D/EU: Data protection in the car - Part 2

The company car is increasingly developing into a rolling network. This raises the issues of data protection and data security. Many vehicles in corporate fleets are equipped with GPS receivers and navigation software. Added to this are networked on-board computers, high storage capacity, as well as mobile telecommunication facilities.

Data protection specialists therefore sometimes ask themselves whether vehicles with an on-board computer plus networked navigation software have now taken on the character of a process that is covered by data protection legislation.

With a new bill in section 32 g BDSG (Privacy Act), the legislator now intends to place the use of tracking systems used in company cars amongst others onto a concrete legal footing, since they are currently only covered by general legal data protection provisions that do not adequately reflect current technical capabilities.

In future, the processing and use of personal data from a tracking system in a company car, for instance, should only be permitted, if it is required for operational reasons to ensure the employee's safety or the coordination of their deployment.

The employee must be made aware of the use of the tracking system, and it may only be used during working hours.

The tracking system may also be used for the protection of property. But tracking for this purpose may not take place while the vehicle is in the employee's possession with the employer's permission.

What is still unclear is what is to be done about the on-board computers that are becoming ever more powerful and especially common in high-quality vehicles. These systems often store movement patterns and a multitude of individual data. Employers and employees are often not even aware as to which individual details are stored and over what period the on-board computers store the data that can be retrieved easily, especially in the car repair shops.

The complexity of the privacy-relevant storage of vehicle data and the possibilities of linking this data to personal data may make it expedient to take advice from a data protection expert. Companies and employee representatives who wish to ensure legal compliance in this area will contact their data protection officer on this matter.