The Legal Basis for Tracking Staff
Location data about identifiable workers is monitoring. What that means for the basis you rely on, and why consent is the weakest option available.
General orientation, not legal advice. Requirements differ substantially by jurisdiction and are developing quickly.
Under European data protection law, tracking the movements of employees is employee monitoring, with everything that follows from that.
Consent does not work here
Consent must be freely given, and in an employment relationship it usually is not: refusing is not a real option when the employer decides your work.
Regulators have said this repeatedly and it is one of the few settled points in this area.
Which means a consent form for vehicle tracking is not a basis. It may be a useful record that people were informed, and it is not what makes the processing lawful.
What employers usually rely on
Legitimate interests, with a documented balancing test weighing the employer's purpose against the worker's rights.
Legal obligation, where tracking is required — driver hours rules in some transport contexts, for example.
Contract, narrowly, where the processing is genuinely necessary to perform it.
Legitimate interests is the common answer, and it is conditional rather than automatic: it fails where a less intrusive method would achieve the purpose.
What regulators have actually found
Property protection can be a legitimate interest — a European supervisory authority reached this conclusion on vehicle tracking — but the measure still has to be appropriate and necessary.
Continuous tracking has repeatedly been found excessive, including where the stated purpose was fleet management and asset protection.
Tracking during breaks has been found excessive.
Retention of route history for months has been found excessive, with one case turning on a 180-day period.
Tracking outside working hours, where a vehicle was used privately, has been found a disproportionate interference with private life.
The pattern is consistent: the purpose is frequently accepted and the amount of data collected is frequently not.
Prior authorisation and consultation
Several jurisdictions require more than a lawful basis.
Italian law restricts direct and continuous tracking of workers, permitting it only for defined purposes such as organisational needs, health and safety, or property protection — and requiring authorisation.
Works council agreement is required in several European jurisdictions before a system capable of monitoring can be introduced.
And authorisation is not a shield. An Italian case in 2025 fined a company that had obtained prior authorisation from the labour inspectorate but did not implement the safeguards that authorisation was conditional on.
An impact assessment is likely required
Location tracking of workers meets several of the criteria that trigger a data protection impact assessment: systematic monitoring, large scale, vulnerable data subjects given the employment imbalance.
Assume you need one and write it before deployment rather than after a complaint.
Record the proportionality reasoning specifically: what less intrusive option was considered, and why it was rejected. For location the less intrusive options are real — geofenced arrival points, aggregate distance, position on demand — which makes the rejection hard to write and worth writing anyway.
Write the balancing test down
Where legitimate interests is the basis, the test is the document.
The interest, stated specifically — not "efficiency" but "confirming attendance at customer sites to resolve billing disputes".
Why this processing is necessary for it, including what else was tried.
The effect on the people tracked, honestly.
Why the interest is not overridden, given that effect.
An unwritten balancing test has not been conducted, and that is how it will be read.
Connect policy to configuration
The practical choices behind this note can be compared with the service-desk workflow. Keep the written purpose in control of the setup, enable only the data needed and review the result with affected workers.
Independent reference
For an external point of reference, see the European Data Protection Board. Its official guidance can support the legal review where European data-protection rules apply.