tors of all types of vehi­cles. Com­pa­nies should the­re­fo­re alrea­dy take into account the data pro­tec­tion requi­re­ments for the pro­ces­sing of the cor­re­spon­ding data during pro­duct deve­lo­p­ment.

Howe­ver, the decisi­on also shows that the sto­rage of GPS tracking data is not ruled out in all cases. Com­pa­nies can influ­ence the weig­hing of inte­rests pur­suant to Arti­cle 6(1)f of the GDPR in their favor by, for examp­le, ensu­ring that data is not stored for a dis­pro­por­tio­na­te­ly long peri­od of time by means of an era­su­re con­cept and by ensu­ring trans­pa­ren­cy through the pro­vi­si­on of data pro­tec­tion information.

back

Stay up-to-date

We use your e-mail address exclusively for sending our newsletter. You have the right to revoke your consent at any time with effect for the future. For further information, please refer to our privacy policy.