GDPR in Fleet Management

Any data that can be linked to a particular person. This includes driving license details, logbook records, fuel and charging transactions, damage reports, and especially location data from telematics systems. Even data that appears to concern only a vehicle becomes personal data once the vehicle is permanently assigned to a driver.

Usually the company's legitimate interest or compliance with a legal obligation, such as driver's license checks. Employee consent is problematic in an employment relationship because it must be freely given and can be withdrawn at any time. The purpose, legal basis, and deletion period must be recorded for each processing activity.

Continuous tracking without a specific purpose is not permitted. Analyses proportionate to their purpose are permitted, such as odometer readings for maintenance planning or location data during working hours for dispatch. Movement profiles during personal time are not.

Where a works council exists, introducing such systems is subject to co-determination under § 87 paragraph 1 number 6 BetrVG. In practice, it is advisable to start work on the works agreement before selecting a system: the agreement defines which data may be collected at all and therefore limits the choice of systems.