Van Tracker Data: Employer vs Employee Rights

Van trackers are a common tool for monitoring company vehicles, but their use requires a careful balance between business needs and employee privacy. In the UK, vehicle tracking data is considered personal data and is regulated under laws like the UK GDPR and the Human Rights Act 1998. Misusing or mishandling this data can lead to fines up to £17.5 million or 4% of global turnover.

Here’s what employers need to know:

• Legal Basis for Tracking: Employers must justify tracking under "Legal Obligation" or "Legitimate Interests" and ensure it’s fair, necessary, and proportionate.
• Employee Privacy: Tracking during personal time is generally unlawful. Employers must provide a way to disable tracking outside work hours.
• Transparency: Employees must be informed about tracking policies, including what data is collected, why, and how it will be used.
• Data Protection: Conduct a Data Protection Impact Assessment (DPIA) to minimise risks and comply with privacy laws.

Employers can use tracking to improve safety, manage working hours, and recover stolen vehicles, but only when policies are clear, data is handled responsibly, and employees’ rights are respected.

Do’s and Don’t’s Concerning Employer Use of GPS Tracking

sbb-itb-499a7f0

UK Legal Requirements for Van Trackers

When installing van tracker systems, you’re handling personal data regulated under UK data protection laws. If tracking data can identify an individual, it falls under these legal frameworks. Below, we’ll break down the steps to ensure compliance.

UK GDPR Compliance

Before you begin tracking, you need a lawful basis for processing. The most common bases are "Legal Obligation" and "Legitimate Interests". For instance, a logistics company tracking drivers' hours for safety compliance would rely on Legal Obligation. On the other hand, tracking for purposes like asset protection or route efficiency falls under Legitimate Interests - but only if a balancing test confirms that business needs don’t outweigh employee rights.

"To comply with data protection law, you must do this monitoring in a way that is lawful and fair to workers." - ICO

The ICO’s updated guidance (June 2025, under the Data (Use and Access) Act) highlights three key principles: transparency, necessity, and proportionality. Your data collection must be fair, lawful, and limited to what is "adequate, relevant, and not excessive". Always opt for the least intrusive method. For example, verifying start times through computer logins is reasonable, whereas webcam monitoring would be excessive.

A Data Protection Impact Assessment (DPIA) is required when tracking could pose a high risk to workers' privacy. This assessment documents why tracking is necessary and how you’ve balanced business needs against employee privacy. If tracking could reveal special category data - like visits to a hospital or union meeting - you’ll need an additional legal condition, such as "Employment, social security and social protection law". The DPIA also helps establish boundaries, like limiting tracking to work hours.

Tracking during personal time is generally unlawful under the Human Rights Act 1998 (Article 8: Right to respect for private and family life). If employees use company vans for personal trips, you must provide a "privacy button" to disable tracking outside work hours or obtain explicit consent. However, consent is rarely valid in employment settings due to the power imbalance.

Employee Notification Requirements

Transparency is essential. You must inform employees about tracking before it starts. This includes explaining what data will be collected, why it’s being collected, how long it will be stored, and whether it could be used for disciplinary actions.

Draft a written vehicle tracking policy for employees to sign. This policy should clearly outline:

• The types of data collected (e.g., location, speed, distance)
• The business reasons for tracking (e.g., theft prevention, route optimisation)
• How long the data will be retained

Make the policy easy to access and understand - don’t bury it in lengthy contracts. If tracking is paired with other tools like CCTV, use clear signage to ensure workers are aware.

Beyond meeting legal requirements, clear communication fosters trust. Senior management and Data Protection Officers hold accountability, so ensure policies are well-documented and regularly updated. With these legal steps in place, we’ll next examine what employers can and cannot do.

What Employers Can and Cannot Do

In the UK, monitoring company vans is allowed as long as it serves a legitimate business purpose and complies with the law. Common reasons include preventing theft, planning routes, ensuring health and safety compliance, and improving efficiency. For instance, logistics companies often track drivers’ hours to meet legal requirements around rest periods. Actions like protecting assets or optimising routes typically fall under "Legitimate Interests". However, to rely on this, you must pass a three-part test: show the interest is valid, prove it’s necessary, and ensure it’s proportionate.

As mentioned earlier, any monitoring must adhere to UK GDPR principles, with proportionality being a key factor. The Information Commissioner’s Office (ICO) emphasises:

"Just because a form of monitoring is available, does not mean it is the best way to achieve your aims. You must be clear about your purpose and select the least intrusive means to achieve it".

For example, if start times can be verified through system logins, using webcams to monitor employees would be excessive. Additionally, if company vans are used for personal trips, you must provide a way to disable tracking during non-work hours. Monitoring during personal time would breach the Human Rights Act 1998 (Article 8), which protects the right to privacy. Let’s look at how these rules apply in practice and the boundaries employers must respect.

Lawful Uses of Real-Time Tracking

Real-time tracking can be a valuable tool for businesses when used appropriately. For example, it can help recover stolen vehicles, prevent theft, plan fuel-efficient routes, ensure compliance with speed and safety rules, and monitor overall performance. However, it’s essential to only collect the minimum data necessary and delete it when it’s no longer required.

