We want to install GPS in company cars. What do we have to do?

GPS shows where the car is. When you know who drives it, you know where the person is. Among identifiers, Article 4(1) GDPR names location data separately. So GPS records are the employee's personal data.

Article 27(1) of the Labour Code (DK) says the employer must respect employees' rights to private life and to the protection of personal data. GPS does not conflict with this, if tracking has limits.

Data is collected only for specified and explicit purposes (Article 5(1)(b) GDPR). Suitable purposes include, for example:

• route planning and assigning orders;
• controlling fuel costs and mileage;
• protecting the car from theft;
• telling a customer when the technician or courier will arrive.

"Controlling employees" is not a clear enough purpose. If you later want to use GPS data for another purpose, for example to assess employees, first check whether that purpose is compatible with the original one (Article 6(4) GDPR).

The most common basis is legitimate interest (Article 6(1)(f) GDPR). You may rely on it if the employees' interests and rights do not override it. Assess this with a balancing test.

An employee's consent usually does not fit here. Recital 43 GDPR says that consent should not be a valid basis where there is a clear imbalance between the parties. An employee depends on the employer, so their consent is rarely free.

An employee may object to the processing on grounds relating to their particular situation (Article 21(1) GDPR). You then stop tracking, unless you show compelling legitimate grounds that override the employee's interests, or you need the data to establish, exercise or defend legal claims. In the notice, state the right to object clearly and separately from other information (Article 21(4) GDPR).

A data protection impact assessment (DPIA) is carried out before processing starts (Article 35(1) GDPR). In the list approved by VDAI (order No. 1T-35 of 2019-03-14), point 10 covers processing employee data linked to monitoring their location or movement. So when GPS lets you see where an employee is, a DPIA is required (Article 35(4) GDPR; VDAI list, point 10).

You will find the whole process, with a GPS example, in DPIA step by step.

Collect only the data the purpose needs (Article 5(1)(c) GDPR). Before you switch the system on, fill in this table:

You set the retention period yourself. Data may not be kept longer than the purpose needs (Article 5(1)(e) GDPR). How to justify it is explained in a separate answer.

The GPS service provider usually processes the data on your behalf. You need a contract with it that contains the terms listed in Article 28(3) GDPR. Choose a supplier that provides sufficient guarantees of data protection (Article 28(1) GDPR).

Article 5(4) ADTAĮ requires you to inform employees about monitoring of their location or movement against signature or in another way that proves they were informed. The content is the information in Article 13(1) and (2) GDPR. The same duty applies to people working on grounds equivalent to employment (Article 5(5) ADTAĮ).

The notice must state:

• who the controller is and how to contact it;
• the contact details of the data protection officer, if you have one;
• the purposes of tracking and the legal basis;
• what your legitimate interest is;
• who receives the data, including the GPS supplier;
• whether data is transferred outside the European Economic Area, and which safeguards then apply;
• how long the data is kept;
• the employee's rights: access, rectification, erasure, restriction, objection;
• the right to lodge a complaint with the State Data Protection Inspectorate;
• whether automated decisions are taken based on GPS data, if there are any.

Sample wording:

GPS devices are installed in the company's cars. During working hours they record the car's location and mileage, to plan routes and control fuel costs. The transport manager sees the data. The data is kept for [period] and deleted automatically.

Hand over the notice before you switch on the GPS. Give it to a new employee no later than before they first use a car with GPS. More on this: employee privacy notice.

If the company employs on average 20 or more people, submit the GPS rules to the works council before you approve them, and consult it. You must inform it 10 working days before approval (Article 206(1)(5) and (6) and 206(2) of the Labour Code). If there is no works council or employee trustee, give the information to a trade union operating in the company (Article 206(4) of the Labour Code).

Enter the GPS process in your record of processing activities: purpose, basis, data, recipients, retention period. Review the DPIA and the notice when the supplier, the system's features or the purpose change.

• GPS switched on before the notice is handed over. Employees must know about tracking in advance.
• Tracking after work. When the car is used privately, location records after work are usually not needed for the purpose.
• A new purpose without a check. Data was collected to control fuel, but is used to assess employees. This needs a check under Article 6(4) GDPR, a reviewed DPIA (Article 35(11) GDPR) and a notice to employees before the data is used for the new purpose (Article 13(3) GDPR).
• Everyone sees the live map. Access must be limited to those who need it for their work.

Start with the purpose and the table from step 4. Then carry out the DPIA and prepare the notice. With the tool you can find out whether you must keep a record of processing activities.

Do we need the employee's consent?
Usually not, and it rarely fits because of the imbalance between the parties. You need a lawful basis and a notice given against signature or in another provable way.

May we track the employee's phone instead of the car?
A phone stays with the person after work too, so the risk is higher. At least the same rules apply: purpose, basis, DPIA and a notice under Article 5(4) ADTAĮ. The DPIA must assess how you will avoid tracking outside working hours.

May GPS data be used in a dispute about working time?
It is safest when this purpose is stated in advance in the notice and the DPIA. If it is not, first check whether it is compatible with the original purpose (Article 6(4) GDPR), and inform the employee (Article 13(3) GDPR).

GPS is already running, but we have done none of this. What do we do?
The safest course is to pause tracking until you carry out the DPIA and inform employees. If you cannot pause it, carry out both steps without delay, and until then collect only the most necessary data and limit access. Assess whether you may keep the data already collected. In this situation it is worth talking to a lawyer.

• DPIA step by step: an example with GPS
• Employee privacy notice
• When is a data protection impact assessment needed?
• Rules for using work email and computers

The law and the risk: Employee monitoring: cameras, GPS, call recording and e-mail (dat.lt)

• Informing employees about monitoring of location or movement: Article 5(4) ADTAĮ; relationships equivalent to employment: Article 5(5); content of the information: Article 13(1) and (2) GDPR; new purpose: Article 13(3).
• Employees' private life: Article 27(1) of the Labour Code.
• Informing and consulting the works council: Article 206(1)(5) and (6), (2) and (4) of the Labour Code.
• Location data is personal data: Article 4(1) GDPR.
• Purpose, amount of data, storage period: Article 5(1)(b), (c) and (e) GDPR.
• Legitimate interest: Article 6(1)(f) GDPR; compatibility of a new purpose: Article 6(4); consent and imbalance: recital 43.
• Right to object: Article 21(1) GDPR; informing about it: Article 21(4).
• Supplier and contract: Article 28(1) and (3) GDPR.
• DPIA before processing: Article 35(1) GDPR; the list: Article 35(4); review: Article 35(11); VDAI list (order No. 1T-35 of 2019-03-14), point 10.

GDPR read from the official Lithuanian text (OJ L 119, 2016-05-04). ADTAĮ (Law on the Legal Protection of Personal Data), the Labour Code (DK) and the VDAI order read from the versions in force on e-tar.lt. English wording of Lithuanian provisions is our translation. This text is general information and is not individual legal advice.