Company vehicles are usually fitted with tracking devices using GPS (Global Positioning System). This can be an insurance requirement and brings down insurance costs, but tracker devices offer other benefits to companies in terms of operational efficiencies and safety and security benefits.
The information from a vehicle tracking device is personal data as defined by the General Data Protection Regulation (GDPR) meaning any information relating to an identifiable person who can be directly or indirectly identified. Location data is included in the definition.
This means that although there is a legitimate interest in collecting the data its use is strictly confined to stated organisational purposes only and, a clear workplace vehicle tracking policy is essential.
More so, Employees often consider tracking devices as highly intrusive and an infringement on their right to privacy, and poor communication with employees about the use of vehicle tracking can have a negative impact and cause resentment, suspicion and insecurity within the workforce if clarity is lacking on the way the company is using information from its tracking devices.
If a company vehicle is provided for both private and business use, a privacy button ought to be available to enable monitoring to be disabled. Otherwise, the express consent of the employee must be obtained for continuous monitoring.
A workplace policy should be set out the details of the nature and extent of monitoring and each employee should consent in writing to the presence of the device. The policy should clarify what private use can be made of vehicles provided by, or on behalf of, the employer, and any conditions attached to use.
It is important that workers using the vehicles are aware of the policy. It should be completely transparent, and all employees should be aware of the presence of tracking devices in the vehicles the use. The purpose of the devices should be clearly explained and the rules on their use including what data the system can provide and how the data gathered will be used by managers, supervisors, the Transport Unit, and even clients and the general public if the case.
Failure to ensure there is clarity around the use of tracking information could result in a breach of data protection regulations, or human rights and employment rights legislation, so a well written company policy is essential.
On average 55 vulnerabilities are identified daily.
What can I do?
Review your organisations priorities and ask ‘can we afford a breach?’. What do I do during an incident? Who do I involve? When do I involve the ICO?
If you’re unable to answers these questions, you need help from the experts.