It’s also critical to stick to the stated purpose of tracking. If employees are told that tracking is only for theft prevention, you cannot later use the data to discipline someone for arriving late - unless this was clearly communicated from the start. The ICO warns:

"Monitoring conducted without transparency is unfair and could negatively impact trust relationships".

If tracking data inadvertently reveals sensitive information - like a driver visiting a hospital or attending a union meeting - you must follow stricter rules under UK GDPR Article 9 for processing such data.

Creating Clear Tracking Policies

Having a transparent tracking policy is just as important as using lawful methods. A well-drafted policy ensures compliance with the law and protects your business from claims that employees weren’t informed about monitoring. This policy should be included in employment contracts and staff handbooks, and it should explain:

• What data is collected (e.g., location, speed, distance)
• The business reasons for tracking
• How long the data will be retained
• Who can access the data
• When the data might be used, such as in disciplinary cases

Use plain language and avoid complicated legal terms. If tracking data might be used for disciplinary purposes, make this clear to ensure you stay within legal boundaries. Regularly reviewing your tracking practices can help ensure they remain necessary and proportionate to your business objectives.

Employee Privacy Rights and Protections

Employers may track company vans, but workers are protected by strong privacy laws. Article 8 of the Human Rights Act 1998 guarantees the right to respect for private and family life, which restricts how and when monitoring can occur. The Information Commissioner's Office (ICO) points out that employees have a higher expectation of privacy at home than in the workplace, warning against the risks of capturing personal or family-related details. For instance, tracking during personal time - such as when a van is being used outside of work - could violate privacy rights.

Privacy Rights and Data Access

Employees have clear rights over tracking data under UK GDPR and the Human Rights Act. First, the right to be informed ensures that employers must explain what data is being collected, why it is needed, and how it will be used. Employees can also submit a Subject Access Request to review the data collected about them, including information on who has access to it. If records are inaccurate, workers can request corrections or even deletion of data that is no longer necessary.

The right to object is particularly important when tracking is justified on the basis of "legitimate interests." If monitoring feels excessive or unnecessary, employees can formally object, forcing the employer to prove that their business needs outweigh the worker’s rights and freedoms. A notable case is Bărbulescu v Romania (2017), where the Grand Chamber of the European Court of Human Rights ruled that dismissing an employee for personal internet use was unlawful. The court found that the worker had not been properly informed about the extent and nature of the monitoring. It emphasised that "an employer’s instructions cannot reduce a worker’s private social life in the workplace to zero".

These rights give workers the tools to challenge practices that infringe on their privacy, as the next section explains.

Challenging Tracking Practices

To ensure tracking remains fair and limited, employees can reference Data Protection Impact Assessments (DPIAs). These assessments require monitoring to be proportionate and minimal. If employees feel their privacy is being compromised, they can request clarification of policies and review any prior assessments. A good starting point is to ask for the company’s written vehicle tracking policy to confirm that data collection aligns with its stated purpose. For example, if start times can already be verified through system logins, continuous GPS tracking might be unnecessary and overly intrusive.

Tracking outside of work hours is typically not allowed under UK law. Employers cannot legally monitor workers during personal time, especially in cases where personal vehicles are used for work. Any tracking active beyond working hours should be challenged. Employees concerned about such practices can raise the issue with their company’s Data Protection Officer (DPO) or consult a trade union representative. This is particularly important if the monitoring captures sensitive information, such as hospital visits or union meetings, which require stricter handling under UK GDPR.

Company Vans vs Personal Vans: Tracking Rules

Tracking rules differ significantly between company-owned vans and personal vehicles (often referred to as the grey fleet). The main distinction lies in ownership and privacy concerns. Tracking company vans involves less intrusion since the vehicle is business property, whereas tracking a personal vehicle directly affects an employee’s private property and activities beyond work hours.

For company vans, informed consent suffices, typically outlined in a vehicle tracking policy that employees agree to as part of their employment terms. However, when it comes to personal vehicles, employers must obtain explicit written consent due to the higher level of privacy involved. Lucy Cobb from BrightHR explains this requirement clearly.

The tracking scope also differs. Employers can monitor company vans during work hours and, with proper notice, even during limited personal use. In contrast, tracking personal vehicles must be strictly restricted to work-related trips. Any tracking outside work hours violates both UK GDPR and the Human Rights Act. Gemma O'Connor from BrightHR highlights this legal complexity:

"You aren't allowed to track employees outside of their working hours, so if the potential misuse involves use of the vehicle in their own time, it becomes less clear legally".

These differences emphasise the importance of having well-defined policies that align with legal standards while respecting employee rights.

Tracking Requirements Comparison Table

To simplify the distinctions, here’s a comparison of the tracking rules for company vans and personal vehicles:

For personal vehicles, employers must also provide a way to disable tracking outside work hours. This safeguard not only protects employee privacy but also shields businesses from potential legal challenges. Without such measures, companies face a significant risk of violating data protection laws.

