As soon as location and vehicle data can be linked to specific individuals and are processed accordingly, they fall within the scope of the European General Data Protection Regulation (GDPR)^[1].

For transportation companies, this presents a balancing act: on the one hand, there is the legitimate business interest in efficient fleet management; on the other, there is employees’ right to informational self-determination. The legally compliant use of telematics therefore requires a nuanced understanding of the conditions under which data processing is permitted.

The Legal Basis: When Is GPS Tracking Permitted?

In data protection, the general principle is the “prohibition subject to exceptions”. This means that any processing of personal data is prohibited unless there is an explicit legal basis or voluntary consent. Since consent in an employer-employee relationship can be legally tenuous due to the often unequal balance of power (voluntariness), location tracking is usually based on legal grounds for authorization.

The main provisions applicable here are Article 6(1)(f) of the GDPR (legitimate interest) and, under German labor law, Section 26(1) of the BDSG (Data processing for the purposes of the employment relationship)^[2][3]. Accordingly, tracking is permissible if it is necessary for a legitimate business purpose or for the performance of the employment relationship and the driver’s interests do not outweigh these purposes. The data protection supervisory authorities point out that the purpose, scope, and design of the measure are decisive.

1. Scheduling, Logistics, and Customer Service

Tracking for the purpose of coordinating the fleet may be permissible following a balancing of interests. If the dispatch department needs to know which truck is near a customer or what a realistic estimated time of arrival (ETA) is, there is generally a legitimate business interest. An occasional real-time location query may also be permissible in specific cases—for example, as short-term navigation assistance to guide the driver by phone to the exact unloading location on a complex factory grounds. However, the prerequisite remains that this location query is actually necessary for fulfilling the specific transport order.

Special care must be taken when tracking shipments for customers: In addition to protecting driver data, security risks play a role here—especially when it comes to sensitive cargo such as cash-in-transit or hazardous materials. To protect drivers from unauthorized surveillance and cargo from crime, the principle of data minimization applies. Instead of raw live locations, abstract status updates (e.g., “Goods are on their way” / “Only 3 stops left”) and a rough location radius are the safer and more privacy-compliant choice. All factors—such as delivery pressure (just-in-time), risk of theft, reducing the burden on customer service, and the duty of care—must be carefully weighed and, ideally, firmly established in a company policy.

2. Theft Prevention and Property Security

Protecting valuable vehicles and cargo is a recognized interest of the employer. This allows downtime during unloading to be reliably tracked and billed. However, features such as geofencing (an alarm triggered when a vehicle leaves or enters a defined area) are not automatically unobjectionable under data protection law. They may be permissible, but this depends largely on how they are implemented: The purpose must be clearly defined, the measure must remain proportionate, and employees must be informed transparently about this feature in advance.

3. Compliance with Legal Obligations

Transportation companies are legally required to record driving and rest times or to provide evidence of working hours. Telematics systems can assist with this. However, it is important to make a distinction: Here, too, the collected data may only be used strictly within the scope necessary in each case. The principle of purpose limitation (Art. 5(1)(b) GDPR) ^[4] prohibits the subsequent use of data collected, for example, for toll billing, to monitor the performance of drivers.

The Red Lines: What the GDPR and Labor Law Prohibit

Where does unlawful surveillance begin? The line is generally crossed when tracking no longer serves the practical organization of the business but instead turns into comprehensive monitoring of behavior and performance.

Established case law on the right to privacy: Constant, comprehensive monitoring of employees in the workplace constitutes a significant infringement of the general right to privacy. The constant pressure of surveillance restricts employees’ freedom of action and is generally disproportionate^[5].
This results in specific restrictions for the vehicle fleet:

• No blanket performance profiling: As a general rule, it is not permitted to analyze data in a way that results in a comprehensive psychological or behavioral performance profile of the driver without a compelling, clearly defined reason for doing so.
• Restrictions on Covert Tracking: Covert surveillance without reasonable suspicion is generally prohibited. Even when there is reasonable suspicion, the thresholds are extremely high. According to Section 26(1), Sentence 2 of the German Federal Data Protection Act (BDSG), the processing of personal data for the purpose of detecting criminal offenses is permitted only if “documented factual indications justify the suspicion” that a criminal offense was committed in the course of employment, and the measure is not disproportionate^[3]. If covert GPS tracking is disproportionate, this generally results in an exclusion of evidence before the labor courts—the unlawfully collected data may then not be used, for example, to justify termination for cause ^[6].

