Do I need employee consent to install GPS in company vehicles?

No. Consent is not the appropriate legal basis in an employment relationship because it cannot be freely given (there is a power imbalance). The correct basis is the employer's legitimate interest (Art. 6.1.f GDPR). What is mandatory is informing the employee in writing before activating the device, detailing the purposes, legal basis, and their rights.

Can I track the company vehicle outside working hours?

Real-time tracking outside working hours is not permitted if the employee uses the vehicle for personal purposes (mixed-use vehicle). However, you can maintain passive geolocation for asset protection. The recommendation is to disable alerts and active monitoring outside working hours and only access position data in case of a security incident.

How long can I keep GPS position data?

Raw position data (latitude, longitude, timestamp) should be kept for the minimum necessary period. The benchmark is 60 days for real-time location data (aligned with CNIL NS-51) and 1 year for aggregated trip data when the purpose is proof of service. Fletaro applies this policy automatically through a daily cleanup process.

What are the penalties for GDPR non-compliance in fleet tracking?

Penalties range from warnings for minor infringements to EUR 20 million or 4% of global annual turnover for serious violations (Art. 83 GDPR). In Spain, the AEPD has imposed fines between EUR 6,000 and EUR 300,000 on companies for tracking employees without informing them or without an appropriate legal basis. Additionally, evidence obtained via GPS without GDPR compliance can be declared inadmissible in employment proceedings.

AI Document Reading: How Automation Saves Your Fleet Hours of Admin Work

Upload a photo of an MOT certificate, insurance policy or traffic fine and AI extracts all the data in seconds. For a 30-vehicle fleet: from 3 minutes per document to 20 seconds. Over 15 hours saved per year.

Legal basis for tracking company vehicles under GDPR

Article 6 of the GDPR defines six lawful bases for processing personal data. For GPS tracking of company vehicles driven by employees, the strongest legal basis is the legitimate interest of the employer (Art. 6.1.f GDPR). Courts across the EU have consistently held that monitoring the location of company vehicles during working hours is a legitimate business interest, provided it is proportionate and the driver has been informed. Employee consent is NOT the appropriate legal basis because the power imbalance in an employment relationship means consent cannot be freely given.

National regulations: Spain's LOPDGDD and other EU examples

Spain's Organic Law 3/2018 on Data Protection (LOPDGDD) complements the GDPR with country-specific provisions. Article 87 regulates the right to privacy regarding workplace surveillance, and Article 90 specifically addresses geolocation in the workplace. Under Art. 90, employers must expressly, clearly, and unequivocally inform employees and their representatives about the existence and characteristics of geolocation devices, as well as their rights to access, rectification, restriction, and erasure.

Obligation to inform drivers: what, how, and when

The duty to inform is the cornerstone of GDPR compliance for GPS tracking. It is not enough to install a tracker and mention it verbally. The company must provide the driver with a written notice (Art. 13 and 14 GDPR) that includes: identity of the data controller, specific purposes of the tracking (vehicle security, route optimization, time tracking), the legal basis invoked, the data retention period, any recipients of the data (insurers, clients, etc.), and the driver's rights (access, rectification, erasure, portability, objection).

Data retention: how long can you keep GPS position data

The GDPR's data minimization principle (Art. 5.1.e) requires that personal data is kept only for as long as necessary for its stated purpose. France's CNIL, in its simplified standard NS-51 (a widely cited EU reference), states that real-time geolocation data should be retained for a maximum of 2 months. For historical trip data, a reasonable retention period is 1 year when the purpose is proof of service or dispute resolution. Spain's AEPD has not set a specific timeframe but aligns with these benchmarks.

Driver rights and the company fleet vs. rental fleet distinction

Every driver has the right to: access their geolocation data (Art. 15 GDPR), request rectification of inaccurate data (Art. 16), request erasure when data is no longer necessary (Art. 17), restrict processing in cases of dispute (Art. 18), data portability (Art. 20), and object to processing based on legitimate interest (Art. 21). The company must respond to any request within 30 days and provide an accessible channel for exercising these rights.

Fletaro — Software de gestión de flotas con GPS y acceso remoto