DPA case 2022-0.021.739 – Violation Found (Austria, 2022)

In December 2019, the DSB received an anonymous submission claiming that a controller had installed GPS-trackers on its company vehicles, monitoring not only business trips but also private rides of the its employees. Further, the complaint stated that the controller would create an employee profile based on such data. Accordingly, the DSB started an ex officio investigation under Article 57(1)(h) GDPR and obtained evidence about the following facts: the controller leased 15 company vehicles from a leasing provider and put them at its employees’ disposal for both business and private trips. In 2020, the controller asked a third party company to install a GPS-tracking device on every vehicle. Initially, this was used to determine the current location of the vehicle when asked; from July 2021 onwards, the GPS-system has also been used as a tool for keeping record of working hours, business trips and for calculating travel expenses. The device placed on the vehicles transmits data to a server and is activated by starting the car’s engine and it is deactivated as the engine stops. However, each car also includes a switch allowing the driver to deactivate the device manually. The transmitted data includes: covered distance in km, date and time, starting point, destination and location data of the vehicle (and the actual route covered). The controller has knowledge about some of this data (the address of, arrival and departure from the customers’ premises) thanks to the coordinators who organize business trips and assign them to the employees on a daily basis, hence without the need to access the data collected by the tracking devices. In order to access to the data generated by the tracking devices, one must log into a software app. The only employees who have these credentials are those responsible for payroll accounting and financial management and the coordinators. Externally, the company that installed the devices, as a processor, also has access to such data. The