MD015Geolocation of vehicles and devices

The recording of the position of a vehicle or device issued to a worker.

Pillar: MD | Monitoring and detection
Sources cited: 17
Added: 30 AUGUST 2026
Updated: 5 OCTOBER 2026

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
MD015/EUMandatory	European Union	Regulation (EU) 2016/679, articles 5(2), 6, 9, 12, 15, 22, 35, and 88European Parliament and Council · read 11 Aug 2026Opinion 2/2017 on data processing at work (WP249)Article 29 Data Protection Working Party · read 11 Aug 2026	The grounds on which processing may rest, the burden of showing it, the categories whose processing is prohibited outright save on a named ground, what a person asking has to be told and by when, the limit on deciding about someone by machine alone, when an impact assessment is owed, and the leave each member state has to set its own employment rule.	A ground under article 6 has to be identified before anything is collected through the tracking device, and whatever more specific rule the member state has made under article 88 applies on top of it. Consent is rarely that ground in an employment relationship, since it has to be freely given and the imbalance there makes that doubtful.
MD015/CoEMandatory	Council of Europe	Florindo de Almeida Vasconcelos Gramaxo v. PortugalEuropean Court of Human Rights, Fourth Section · read 11 Aug 2026‘Just more surveillance’: The ECtHR and workplace monitoringMole and Mangan · read 11 Aug 2026	That geolocation of a company vehicle, inside and outside working hours, did not violate article 8 on the facts, by four votes to three.	Tracking a company vehicle through and beyond working hours has survived on its facts, on a bench divided four to three, with the mileage relied on separated from the location data as a whole. A case note reads the majority as having placed the technology itself largely beyond examination, so the survival is weaker authority than it appears.
MD015/ATMandatory	Austria	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council’s consent is the condition of the tracking device having legal effect, and the threshold is whether it touches human dignity.
MD015/FRMandatory	France	Code du travail, articles L1121-1, L1222-4, and L2312-38République française · read 16 Aug 2026	Consultation of the social and economic committee before the decision, prior knowledge for the worker, and proportionality to the task.	The social and economic committee has to be informed and consulted before the decision to put the tracking device in place, and the worker informed before it reaches them.
MD015/DEMandatory	Germany	Betriebsverfassungsgesetz, section 87(1)(6)Bundestag · read 16 Aug 2026	Co-determination by the works council over the introduction and the use of technical devices intended to monitor conduct or performance.	The works council has to agree before introducing the tracking device, and again on the manner in which it is used.
MD015/ITMandatory	Italy	Sentenza n. 3462/2026Corte di Cassazione, First Section · read 16 Aug 2026	That vehicle tracking is processing of worker data wherever the driver can be identified, including indirectly.	Tracking requires notification to the supervisory authority wherever the driver can be identified, and identification through vehicle assignment is enough.
MD015/LUMandatory	Luxembourg	Délibération n° 11FR/2021Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026Délibération n° 1FR/2022Commission nationale pour la protection des données, formation restreinte · read 5 Oct 2026Lignes directrices en matière de géolocalisation des véhicules mis à la disposition des salariésCommission nationale pour la protection des données · read 5 Oct 2026	That location data kept two years and four months for geographic tracking, protection of goods, and working time of travelling employees exceeded what the purposes needed, that a retention set per purpose is owed, two months for location, one year for billing evidence, three years for working time, that the employees were not informed as article 13 requires, and that access to the geolocation software through shared accounts breached article 32, individual accounts being owed only to those for whom access is strictly necessary to their tasks.	Geolocation of a vehicle given to an employee is always surveillance under article L.261-1; the employer does not monitor the employee outside working hours, leave, sick days, lunch breaks, home-to-work trips, medical visits, and weekends included; a vehicle also used privately carries a deactivation in the employee’s hands, and a vehicle for professional use only may stay located permanently. Employees are informed individually of a geolocation system, its purposes, its legal basis, the retention per purpose, the recipients, and their rights.
MD015/NLMandatory	Netherlands	Wet op de ondernemingsraden, article 27(1)(l)Staten-Generaal · read 16 Aug 2026	Consent of the works council for an arrangement directed at or merely suitable for observing presence, conduct, or performance.	The works council has to consent before any arrangement governing the tracking device is adopted, amended, or withdrawn.
