UK Vehicle Tracking Laws, Privacy Policies and Data Protection

Fleet vehicle tracking is one of the best ways to keep tabs on your business’s resources, efficiently dispatch employees to field sites and collect key data about how vehicles are performing. However, tracking vehicles can be tricky as you must protect employees’ rights and comply with UK privacy laws.

In this guide, we’ll cover everything you need to know about UK vehicle tracking laws, privacy policies and data protection regulations, plus highlight best practices for tracking your fleet vehicles.

Key Takeaways

• The key laws governing vehicle tracking in the UK include the Data Protection Act of 2018, the UK General Data Protection Regulation and Article 8 of the Human Rights Act of 1998.
• To track fleet vehicles legally, you must have a need to comply with other UK regulations (such as tachograph rules) or a legitimate business interest in collecting vehicle data. Employee consent is insufficient on its own.
• You must also notify employees that they are being tracked and tracking must be limited to work hours.
• It’s important to develop a clear vehicle tracking policy, communicate with employees about tracking, and review your tracking practises and data at least once per year.

Legal Framework Governing Vehicle Tracking in the UK

To ensure your fleet tracking approach complies with legal obligations, it’s important to understand the legal framework around vehicle tracking in the UK.

There are no specific laws that govern vehicle tracking using a GPS, but existing data protection and employee privacy laws in the UK do apply. The most relevant of these are the Data Protection Act of 2018 and the UK General Data Protection Regulation (GDPR).

Together, these laws classify data, like a vehicle’s location, as personal data since it can be used to identify an individual employee.

The legal framework surrounding vehicle tracking is important to fleet operators, as it means personal employee data can only be collected under certain conditions.

At least one of two conditions must be met:

• Compliance with other regulations: Businesses using GPS tracking to comply with other UK regulations or requests from law enforcement agencies are legally allowed to track company-owned vehicles to collect necessary data. For instance, those collecting information about drivers’ hours and mileage to submit electronic tachograph data.
• Legitimate business interest: If your business can prove a legitimate business interest for tracking vehicles, such as needing to monitor vehicle performance or dispatch employees already in the field, then you can legally track fleet vehicles. However, you can only collect data necessary for your established business interest.

In theory, receiving consent from your employees for tracking is also a sufficient condition to collect personal data. However, your business should not rely on consent alone as a legal basis for fleet tracking. This is because UK courts have recognised a power imbalance between employers and employees that can result in employees giving consent to be tracked unwillingly.

Article 8 of the Human Rights Act of 1998 also applies to vehicle tracking. This law guarantees employees’ expectation of privacy, including at work. Crucially, it requires you to notify employees that they’re being tracked, even if you don’t need their consent.

Employee Privacy Rights and Employer Obligations

Based on these overlapping legal frameworks, there are key things employers need to know about staying compliant while tracking vehicles.

• Notification is required: You must notify employees that they are being tracked and be transparent about the electronic tracking devices used. Tracking employees without notifying them is illegal, even if you have a legitimate business or compliance reason for tracking.
• Consent alone is insufficient: You should seek employee consent for vehicle tracking to document that employees are aware of being tracked and to strengthen your legal basis for tracking. However, consent alone is insufficient as a basis for tracking vehicles if you don’t have a legitimate business or compliance reason to collect data.
• Tracking should be limited: Vehicle tracking must be limited to company vehicles during business hours. If your business allows company vehicle use for personal purposes, you can’t track employees during their personal time.

Using vehicle tracking data to discipline employees

Vehicle tracking data can sometimes reveal details about unacceptable employee behaviour at work, such as speeding or over-reporting hours. In these cases, whether you can use tracking data as the basis for disciplining an employee depends on the original reasons for vehicle monitoring and how the data was analysed.

If the data is used appropriately, you can use tracking data as a basis for discipline. For example, if you track vehicles to monitor fuel efficiency and workplace safety and discover a driver who consistently speeds, you can use the tracking data as evidence to discipline that driver.

On the other hand, if you use the same data to discover that a driver is conducting personal errands while at work, it may not be permissible to use it as evidence to discipline that employee. This is because the violation doesn’t relate directly to fuel efficiency or safety.

In this case, you can lawfully speak with the employee about their behaviour, but you should be cautious about disciplining them based on the tracking data.

Data Protection and Privacy Policies

The Data Protection Act and UK GDPR also set out guidelines for how companies need to handle data obtained through vehicle tracking.

Firstly, it’s important to collect only strictly necessary data and to use it solely for the purposes your business specifies. Using data obtained through vehicle tracking for purposes that aren’t explicitly laid out in a vehicle tracking policy can leave your business at risk of hefty fines.

It’s also crucial to ensure that any personal data you collect about employees, including vehicle tracking data, is fully secure. Consider using multiple data security measures, such as role-based access permissions, to limit who can access tracking data and encrypted storage to limit the impact of a data breach.

Employers are fully responsible for breaches of employee personal data under UK GDPR and can face steep penalties.

Finally, set out clear policies for how long vehicle tracking data is retained and how and when it’s deleted. Tachographs must be kept for a minimum of two years, although there’s no legal requirement to keep the underlying tracking data.

There are also no legal stipulations requiring this data to be deleted after a certain amount of time. In general, it’s a good idea to delete tracking data for a vehicle when it’s been retired and replaced.

Best Practices for Compliance

There are several best practices your business can implement to maintain compliance and trust while tracking fleet vehicles.

Develop a clear vehicle tracking policy

Creating a clear, detailed vehicle tracking policy is the best way to establish your business’s legal basis for tracking and to inform employees that they’re being tracked. This can be a standalone policy or part of your business’s broader employee privacy policy.

The policy should begin by describing your company’s rationale for tracking, including all underlying business reasons. These can include monitoring vehicle performance, improving workplace safety, reducing fuel costs, verifying employees’ reported work hours and more.

The policy should also specify whether tracking data will be used to comply with other UK fleet regulations and whether employees have the option to opt out.

Next, your policy should detail the specific types of tracking devices that will be used, what types of data will be collected and when. It should also include information about how data will be secured, who will have access to it and how long it will be retained.

Finally, the policy should list various ways vehicle tracking data will be used, including any uses for disciplining employees.

If you’re unsure how to create a thorough vehicle tracking policy, seek legal advice. The consequences for non-compliance with UK privacy and data protection laws are severe. Fines can be up to £17.5m or 4% of annual global revenue, whichever is greater.

Your vehicle tracking policy should be easily accessible to employees, for instance, by including it in your company’s employee handbook. It’s also a good idea to ask employees to sign the policy to indicate they’ve read it. This provides legal proof that your employees have been notified that your business is tracking company vehicles.

Communicate with employees about vehicle tracking

The more transparent you can be with employees about vehicle tracking, the better. This is not just because your business is required to notify employees about personal data collection, but also because greater transparency improves trust.

It’s a good idea to hold training sessions to educate employees about vehicle tracking. These sessions can cover how the electronic devices used for tracking operate, highlight key points from your vehicle tracking policy and give employees a chance to ask questions.

Conduct regular compliance reviews

At least once per year, your business should review your tracking systems and vehicle tracking policy to ensure they’re up-to-date and still in compliance with the latest UK privacy laws. This is also a good opportunity to review the security of collected data and to delete any tracking data that’s no longer needed.