In its judgment of 19 March 2019, the Lüneburg Administrative Court became the first German court to issue a decision under the new data protection law (EU General Data Protection Regulation (GDPR), and the applicable German statute) relating to GPS tracking of company vehicles by the employer. By way of explanation, the German legislator has introduced an amended national implementation act for the GDPR, called the Federal Data Protection Act, Bundesdatenschutzgesetz (‘BDSG-new’). This Act replaces the previous version of the German Data Protection Act (‘BDSG-old’), which was in force until 24 May 2018.

The judgment basically confirms the decisions made under the previous German data protection law (BDSG-old). Employers who operate similar systems or consider the introduction of GPS tracking systems should be aware of this judgment since it further specifies the conditions for the use of GPS tracking for employment purposes and provides helpful evaluation criteria.

Background  The plaintiff, a building cleaning company, had equipped 18 of its company vehicles, used by cleaners and caretakers, with GPS systems. For a period of 150 days these systems stored any distance travelled with start and finish points, including the time traveled and the status of the ignition (on or off). Since the system also stored the vehicles’ licence plates, the data obtained could be clearly assigned to the respective operational users.

In this lawsuit, the cleaning company has challenged a restriction issued by the local Data Protection Authority regarding their use of GPS tracking in court proceedings. On 30 March 2017 the Data Protection Authority had issued an order to the cleaning company:

‘to design the collection, processing and use of employment data by positioning systems so that personal positioning during proper operational use of the vehicles does not take place at the latest by 5 May 2017.’

Such an order to comply with applicable data protection law is one of the competences of the Data Protection Authorities as granted by Article 58 (2) (d) and (f)) of the GDPR. After an unsuccessful protest against the order, the plaintiff company took legal action against it before the Administrative Court. The company defended its use of the tracking system, claiming it was operationally necessary and only used a maximum of three to four times a year per vehicle. It relied, firstly, on the argument that the data collection was necessary for employment purposes, including planning visits and coordination of vehicles, prevention of theft or recovery of stolen vehicles, proof that work was carried out for customers, monitoring the weekend driving ban and prohibitions on private driving. Second, written consent had been obtained from some of the employees concerned.

The decision: GPS positioning is inadmissible processing of personal data  The Court dismissed the action as unfounded. The collection, storage and evaluation of GPS position data is processing of personal data for the purposes of employment according to Article 88(1) GDPR, and section 26 BDSG-new. The Court decided that the monitoring of this data by the company is neither necessary for the purposes of the employment relationship under section 26 para 1 BDSG, nor is it covered by effective consent of the employees under section 26 para 2 BDSG.

It may be worth noting that although this legal action related to an order issued by the Data Protection Authority on 30 March 2017, the court has applied the new legal situation which entered into force in May 2018, after the order was issued. The court has found that the instruction is an administrative act with ongoing effects for the future, so that the GDPR, which took effect on 25 May 2018, could be applied to assess the legal situation. It seems that this is one of the first court decisions on GPS tracking in an employment context which has been made under the new legal situation.

Not required for employment purposes  According to the Court, none of the data processing purposes claimed by the applicant could justify the need to process GPS position data for the following reasons:

• Information about current or past location of the vehicles is irrelevant for future planning of visits and the coordination of vehicles in the building cleaning industry; Unlike  with the transportation of goods or people, for example, the coordination of vehicles and staff for a cleaning company is not time critical, and short-term changes must be overcome using less restrictive measure such as calling the employees on their mobile phones.
• To prevent theft, one argument made by the plaintiff company and data processor, the permanent GPS location tracking of the vehicles is completely unsuitable as by itself it will not prevent theft. As for the recovery of stolen vehicles, a one-time GPS location tracking will be sufficient.
• Vehicle location data is completely unsuitable as proof work was carried out for clients of the company, because it would give no proof of the employee’s activity for the customer, but at best indicate a company vehicle was in the vicinity.
• Checking the weekend driving ban and prohibition private driving are being observed could also be achieved by less onerous means, such as handing over vehicle keys and keeping log books.

The Court also found that the fact that the company had only resorted to the stored position data three or four times a year for the purpose of locating vehicles contradicted the company’s argument for the need for permanent GPS positioning. It is precisely that fact which shows that a system which locates the vehicles on an ad hoc basis would be perfectly adequate for the company’s purposes.

Consents ineffective  The data processing consent (sect. 26 para 2 BDSG-new) obtained from some of the employees affected was ineffective in this case, since the legally required notice of the possible revocation of consent (section 7 para 3 BDSG-new) was omitted, and employees were only partially informed about the purpose of the data processing.

Conclusion  As mentioned above, this is most likely one of the first decisions on the use of GPS location tracking in an employment context which has been made under the GDPR (and its German implementation Act, BDSG-new). This judgement shows that an assessment of the need for permanent and personal GPS localisation of company vehicles will be closely related to organisational requirements in the industry in question. In companies in which the coordination of the company vehicles is not subject to particularly tight scheduling (such as in the cleaning company here), the introduction of GPS positioning should be well thought out and, in case of doubt, GPS location of vehicles should only take place on an ad hoc basis. The Court explicitly mentions that this may be seen differently in cases where the transportation of goods or people may require an exact knowledge of location and an immediate reaction. In any case, before implementing constant GPS tracking in an employment context, it is advisable to conduct a Data Processing Impact Assessment (Article 35 GDPR) in order to evaluate the purposes of the processing and the likely risks it involves.