How to Ensure Legal Compliance

Ensuring compliance with legal and privacy regulations requires a structured approach. Here's how you can align your vehicle tracking practices with the law.

Conduct Risk Assessments and Develop Transparent Policies

Start with a Data Protection Impact Assessment (DPIA) to evaluate and document the necessity of monitoring. This process should include your Data Protection Officer from the outset. A DPIA not only helps you address potential employee concerns early but also ensures that your tracking practices are proportional to your business needs. It’s a critical step in creating clear and enforceable internal policies.

Your tracking policy should outline key details such as:

• The purpose of vehicle tracking.
• The type of data collected.
• Who has access to the data.
• How long the data will be retained.

Additionally, be upfront about whether tracking data might be used in disciplinary procedures - this must be clearly stated from the beginning. If your tracking collects special category data, make sure to specify the lawful basis for its processing and the conditions under which it is handled.

Secure Data and Maintain Open Communication with Employees

Once the risk assessment is complete, focus on safeguarding the data. This includes limiting access to authorised personnel, implementing strong password protocols, and conducting regular audits. Always follow the principle of data minimisation - only collect what you genuinely need. For example, if verifying start times is your goal, use system log-in records rather than more invasive tracking methods.

Equally important is keeping employees informed. Regularly update them on the benefits of tracking, such as improved safety and optimised routing. Provide training to ensure they understand their rights regarding data access and correction. Open communication fosters trust and ensures that everyone understands both the business reasons for monitoring and the legal boundaries.

Choose GRS Fleet Telematics for Compliance-Friendly Tracking

GRS Fleet Telematics offers a range of GDPR-compliant tracking solutions designed to meet legal standards. Their system includes three hardware options:

• Essential (£35): Provides basic real-time tracking.
• Enhanced (£79): Features dual-tracker technology with Bluetooth backup.
• Ultimate (£119): Adds remote immobilisation, ideal for protecting high-value assets.

All packages include a software subscription starting at £7.99 per vehicle per month. This covers SIM data, platform access, and a dedicated account manager. The dual-tracker technology boasts an impressive 91% theft recovery rate while ensuring robust data security. Plus, GRS Fleet Telematics offers free installation when paired with their fleet branding services.

Summary

Finding the right balance between employer and employee rights when using van trackers hinges on transparency, legal compliance, and respect for privacy. Employers are required to inform workers about tracking systems and secure their consent before implementation. As Gemma O'Connor from BrightHR explains: "Your workers must be told that you're tracking their location, and consent to you tracking them".

Adhering to GDPR regulations is essential. Tracking data qualifies as personal data, meaning it must be handled fairly, lawfully, and for specific purposes like safety, time management, or improving efficiency. Employers should only collect data that is absolutely necessary and must avoid monitoring employees during personal time. Tracking outside of working hours infringes on privacy rights protected under the Human Rights Act.

A clear vehicle tracking policy is vital to protecting against legal disputes. This policy should outline what data is collected, its purpose, who has access to it, and how long it will be retained. To formalise understanding and consent, have employees sign this document. Lucy Cobb from BrightHR highlights: "Vehicle tracking provides better visibility of your staff's workday and ensures you comply with the UK law on timesheets".

Regular reviews are necessary to ensure compliance. Employers should conduct Data Protection Impact Assessments, restrict data access to authorised personnel, and delete information when it’s no longer needed. Tracking systems should also be configured to respect employees' off-duty hours and align with the purposes communicated to staff.

When done properly, van tracking benefits both sides. Employers can improve operational efficiency and meet their legal duties under the Working Time Regulations 1998, while employees gain enhanced safety and fair treatment. Success lies in open communication and handling tracking data with care and respect.

FAQs

Can my employer track me when I’m off duty?

Employers can monitor you, but only if they have a fair and lawful reason. Any tracking must align with data protection laws and uphold your privacy rights. They are required to ensure that any monitoring is transparent, justified, and proportionate to its purpose.

How do I request my van tracking data (SAR)?

To obtain your van tracking data through a Subject Access Request (SAR), you’ll need to send a written request to your employer or the designated data controller. Make sure to explicitly mention that your request is an SAR under GDPR and the UK Data Protection Act. Include key details such as your full name, employee ID (if relevant), and any other information that might help identify the data. They’re required to provide a response within one month, including a copy of the requested tracking data. It’s a good idea to keep a record of your request for future reference.

When is GPS tracking classed as 'excessive'?

GPS tracking crosses the line into being 'excessive' when it gathers more information than is genuinely needed for legitimate business purposes. For instance, tracking employees during their personal time or monitoring locations without clear communication and consent falls into this category. Employers have a responsibility to ensure that any tracking is reasonable, justified, and openly communicated to employees, respecting their right to privacy.

Related Blog Posts

• Van Trackers for Trade Businesses: Protecting Tools and Vehicles
• Fleet Telematics and Data Privacy: Best Practices
• Van Tracking vs. Traditional Delivery Monitoring
• UK Vehicle Tracking Privacy Laws Explained