Practical Guide: How to Ensure Your Telematics System Is Legally Compliant

To minimize legal pitfalls, fleet managers should follow this structure:

1. Comply with the disclosure requirement

You must inform your drivers in a transparent and clear manner that vehicle tracking is taking place and how it is carried out. This document must specify, among other things, the purpose of the tracking, the legal basis, the retention period, and the individuals authorized to access the data.

2. Implement a strict roles-and-permissions framework

Implement the principle of data minimization (Art. 5(1)(c) GDPR)^[7] through technical measures. A dispatcher needs location data for day-to-day operations—but the controlling or human resources departments generally do not. Access must be limited to what is strictly necessary. Sophisticated telematics systems, enable you to manage these permissions with precision.

3. Using the Works Agreement as a Framework

If a works council exists, the introduction of systems designed to monitor behavior and performance is subject to mandatory co-determination under Section 87(1)(6) of the Works Constitution Act (BetrVG)^[8]. A properly negotiated works agreement specifies in detail which analyses are permissible and often expressly excludes the use of the data for general labor law sanctions. This provides legal certainty for the company and fosters trust among the workforce.

Data protection requires precision, but it does not hinder progress

The GDPR is not a blanket obstacle to digital logistics, but it does require a thorough review of processes. Vehicle tracking within a fleet can be legally compliant as long as the principles of purpose limitation, data minimization, and proportionality are consistently applied. Companies that communicate transparently, precisely document the legal grounds for data processing, and prevent excessive monitoring through both technical and organizational measures protect their businesses from penalties and ensure the acceptance of their drivers.

Sources & Additional Legal Bases:

• [1] Art. 4(1) GDPR: Definition of “personal data” (Applies as soon as vehicle data can be linked to a specific driver via schedules or license plate numbers).
• [2] Art. 6(1)(f) GDPR: Lawfulness of processing to safeguard the legitimate interests of the controller (legal basis for operational planning, theft protection, and geofencing following a balancing of interests).
• [3] Section 26 BDSG: German Federal Data Protection Act – Data Processing for the Purposes of the Employment Relationship (Paragraph 1 on general necessity in the workplace; Paragraph 1, Sentence 2 on data processing in cases of concrete suspicion of criminal offenses).
• [4] Art. 5(1)(b) GDPR: Principle of purpose limitation (data may not be used arbitrarily for purposes other than those for which it was originally collected).
• [5] German Federal Labor Court (BAG), Decision of April 25, 2017 – Case No. 1 ABR 46/15: Landmark decision on the narrow limits of technical surveillance measures and the impermissibility of constant, disproportionate surveillance pressure.
• [6] Established case law on the prohibition on the use of evidence: Labor courts and the German Federal Labor Court (fundamental ruling on technical surveillance, among others, BAG, judgment of July 27, 2017 – Case No. 2 AZR 681/16) regularly rule that surveillance data collected in a disproportionate and unlawful manner is subject to a prohibition on the use of such evidence and may not be used against the employee in proceedings for protection against dismissal.
• [7] Art. 5(1)(c) GDPR: Principle of data minimization (“Data minimization” means that personal data must be adequate, relevant, and limited to what is necessary for the purposes of the processing).
• [8] Section 87(1)(6) of the German Works Constitution Act (BetrVG): Works Constitution Act – Mandatory right of the works council to participate in decisions regarding the introduction and use of technical devices intended to monitor the behavior or performance of employees.

Legal Notice: This article is intended solely for general informational purposes and does not constitute legal or data protection advice. Although it has been prepared with due care, we do not guarantee that the content is up-to-date, accurate, or complete. Legal requirements and case law are subject to change. For a binding assessment of your specific situation, please consult a qualified legal advisor or your relevant data protection authority or data protection officer.