Geolocation technology in company cars: how to get on the right track
22 May 2025
The installation of track-and-trace technology in company cars, often referred to as geolocation systems, can be a valuable addition to a company's operational toolbox. However, to correctly introduce a geolocation system, it’s important to take the regulatory framework into consideration. In this newsletter, we’ll set out the main principles in this respect, as well as put forward some best practices.
Company car geolocation defined
The notion of ‘company car geolocation’ is an umbrella term that refers to different types of track-and-trace technology – using GPS, mobile data, or a combination of both – that can be used to determine, record and transmit a company car’s whereabouts.
Although the benefits of track-and-trace technology for companies are apparent – be it in terms of fleet management, improving logistical efficiency, security or otherwise – the actual installation of this technology must not be approached casually. Indeed, as it clearly encroaches on an employee’s right to privacy, the introduction of geolocation technology must abide by the regulations governing this fundamental right.
The regulatory framework
In Belgium, there’s no legislation that specifically covers geolocation technology in company cars. As such, the general principles on the right to privacy –laid down in the Belgian constitution and the European Convention on Human Rights – will apply. In addition, as logging and transmitting a company car’s location constitutes the processing of personal data, the additional protection provided by the provisions of the General Data Protection Regulation (GDPR) also comes into play.
Considering these legal instruments, the introduction and use of geolocation technology in a company car can only be done in the pursuit of a legitimate aim and must adhere to the principles of legality, proportionality, transparency, and purpose limitation.
First and foremost, an infringement of an employee's right to privacy is justifiable only if it occurs for the purpose of pursuing a legitimate aim. This could e.g. be the safety of the employee, the protection of the company car, optimising the efficiency of new transport routes or monitoring employees’ professional activities. Additionally, the company car geolocation must have a lawful basis under the GDPR. When talking about company car geolocation in the private sector, this lawful basis will usually be that the geolocation is necessary for either i) the execution of the employment agreement, or ii) for the pursuit of a legitimate interest of the employer.
Next, the principle of legality means that the fundamentals and modalities of the company car geolocation must be laid down, in detail, in a document that’s clear and easily accessible, such as the company’s work regulations or a dedicated company policy.
The introduction of company car geolocation and the way the monitoring takes place must also be proportionate to the intended aim. Therefore, continuous tracking will in principle not be allowed. When the geolocation data is used to optimise transportation routes, long-term tracking – without being continuous – can, however, be considered proportionate. If private use of the company car is allowed, the tracking must in any case be deactivated altogether outside of the working hours. The obtained data also cannot be retained longer than is required for the intended aim.
Apart from the requirement to lay down the principles and modalities of the company car geolocation in writing (see above), the system must also be introduced in a transparent manner. The requires clear communication before the start of the actual tracking on, inter alia, the fact that geolocation will be conducted, for what aim, and on what legal basis, the duration of the geolocation, how long the data will be retained etc. In addition, it’s advisable to inform the works council or union representatives.
Lastly, the principle of purpose limitation requires the employer to only use the recorded data towards pursuing the aim for which the geolocation was set up in the first place.
How to do it right – some best practices
Detailed protocol on geolocation
When using geolocation technology in company cars, it’s imperative to establish a comprehensive and carefully considered protocol on the matter. In a recent ruling, the Belgian Data Protection Authority (DPA) opines that they consider it best practice for a company to conclude a separate agreement with the employees involved, or add an annex to these employees’ employment agreements, in order to meet the transparency requirement in this respect. However, such protocol could in principle also be included in the company’s work regulations or even in a dedicated company policy, which gives the company some more flexibility.
Deactivating tracking outside working hours
As already mentioned, tracking the location of the company car outside of the employee’s working hours is generally not allowed. The deactivation of the geolocation system after the working hours can in principle be done automatically, but in its recent ruling, the DPA writes that – as a best practice – the employee should be able to manually activate and deactivate the geolocation system. This would limit the chance that data is being processed outside of the employee’s working hours. This consideration applies particularly, the DPA states, where an employee works flexible hours that vary day by day, making automatic deactivation prone to errors.
If you have any questions regarding company car geolocation or if you seek assistance in drafting up a clear and thorough policy, do not hesitate to reach out; we’d love to hear from you!
