GDPR Data processing modelGeolocation and Monitoring of Employee-Assigned Vehicles
Purposes (4)
A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable
Data categories (3)
Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)
Employee travel data
Data details
Data conservation rules
Active base:
Active use ≤ 3 months
proportionate under accountability principle; Information Commission (ICO) employment data retention guidance.
Intermediate archiving:
For legal claims/security incidents: ≤ 6 months.
proportionate under accountability principle; Information Commission (ICO) employment data retention guidance.
Destruction
Additional vehicle use data
Data details
Data conservation rules
Active base:
No statutory period applies to vehicle location data; the controller should set the shortest period needed for each purpose (UK GDPR, Article 5(1)(e)), for example: raw location and journey data kept for 2 months; data kept up to 12 months where needed to prove that a service was performed or to optimise routes, and longer only while a dispute about the service is ongoing. Where tracking is used to monitor working time (only when no less intrusive means exists), only the data on hours worked are kept, as working time records.
UK GDPR, Article 5(1)(e); Working Time Regulations 1998, reg. 9; National Minimum Wage Regulations 2015, reg. 59
Intermediate archiving:
Intermediate storage, with restricted access: data proving a service kept while a dispute is possible (for example up to 12 months, longer if a dispute is pending). Hours-worked data kept as working time records for at least 2 years (Working Time Regulations 1998, reg. 9) and, where used to show National Minimum Wage compliance, for 6 years (National Minimum Wage Regulations 2015, reg. 59). Location details are not needed for this and should be removed.
Working Time Regulations 1998, reg. 9; National Minimum Wage Regulations 2015, reg. 59; Limitation Act 1980, s.5
Destruction
Employee identification data
Data details
Data conservation rules
Active base:
Identification data of the employee to whom the vehicle is assigned (name, staff number, vehicle assigned) are kept in the active database for as long as the vehicle is assigned to the employee. No statutory period applies; location data linked to the employee follow the retention periods set for vehicle use data.
Working Time Regulations 1998, reg. 9; Limitation Act 1980, s.5
Intermediate archiving:
After the assignment ends, only the data needed to link journeys, hours or incidents to the employee are kept in intermediate storage, for as long as the related records are kept (for example 2 years for working time records under the Working Time Regulations 1998, reg. 9) or while a claim is possible. No statutory period applies to the rest; the controller may set, for example, 6 years after the end of employment to defend contractual claims (Limitation Act 1980, s.5), or a shorter period if no claim is foreseeable.
Destruction
Data subject (1)
A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process
- Employees
Attribution / Pas d'utilisation commerciale
CC-BY-NC
