Connected company vehicles: vehicle data and employee privacy

Connected company vehicles continuously generate data about location, speed, journeys, maintenance, charge levels and vehicle condition. Once those details can be linked to an employee, for example through a vehicle assignment, user account, journey log or work schedule, they will generally be personal data. GPS tracking cannot be justified solely by the company owning the vehicle.

This article separates the user right to vehicle data under the Data Act from the privacy law requirements for processing employee data. It focuses on purpose, necessity, transparency, access, retention and the role of the vehicle or telematics provider. A fleet overview, theft protection and ongoing performance monitoring serve different purposes.

Article 4(1) GDPR covers information relating to an identified or identifiable natural person. For company vehicles, that link often comes from combining data sources: a vehicle is assigned to an employee, an app uses a personal account, a journey log names the driver or a work schedule makes a journey traceable.

The Austrian Data Protection Authority explains in its GPS tracking FAQ that personal data will generally be involved where the tracking party knows whom or what the system records. A technical identifier or vehicle registration therefore does not automatically fall outside the GDPR. Aggregated fleet values may be assessed differently if individual employees can no longer be determined by reasonable means.

The employee data protection topic page places the processing in the employment context. For the specific assessment, businesses should describe data flows, attribution and evaluation together instead of looking only at the vehicle database.

The Data Act treats a user as, among others, a natural or legal person who owns, rents or leases a connected product or receives rights to use it. A business can therefore be the user of a company vehicle and request access to data generated by it. That status does not automatically permit the business to process personal data for every desired purpose.

Processing employee data still requires a specific purpose and a valid legal basis under Article 6 GDPR. Special categories require an additional Article 9 assessment. Location data are not health data or another sensitive category simply because they are precise. Continuous collection can nevertheless interfere deeply with privacy and become disproportionate depending on purpose, scope and context.

The privacy governance topic page helps separate user status, controller responsibility, purpose and evidence. Document which data fleet management needs for organisation and which further evaluations would enter employment assessment or supervision.

Tracking may be necessary for a defined theft-protection, breakdown or dispatching purpose. That does not create a general permission for permanent monitoring of driving behaviour. A continuous location history can create movement profiles, reveal private journeys and allow conclusions about work performance, breaks or personal circumstances.

For every purpose, assess whether a less intrusive method works. Maintenance may require technical condition data. Billing may require a journey total without permanently keeping every position. Private use requires clear rules on tracking, visibility and switching off. A system that continues transmitting outside working hours needs its own proportionality assessment.

The principles in Article 5(1)(a), (b) and (c) GDPR require fair, purpose-limited and minimised processing. The article on access rights to employee data shows how roles, exceptions and logs can be structured for sensitive internal information.

Under certain conditions, the Data Act requires data holders to make data from a connected product available to the user or to a third party chosen by the user. Vehicle data may fall within that framework. The Regulation also protects personal data and requires processing to remain lawful under the GDPR.

If the business is not the data subject, personal vehicle data may be made available under Articles 4(12) and 5(7) of the Data Act only where there is a valid legal basis under Article 6 GDPR and, where relevant, the conditions of Article 9 GDPR are met. A data access right can therefore trigger an assessment, but it does not by itself authorise unrestricted disclosure to fleet management, a manager or a provider.

When requesting data, record who requests it, which categories are needed, the intended purpose and whether a report is enough instead of raw data. The processors and service providers topic page supports the role assessment for external platforms. Privacy review remains separate from the technical ability to export data.

Before launch, employees should be able to understand which sensors and services generate data, whether data arise continuously or after an event, where they are stored and which roles can access them. The information should also cover reports, exports, support access, private use, switching off and possible transfers where they exist in the system. A general phrase such as “fleet administration” often leaves the actual scope unclear.

Articles 12 to 14 GDPR require transparent information about processing and rights. Employees should know where to send requests for access, rectification or objection. If location data will enter performance or conduct assessments, that purpose must be stated clearly. Information should be available before the first use.

Whether workplace participation or an agreement is additionally required depends on the organisation and applicable employment law. Involve the relevant workplace bodies early. The article on technical and organisational measures illustrates why technical availability and lawful purpose must be recorded separately.

Article 5(1)(e) GDPR requires storage limitation. It does not create one retention period for every vehicle datum. Set purpose, necessary duration and deletion event for live data, raw histories, billing, maintenance events, accident investigation, reports and backups separately.

Measures under Articles 25 and 32 GDPR should reflect the actual sensitivity of the data. Role-based access, separate live and reporting systems, export logs and limited administrator rights can reduce exposure. Test whether deleted journeys remain in CSV exports, local downloads, support systems or backups.

An erasure concept needs practical procedures. Define who checks periods, how a vehicle change is handled and when a personal user account closes. The overview of technical and organisational measures supports documentation of security and evidence.

A vehicle manufacturer, telematics platform, leasing company, workshop and fleet manager may participate in one data flow. The actual allocation of roles is decisive. A provider is not automatically a processor merely because it performs technical services. Check who determines purposes and essential means, who performs its own analytics and who has support access.

Request a complete data-flow description covering the vehicle, app, interfaces, cloud, sub-processors, storage locations and export routes. Arrangements under Article 28 GDPR must match the actual processing. The records of processing, privacy information, security concept and erasure procedure should name the same data categories and recipients.

A DPIA under Article 35 GDPR should be assessed where the planned processing is likely to create a high risk to rights and freedoms. Extensive or systematic location monitoring, detailed driving assessments or a large employee group may support that conclusion. The article on DPIAs for new software explains the process and risk description needed for that decision.

Start with a data map. Record sensors, location, time, speed, events, user account, vehicle assignment, billing and technical condition data. Mark which details can identify an employee directly or through other workplace lists.

Then assign purposes and recipients. For each purpose, set data scope, legal basis, access level, retention period and deletion event. Check whether an aggregated evaluation, an event record or shorter retention would suffice. Configure private use, switching off and vehicle changes so that they work in practice.

The final file should include provider documents, a role matrix, privacy information, any workplace participation documents, a security concept, an erasure test and the DPIA decision. For a Data Act request, additionally record user status, data categories, recipients and the privacy law basis. This keeps data access usable without turning every vehicle record into permanent employee monitoring.

We review the data map, purposes, legal bases, user and provider roles, Data Act access, employee information, access levels, retention and the DPIA decision. For an initial assessment, provide the system description, data flow, provider documents, fleet policy, role matrix and erasure concept. This allows connected vehicles to support operations without using location data indiscriminately for employee monitoring.