Irish Data Protection Commission Case Studies

Tracking Devices in Vehicles [30/05/2011]

 

During 2010 we received a number of complaints and general queries in relation to the deployment of tracking devices in vehicles such as cars and vans used for business purposes.

 

We received two separate complaints against a single company that installed tracking devices in company cars and in private cars used by their owners for business purposes connected with their employment.  The complainants alleged that they felt they were being tracked and monitored 24 hours per day, 7 days per week as they had no means of switching off the tracking devices.  The owner of the private car also expressed concern that his wife and children were being tracked when they were using the car outside of working hours.  The user of the company car explained that he had use of the car for personal purposes outside of working hours and he complained that the tracking device created a huge intrusion into his private life.

 

In the course of our investigation of these complaints, we engaged at length with the company concerned and we met with them to discuss all of the data protection issues arising.  We explained that the use of tracking systems in vehicles can give rise to data protection issues if they are not deployed in a manner that takes account of the legitimate privacy expectations of vehicle drivers, particularly when they are off-duty.  Monitoring or tracking, including in-vehicle monitoring, must comply with the transparency requirements of the Data Protection Acts.  Staff must be informed of the existence of the tracking equipment and of the purposes for which their personal data is processed.  We established during the course of our investigation that, while privacy switches were fitted when the tracking devices were installed, the drivers were not shown how to use them.

 

The complaints were resolved to the satisfaction of the complainants and the company concerned on the basis of the following guidance from my Office.  We expect any organisation deploying vehicle tracking devices to abide by these rules:

 

·         If a company vehicle is permitted to be driven for personal use outside of working hours, a privacy switch must be fitted.

·         If a privately owned vehicle is used for work purposes, a privacy switch must be fitted.

·         The data controller is responsible for ensuring that drivers are given training on the operation of the privacy switch.

·         The data controller must inform drivers of the purpose(s) for which the personal information processed by the tracking device will be used.

·         The personal information processed by the tracking device may not be used for a purpose other than the stated purpose(s).

·         Data controllers should devise and make available to drivers a policy on the use of tracking devices. This document should also set out the data controller's policy on the use of company vehicles for private use.

·         New employees should be made aware of the existence of tracking devices on company vehicles and should be trained on the operation of the privacy switch.

·         There is no requirement to fit a privacy switch if a company vehicle is used exclusively for work-related purposes, i.e. where no personal use of the vehicle is permitted.

 

Vehicle tracking devices are not staff tracking devices.  Their key function is to track or monitor the location of the vehicles in which they are installed.  Data controllers should not regard them as devices to track or monitor the behaviour or the whereabouts of drivers or other staff.