In a ruling of the Administrative Court of the adminstrative court of Lüneburg dated 19.03.2019 (Case No. 4 A 12/19), the court dealt with the admissibility of GPS monitoring of employees under data protection law. The court denied the legal legitimation of the associated processing of personal data and refers in that respect to already known aspects of employee monitoring. However, the decision should not lead to the misconception that any GPS monitoring is now inadmissible. Nevertheless, it gives reason for companies to review their own practice in this regard.
The decision:
The plaintiff is an industrial cleaning company and had equipped all its own vehicles with GPS sensors. This GPS sensor system collected the coordinates of each distance driven and stored them for 150 days. The vehicles were used by caretakers and cleaning staff and were assigned to the respective operational users. On the basis of a tip from a former employee, the responsible data protection supervisory authority initiated administrative proceedings and issued a ruling against the plaintiff after hearing. In this decision, the supervisory authority stated that the collection and storage of position data was not necessary to this extent and ordered that the positioning systems be designed in such a way that personal positioning would not take place during the proper operational use of the vehicles.
In the subsequent court proceedings, the court dealt with the legal basis of data processing using GPS systems and came to the conclusion that the collection and storage of position data did not comply with data protection requirements. In particular, a justification according to § 26 para. 1 sentence 1 BDSG was denied. Although the employer also had interests worthy of protection in this context, such as the freedom of organisation of the company as guaranteed in the constitution, a control of the agreed extent of use and theft protection. However, the arguments put forward were not effective, since data processing to this extent was not necessary in order to achieve the respective purposes.
For example, a complete knowledge of the position data was not required for the performance of the employment relationship of caretakers and cleaning staff, since the data were "irrelevant for planning". It was not necessary to check the permissible extent of use, since employees were also allowed to use the vehicles privately to a limited extent. Furthermore, positioning systems were "completely unsuitable" for preventive theft protection. On the contrary, in the event of actual theft, it is sufficient to locate the vehicle on a case-by-case basis.
Practice Consequences:
Even if the decision is not unconditionally transferable to every site-related employee monitoring, some fundamental practice-relevant aspects can be filtered from the decision of the administrative court Lüneburg. Irrespective of the specific technology used, the decision is basically transferable to all companies that process the position data of their employees, but should not lead to the misconception that GPS monitoring of employees is now always inadmissible. Rather, it always depends on the respective processing context such as the industry and the specific technical design. For example, the court explicitly noted the storage period of 150 days and the fact that it was technically not necessary for the permitted to collect any location data, at least in the context of such private use.
A legal legitimation according to § 26 para. 1 sentence 1 BDSG or Art. 6 para. 1 lit. f DSGVO is not per se excluded, even if no insignificant requirements are laid down. It is not comprehensible why the court has unconditionally described position data as "irrelevant to planning", especially since the processing of employee data for internal administrative purposes is explicitly recognised as a legitimate interest by the General Data Protection Regulation. The blanket judicial reference to the keeping of driver's logbooks, which would do equal justice to corporate interests, fails to recognise this entrepreneurial organisational sovereignty against the background of more efficient technological possibilities. Here it will depend on a comprehensible argumentation to the supervisory authority or the respective court. Consents are considered as impracticable, because they can be freely revoked at any time and therefore do not represent a reliable basis for an efficient operational organisation.
Unfortunately, the decision did not give rise to the assessment of works agreements, which according to § 26 para. 1 sentence 1 BDSG can also constitute independent legal bases for the processing of employee data. Companies also have the option of concluding a works agreement for the processing of corresponding position data under the validity of the General Data Protection Regulation. Insofar as it complies with the highest court requirements for employee monitoring, it represents a suitable legal basis for data processing. Companies that have implemented the employment-related requirements for employee monitoring not yet, should take the court's information as an opportunity to critically review their own status of implementation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
