GPS tracking of drivers: what the GDPR, the works council and retention limits require

The live position carries several core processes in a transport operation. The arrival information given to a school or workshop. The re-planning when a driver calls in sick at 6:40 and twelve passengers have to be redistributed. The evidence provided to the Kostenträger (the public body funding the transport). These purposes will later carry the necessity test, provided somebody wrote them down beforehand.

The groups of data subjects need separating just as early. Each group has its own legal bases and its own retention periods.

• Drivers. Employee data protection, co-determination, protection against performance and conduct monitoring.
• Passengers. Frequently details of disability, care needs or treatment, and therefore special categories under Art. 9 GDPR.
• Relatives, institutions and funding bodies. Recipients of information about a particular journey, not observers of the driving staff.

The sharp edge does not run between tracking and no tracking. It runs between vehicle tracking for dispatch purposes and the analysis of the same data to assess individual people. As soon as the position trail says something about break length, driving style or punctuality rates, a second processing operation exists. It needs a legal basis of its own.

For years, Section 26(1) sentence 1 BDSG was the standard anchor for employee data. In its judgment of 30 March 2023 in case C-34/21, the European Court of Justice held that national rules on employee data protection must be disapplied, given the primacy of Union law, where they fail to observe the conditions and limits of Art. 88(1) and (2) GDPR. The case concerned a Hessian provision which, in the view of the court, merely restates necessity without adding safeguards of its own.

The Hessian Commissioner for Data Protection and Freedom of Information drew the practical conclusion. Because Section 26 BDSG and the Hessian provision are worded almost identically, Section 26(1) sentence 1 BDSG is probably incompatible with Art. 88 GDPR as well. For the private sector there is no replacement opening clause, which is why you have to fall back on the general grounds for processing in Art. 6(1) GDPR.

For vehicle tracking, that usually leads to Art. 6(1)(f) GDPR, the legitimate interest in dispatch, availability and evidence. The balancing exercise belongs in the file in writing. Anyone who describes the purpose with the word efficiency loses it. Anyone who writes down that dispatch cannot give a reliable arrival time without a live position, and that the receiving institution then has to tie up staff at the entrance, has an argument an auditor can follow.

Consent rarely works here. Section 26(2) BDSG requires the dependency inherent in an employment relationship to be taken into account, and the Data Protection Commissioner for Rhineland-Palatinate considers consent invalid for blanket monitoring because it is not freely given. A collective agreement is sturdier, because Section 26(4) BDSG expressly permits the processing of employee data on that basis.

Purpose limitation under Art. 5(1)(b) GDPR becomes concrete exactly where tracking happens without any operational reason. Your configuration and your Betriebsvereinbarung (works agreement between employer and works council) therefore need a list of the cases in which the system stays silent:

• during statutory breaks and after the last stop of a tour,
• where private use of the vehicle is permitted, which the Rhineland-Palatinate commissioner expressly excludes from tracking and for which he names the paper logbook as an alternative,
• while the vehicle is parked outside working hours, unless an anti-theft purpose exceptionally applies,
• on empty runs, where the dispatch purpose does not require it.

A second point is often missed. The sampling rate is itself a measure of intrusion. A dense per-second trail supports conclusions about driving style and standing times that a status event per stop does not. So check what sampling rate the arrival information genuinely needs, and record the result.

Yes. Under Section 87(1) no. 6 BetrVG, the works council has a co-determination right on the introduction and use of technical devices intended to monitor the conduct or performance of employees. According to settled case law of the Federal Labour Court, intended means objectively capable. It is therefore enough that the device can collect conduct or performance information. Surveillance intent is irrelevant, and nothing has to be stored either. The court confirmed that standard in its decision of 16 July 2024 (1 ABR 16/23) for a system that merely transmitted conversations live.

A GPS system that continuously records the positions of individual vehicles clears that bar without difficulty.

The right is enforceable. If no agreement is reached, the Einigungsstelle (a conciliation committee) acts on the application of either side under Section 76(5) BetrVG and replaces the agreement with its award. At municipal providers and public enterprises, the Personalrat (the staff council in the public sector) takes the place of the works council, at federal level via Section 80(1) no. 21 BPersVG, and in the individual states via their own staff representation acts, which differ in detail.

A works agreement that only permits the use of a telematics system helps nobody. It becomes useful once it describes the processing tightly enough to double as a legal basis under Section 26(4) BDSG.

