Partnerblog
On 25 March 2025, the Belgian Data Protection Authority (DPA) issued a decision regarding the use of a geolocation system in a company car. The DPA reaffirms the system’s legitimacy and clarifies the established principles in this decision.
Employee complaint
An employee submitted a complaint to the DPA, alleging that his employer had unlawfully used a geolocation system. The employee objected among others to the fact that it was not possible to switch off the system outside working hours or during holidays.
Permitted purposes for geolocation
The employer invoked the legal basis of ‘legitimate interest’ for the geolocation system. In its decision, the DPA applies the so-called legitimate interest analysis (LIA) to determine whether the legal basis of ‘legitimate interest’ can be invoked.
The DPA found that the employer relied on the geolocation system for various purposes. In the geolocation policy the following purposes were mentioned: (1) to obtain a simplification of the registration and administration for the purpose of invoicing and time registration, (2) insight into the routes, (3) insight into departure and arrival times; (4) reducing (fuel) costs, (5) a conclusive timesheet, (6) evidence for clients, (7) increasing safety, and (8) reducing communication costs.
However, according to the DPA, the primary purpose of the geolocation system was to monitor the work performance and hours worked by the employees, which was not mentioned in the policy. The employer confirmed this during the hearing. Since the employer had not communicated the correct purpose in advance, a violation of the purpose limitation and transparency principles was established.
In any case, the DPA ruled that both the purposes included in the policy and the monitoring of work performance and hours worked could constitute legitimate purposes for the use of the geolocation system.
Do not process more data than necessary
The DPA further confirms that the processing of the location, the kilometres driven, the start and end times, the journey duration and the stop times are necessary for the fulfilment of the abovementioned purposes.
In this context, the DPA also discussed the timeframes during which the data was registered. According to the DPA, the processor that offered the geolocation system recorded the data continuously but the employer only received the data which was registered during working hours.
The DPA goes on to say that – in the light of the purpose of monitoring work performance (see above) – it considers continuous data registration to be disproportionate and also a violation of the principle of data minimisation. It emphasises that the system must be set up in such a way that it can be deactivated outside working hours. This means that the employer may not have access, and that the processor may not even register the data. However, the DPA did not find any infringement in this regard as it did not have a detailed overview of the data registrations carried out by the processor.
With regard to the balancing test, the DPA states that the geolocation system has only a minor impact on the data subjects. Consequently, it ruled that the employer was entitled to invoke its legitimate interest as a legal basis.
Ruling
The DPA reaffirmed the legitimacy of the geolocation systems. The employer was however reprimanded for its infringement of the purpose limitation, transparency and data retention principles.
This decision serves as a welcome reminder for companies to check if they have implemented a geolocation policy where required, if all purposes are clearly described and if employees have the option to switch off the geolocation system outside of working hours if it is used for monitoring work performance.
Author
Matthias Vandamme
