GPS tracking has become a source of security for businesses and individuals, allowing them to view their vehicles and assets on a digital map. While this could be regarded as an invasion of privacy, thankfully, there are laws in the UK to protect the privacy of individuals. These laws on personal privacy alleviate our worries; however, there are no specific laws in the UK regarding GPS tracking. Here, we examine the law with regard to GPS tracking and discuss when GPS tracking is legal and when it is not.
What Is GPS Tracking?
GPS tracking refers to placing a GPS tracker in an asset or vehicle to track and record its movements. The tracker records the geo-location of the asset or vehicle and transmits it to a cloud-based server to be viewed on a digital map. Installing a GPS tracker allows you to see the exact position of that vehicle at any given time, as well as a detailed history map that you can view from your computer or smartphone. GPS tracking of vehicle fleets has had a positive effect on improving their safety and security.
The laws in the UK do not specifically address the use of GPS tracking devices, although several laws are governing the use of GPS technology as it is considered a surveillance tool. If an individual can be identified using some information, this information is considered personal data. The Data Protection Act 1998 defines the information gathered by GPS trackers as personal data; this data must be dealt with in accordance with the law.
A business must inform drivers before installing vehicle tracking devices. Informing employees of your intention to install trackers on their vehicles creates a level of trust. The trackers aren’t intended to be a tool to spy on them, but rather to assure their safety and wellbeing while on the job. You can even use this opportunity to remind them of your legal obligation towards their safety.
In the United Kingdom, the law expects businesses with fleets to ensure the safety of their drivers. One of the ways a fleet manager can improve safety is by tracking the movements of vehicles and helping the drivers adjust and improve accordingly. Vehicle tracking gives insight into a driver’s state of mind and their level of fatigue, even when they will not admit to it.
Is Vehicle Tracking Legal?
Yes and no, depending on how you use the GPS tracker. Tracking someone else’s car without their consent is definitely illegal. However, if you track what's yours or inform your employees of the installation in a business fleet and safeguard the data collected as per the law, it’s legal. If you fail to alert your employees or use the information to victimize them, you will have trouble with the authorities.
To answer this question definitively, you have to examine all the related laws provided by the United Kingdom government below:
The Data Protection Act 1998 is in place to protect all essential data collected by companies and to specify that all employees have a right to know about the information being stored and processed about them. The Data Protection Act dictates that all personal data must be processed lawfully and fairly while the personal data has to be obtained for specified and lawful reasons.
The rules may seem complicated, but they are crystal clear regarding vehicle tracking devices and the information they gather. Managers have a responsibility to distinguish and state whether the information is business or personal and whether the company is using it lawfully to improve their business with the consent of their employees. As long as a company is within the boundaries of the law, doesn’t share personal employee data or use data without consent, it is completely legal for a company to track their business vehicles and drivers.
In recent regulation, the EU and UK government increased the penalties for failing to protect personal data. Companies can still store personal employee data on secure servers and use it to improve their business, but they need to check whether the proper consent to gather, store and process that data was gathered. As of 25th May 2018, businesses must ensure that the consent given for all data – even that collected before the change – meets the new protocols. In other words, employees will have to re-consent to their data being used in any capacity.
The new principles relating to the processing of personal data dictate that personal data shall be:
1- Processed lawfully, fairly and in a transparent manner in relation to the data subject.
2- Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes.
3- Adequate, relevant and limited to what is necessary for relation to the purposes for which they are processed.
4- Accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
5- Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest. Scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organizational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject.
6- Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage, using appropriate technical or organizational measures.
7- The controller shall be responsible for, and be able to demonstrate compliance with the previous six principles.
In the UK, the primary rule is that vehicle tracking is legal as long as drivers and other employees know they are being tracked, this means that businesses are allowed to install tracking devices on their vehicle fleet, but they must inform all of their personnel immediately and acquire consent for collecting data. There are no exceptions to this law, other than in law enforcement and government agencies in which covert trackers may be needed for investigations.
The Information Commissioner’s Code of Practice for Employees is clear on how the employee should be treated; it is clearly stated that the employee has the right to know about any methods used to monitor them. It also favors methods with the least intrusion of privacy and suggests that employees should only be monitored during working hours, with the option of switching off surveillance tools during private time.
You will be within the law to track vehicles solely used for business tasks, provided the driver is aware of the GPS tracking device. You are allowed to monitor mileage, driver behavior, hours on the road, and the routes used. Almost anything goes here, as long as the vehicle is designated for business use. Personal tracking devices must only be used with consent from the person being tracked.
This article is merely for informative purposes. For a definitive answer on what’s legal or not, see the full legislation provided by the Government of the United Kingdom at legislation.gov.uk.