MD015/ESMandatory	Spain	Ley Orgánica 3/2018, articles 87, 89, and 90Cortes Generales · read 16 Aug 2026	A right to privacy in employer-provided devices, and the express prior information owed before camera images or location data are processed.	Location data may be processed for the control functions in article 20.3, on the same condition of express prior information.
Recommended	Croatiawhere written	Smjernice o obradi osobnih podataka u radnim odnosimaAgencija za zaštitu osobnih podataka (AZOP) · read 5 Oct 2026	That consent is seldom an adequate basis in the employment relationship, that GPS in company vehicles is regulated by written internal rules available to all workers, with the data processed only for the purposes those rules state and kept no longer than needed, that a data protection impact assessment is mandatory for processing workers’ data by applications or systems that track work, movement, or communication, and that video surveillance of workers rests on the GDPR implementation act and the Occupational Safety Act without consent, with the works council’s prior consent where devices follow all movements throughout working time.	GPS in company vehicles is installed without the worker’s approval only where necessary for the professional nature of the work or as a precaution; its use is set in written internal rules available to all workers, in particular where private use of the vehicle is allowed, the data are processed only for the purposes those rules state, and the movement records are kept only as long as needed.
Recommended	Portugalwhere written	Deliberação n.º 7680/2014, Princípios aplicáveis aos tratamentos de dados pessoais decorrentes da utilização de tecnologias de geolocalização no contexto laboralComissão Nacional de Proteção de Dados · read 5 Oct 2026	That geolocation of vehicles is admitted for fleet management in external service in five activities, that protection of goods is weighed strictly and does not cover every vehicle, that geolocation of mobile phones is excessive for both purposes and the employer neither obtains location data from the operator nor installs GPS applications, that location data are never used to control performance, that indications of a crime may support a criminal complaint and a disciplinary proceeding where the facts themselves breach the worker’s duties, that driving parameters tied to the driver are anonymized, and that the purpose of fleet management is spent in the real-time view or the last position.	Geolocation of vehicles is admitted for fleet management in external service in external or home technical assistance, distribution of goods, passenger transport, goods transport, and private security; vehicles not in external service are excluded; protection of goods is weighed strictly and does not cover every vehicle; the purpose is spent in the real-time view or the last position; driving parameters tied to the driver are anonymized. Geolocation of a mobile phone is excessive for protection of goods and for management of external service; the employer neither obtains location data from the operator as subscriber nor installs applications that activate the GPS sensors.
Recommended	Swedenwhere written	Så får du som arbetsgivare använda platstjänster (GPS)Integritetsskyddsmyndigheten · read 5 Oct 2026	That positioning is allowed where a concrete operational need justifies it, that real-time monitoring of employees without such a need is not, that secret monitoring is a breach, that employees are told what is collected, why, where, for how long, and who sees it, and that the employer usually negotiates with the union before switching location services on.	Positioning is allowed where a concrete operational need justifies it, real-time monitoring of employees without such a need is not, secret positioning is a breach, and the employees are told what is collected, why, where, for how long, and who sees it.
Recommended	Switzerlandwhere written	Wegleitung zur Verordnung 3 zum Arbeitsgesetz, Artikel 26, Überwachung der ArbeitnehmerStaatssekretariat für Wirtschaft (SECO) · read 5 Oct 2026	What counts as a behaviour monitoring system (cameras in work rooms, microphones, continuous positioning, IT tools that monitor computer or phone activity at work or at home, sensors capturing biometric or physiological data, and AI tools for automated analysis of employee-based data), the three conditions of admissibility of a system needed for other reasons (a clearly overriding other interest, proportionality, and the participation of employees in planning, installation, hours of operation, and retention), the written justification produced to the labour inspectorate on request, and the data rules (prior detailed information, shortest predetermined retention, access limited to those authorized to evaluate, no archiving after the control, an internal regulation on rights and duties, monitored areas marked).	Satellite or other positioning systems that continuously track and record the position of persons are behaviour monitoring; route recording of company vehicles for route optimization, and precise vehicle location for transport of persons, cash, dangerous or perishable goods, or for service fleets, are permitted purposes.