May an employer install a geolocation system in a company vehicle?

Yes, but... The installation of a geolocation system in a commercial vehicle is in principle permitted when it is within the scope of the pursuit of a legitimate interest of the employer. This confirmed The Dispute Chamber of the Data Protection Authority (DPA) in a decision dated March 25, 2025 (No. 61/2025), in which the GBA ruled on a complaint by an employee who opposed the installation of such a system in his company vehicle.

What was the problem?

The employee disputed that his employer could install a geolocation system in his company car without explicitly stating this in his employment contract, and without the possibility of deactivating the system outside working hours. After all, the car was also used privately. The employer argued that the measure was justified for reasons of logistical and administrative efficiency.

What does the GBA judge?

The Disputes Chamber follows the position that a legitimate interest exists when geolocation serves for the optimization of work movements, cost management (such as fuel), comprehensive time recording, or providing proof to customers (§21). Importantly, the employer must only data during working hours consulted (§26), which as necessary and proportionate was considered (§33).

Still, the GBA pointed out some critical shortcomings:

1. Target binding: although the geolocation policy spoke of logistical purposes, the facts showed that the employer essentially controlled the hours of work performed. This control was not communicated as such to the employees, in violation of the purpose limitation principle (Article 5.1 b) GDPR) (§38).
2. Transparency: the policy contained vague or contradictory wording about purposes, listed non-exhaustive data categories ("et cetera") and no retention periods. The legal basis was also insufficiently clearly defined. The GBA qualified this as a violation of the transparency obligations of Articles 12, 13 and 14 AVG (§§47-50).
3. Best practices: the system recorded location data even outside working hours, even though the employer did not have access to it. The GBA considered this disproportionate, and stated that deactivation outside working hours should be possible. Ideally, the employee should be able to do this himself, although this is not a strict obligation, but is a "best practice" (§43).

Decision

The employer had a legitimate interest, and the processing was judged proportionate within working hours. But because of a lack of transparency and lack of clarity about the exact purposes, the employer was granted a reprimand imposed.

Practical tips for employers

• Be complete and clear about the purposes of the processing.
• Avoid vague terms such as "et cetera" when listing the data processed.
• Define and communicate data retention periods.
• Consider allowing employees to (de)activate the system themselves.
• Explicitly document the use of geolocation in an appendix to the employment contract.