Sixty seconds is too often: the Italian authority says polling a vehicle's position that fast is continuous monitoring

How it reached the authority

A driver employed by the authority complained that he had been subjected to disciplinary proceedings, ending in suspension, on the basis of data collected by the satellite tracking system fitted to the company car. He argued the collection had taken place without the conditions of Article 4 of Law 300/1970 and without the required information, noting also the absence of stickers on the vehicle indicating that it was being tracked.

One detail takes up a few lines in the decision and would deserve an article of its own: to justify his movements in the disciplinary proceedings, the worker sent the employer — at its request — a medical certificate setting out the conditions he suffered from, and copies of receipts for certain medicines. A system designed for fleet management thus ended up collecting health data. Similar complaints later came from other employees and were dealt with jointly.

The employer had done the paperwork, and it was not enough

This is not a case of an employer who had done nothing. It had a formal agreement with the works council and the trade unions, definitively signed on 3 July 2018, a regulation on the use of company vehicles published on the intranet, and dedicated GPS guidelines approved by resolution no. 88 of 8 February 2019, available in its transparency section. The Article 4 step, in other words, had been taken.

It was not enough because the issue was not permission to install, but how the system was configured.

Why sixty seconds is too often

The authority observes that such a short interval — taking into account road traffic rules and actual traffic conditions — made it possible to reconstruct employees' movements in a substantially continuous manner, giving rise to pervasive processing. The system also allowed real-time access to the vehicle's location, and did not let drivers deactivate the device even during breaks or in emergencies.

This is not new: the decision expressly recalls the decision of 19 July 2018, no. 427, concerning vehicles used to transport special and hazardous waste, where a 120-second interval had already been held disproportionate. Sixty is half of that.

The test to take away

The decision restates the conditions that make vehicle tracking acceptable in the employment relationship: activate the system only where strictly necessary for the purposes; as a rule allow deactivation during breaks and outside working hours; as a rule process in pseudonymised form, using information that does not directly identify; store the data only where necessary and for periods proportionate to the purposes, as a rule excluding the monitoring of the routes taken. The decision also cites the note of the National Labour Inspectorate with operational guidance on authorisations under Article 4.

During the investigation the employer moved the polling interval to 15 minutes. The authority called this an appreciable change in terms of proportionality, accountability and respect for workers' dignity, and took it into account in setting the fine.

The provisions infringed

The authority declared the processing unlawful for infringement of Articles 5(1)(a), (b) and (c), 6, 25, 35 and 88 of the GDPR, and of Articles 113 and 114 of the Italian Data Protection Code. Article 35 is worth pausing on: among the infringements is the failure to carry out a data protection impact assessment. A system that follows employees minute by minute is precisely the case where the assessment had to come first, not be argued about afterwards.