Vehicle geolocation: privacy obligations apply without direct identification

Privacy and Data Protection
Vehicle Geolocation: Privacy Obligations Apply Even Without Direct Identification of the Worker
Court of Cassation

The case arose from a sanction imposed by the Data Protection Authority on a company for the use of a vehicle geolocation system without prior notification. The Tribunal had annulled the measure, finding that the system did not enable the identification of workers and was managed by a third party.
The Court of Cassation reversed this approach, clarifying that, for the purposes of data processing obligations, what is relevant is the possibility of linking — even indirectly — the position of the vehicle to the worker. It is sufficient that the system enables the geographical location of a vehicle to be identified, given that the employer may trace the identity of the driver through other company data.
It is therefore not necessary for identification to occur automatically or immediately: the mere potential for such a link suffices, even through subsequent processing or the cross-referencing of information. Nor is it relevant that the system is managed by a third party, where the company retains access to the data or the relevant login credentials.