• Purposes of the tracking, listed exhaustively, with an express exclusion of performance monitoring
• Scope of collection: which data fields, at which sampling rate, from when to when in each shift
• Access roles: who sees the live map, who sees the history, who sees nothing
• A ban on analysis with narrowly drawn exceptions, such as accident investigation
• Retention periods per data type, configured in the system rather than stated as an intention
• Procedure in cases of suspicion, including logging of every access to the history

One point is missing from many drafts. It governs the exceptional case in which position data is used after all to clarify an incident, for example after a manoeuvring accident in the yard of an institution. What needs settling is who decides, who logs the analysis and at what point the works council is brought in.

Art. 35(1) GDPR requires a data protection impact assessment where processing is likely to result in a high risk to the rights and freedoms of natural persons. You do not have to derive that forecast yourself here. The mandatory list of the German supervisory authorities under Art. 35(4) GDPR lists, under the heading geolocation of employees, the case of a company having movement profiles of employees created via RFID, mobile phone location or GPS. A telematics system that identifies drivers is therefore a standard case.

1. 1Threshold analysisDescribe the processing, compare it against the mandatory list and record the result in writing.
2. 2Necessity and proportionalityWeigh purposes, depth of collection and sampling rate against less intrusive means. Would a status event per stop do instead of a per-second trail?
3. 3Risk assessmentAssess severity and likelihood, in particular the inference from movement profiles to the home and treatment addresses of passengers.
4. 4Measures and role conceptDefine roles, access logging, automatic deletion, encryption and the data processing agreement with the telematics provider.
5. 5Involvement and updatingInvolve the data protection officer under Art. 35(2) GDPR and update the impact assessment whenever functionality is extended.

What often gets overlooked is that the tracking runs in the same application as the passenger data. If you process wheelchair requirements, diagnostic notes or dialysis appointments, you process special categories of personal data. There is more on that in the article on health data under Art. 9 GDPR in passenger transport.

There is no statutory maximum period for employee GPS data. The yardstick is storage limitation under Art. 5(1)(e) GDPR. Data may be kept in identifiable form only for as long as the purposes require. The period therefore follows the purpose, and the purpose has to be named in advance.

The sharpest reference point comes from the Wiesbaden Administrative Court, judgment of 17 January 2022 (case 6 K 1164/21.WI). A logistics company had kept driver card data for 28 days and the remaining telematics data for around 400 days. The court held that storing the location data for 400 days was disproportionate, rejected the consent because it was not freely given, and criticised the failure to inform the employees.

The three figures come from different areas of law and apply to different data. A tax retention period does not justify 400 days of raw position trail, and a deletion run for location data must not sweep accounting vouchers along with it.

A deletion grid per data type

Most retention concepts fail on a single sentence, which reads roughly like this. Location data is deleted after X months. That pushes one period over data serving quite different purposes. A grid works better.

• Live position for dispatch, arrival information and emergency response. Keep it only for the duration of the running tour.
• Raw position trail for clarifying short-term disruptions and complaints. Keep it briefly and give an express reason for the period you chose, based on how long realistic queries about a journey take to arrive.
• Condensed trip record per stop as proof of service towards the funding body. Until billing and the audit window are closed.
• Working time record for working time beyond eight hours. At least two years under Section 16(2) ArbZG.
• Invoice and accounting voucher for bookkeeping and tax audits. Eight years under Section 147(3) AO.

For the grid to exist anywhere other than on paper, the periods have to be configured in the system and executed automatically. Manual deletion runs fail in the first week of the holiday season. In a dispatch and route planning system, position trail, trip record and billing document can be held as separate objects with separate periods. How robust the trip record has to be is covered in the article on proof of service towards funding bodies.

That leaves accountability. Art. 5(2) GDPR requires you to be able to demonstrate compliance with the principles, and a retention concept nobody logs counts as not carried out if it is questioned. Record which run covered which data type and when, and take a sample check once a year.

The information under Art. 13 GDPR belongs before go-live, not in the next staff appraisal. In the Wiesbaden case, the missing information was a separate ground for objection. The Rhineland-Palatinate commissioner requires that employees learn that tracking is taking place, for example through a notification or a display in the vehicle, because otherwise there is covert monitoring, which is prohibited in principle. A usable driver notice fits on one page:

1. Which data is collected, for example position, timestamp, ignition status and events per stop.
2. When it is collected and when it is not, that is from start of shift to end of tour, with no collection during breaks or permitted private use.
3. Who may access it: dispatch live, billing only in condensed form, management only where there is a specific reason.
4. How long it is stored, broken down by data type.
5. Which legal basis and which works agreement the processing rests on.
6. Which rights apply, with contact details for the data protection officer.

On the other side are parents, carers and institutions who see the status of a journey. The same purpose limitation applies to them. What is displayed is the status of their own journey. An open live map on which a father can follow where his son named driver is standing between two tours cannot be justified by the dispatch purpose.