--- title: "GPS on company cars in compliance with the GDPR and the Workers' Statute" url: 'https://argobs.com/en/gps-su-auto-aziendali-in-conformita-al-gdpr-e-allo-statuto-dei-lavoratori' markdown: 'https://argobs.com/en/gps-su-auto-aziendali-in-conformita-al-gdpr-e-allo-statuto-dei-lavoratori.md' lang: en date: '2025-06-27' description: "Installing geolocation devices (GPS – Global Positioning System) on company vehicles is an effective tool for optimizing fleet management, improving worker safety and protecting the company's assets. Because these devices involve the processing of personal data, their adoption is strictly regulated…" taxonomy: category: - gdpr --- # GPS on company cars in compliance with the GDPR and the Workers' Statute 27 June 2025 | GDPR Installing geolocation devices (GPS – Global Positioning System) on company vehicles is an effective tool for optimizing fleet management, improving worker safety and protecting the company's assets. Because these devices involve the processing of personal data, their adoption is strictly regulated by Article 4 of Law 300/1970 (the Workers' Statute) and by Regulation (EU) 2016/679 (GDPR). Below is a summary of the legal and organizational requirements for compliant use. Article 4 of the Workers' Statute is very clear on this point and permits the use of tools that entail potential remote monitoring (such as GPS) exclusively for: - Organizational and production needs – for example planning more efficient routes, coordinating field interventions, locating the nearest vehicle for an emergency, monitoring mileage for maintenance or reimbursements; - Workplace safety – to be able to locate a vehicle in the event of a breakdown, accident or other emergency, thereby ensuring the employee's safety; - Protection of company assets – to prevent theft of the vehicle or its improper use outside working hours and work purposes. In any case, it is absolutely prohibited to install GPS systems with the primary or sole purpose of constantly monitoring the employee's work performance, breaks or speed, or of carrying out continuous and indiscriminate monitoring of their activity. In any case, even if the installation falls within one of the purposes listed above, before proceeding the law requires a mandatory procedure, namely entering into a *Collective Agreement* with the company trade union representatives (RSA) or with the unitary union representation (RSU), where present in the company. Failing an agreement, or in the absence of such representatives, it is mandatory to request and obtain formal authorization from the territorially competent office of the National Labour Inspectorate (INL). Installing the GPS system without either the union agreement or the Inspectorate’s authorization is unlawful. Once an agreement has been reached with the unions or authorization has been obtained from the INL, the processing of the data collected through GPS must follow the fundamental principles set out in the GDPR: - Lawfulness, Fairness and Transparency – processing is lawful and fair if it complies with the regulatory procedure, and transparency is essential, meaning employees must be clearly informed about the use of these systems; - Purpose Limitation – the data collected must be used solely for the purposes stated in the agreement/authorization and communicated in the privacy notice; - Data Minimization – only the data strictly necessary to achieve the agreed/authorized purposes may be collected, which means, for example, limiting the frequency of tracking to what is strictly indispensable and, crucially, providing ways to deactivate location tracking outside working hours; - Storage Limitation – location data cannot be kept indefinitely. The retention period must be defined and proportionate to the purposes; - Integrity and Confidentiality – protect the data from unlawful access or loss through adequate security measures, both technical and organizational. Limit access to the data to personnel who are specifically authorized and trained on the permitted purposes. Articles 13 and 14 of the GDPR establish the need to provide a Privacy Notice to ensure clarity for employees. Even before the GPS system is activated, workers must receive a Privacy Notice that is complete and understandable to everyone, detailing in particular: the Data Controller and its contact details (including those of the Data Protection Officer, if appointed); the specific purposes for which the GPS data is collected; the legal basis for the processing; the types of data processed; how the system works; the exact data retention period; who will have access to such data within the company; the employee's rights; and the right to lodge a complaint with the Italian Data Protection Authority (the Garante). Given the potentially invasive nature of the systematic geolocation of workers, it is almost always mandatory to carry out a Data Protection Impact Assessment (DPIA) pursuant to Article 35 of the GDPR. This document, to be drawn up before the processing begins, serves to identify and assess the risks to employees' rights and freedoms and to define the measures to mitigate them. In conclusion, installing GPS systems on company vehicles is feasible and can bring benefits, but it requires particular care and a careful, rigorous procedure. In general, given the legal and technical complexity, it is advisable to rely on experts in data protection and labor law to ensure compliance with the regulations and avoid heavy penalties, including criminal ones. Argo Business Solutions offers a wide range of data protection services and supports your organization at every stage of the process, from analyzing the purposes of the processing to drafting contractual agreements and authorization requests, through to preparing the DPIA and privacy notices and defining and updating internal policies, ensuring technically sound solutions that are fully compliant with the GDPR and the Workers' Statute. Would you like more information on how we can help your company comply with current regulations? Write to us using the contact form or send an email to . --- ## Navigation - Parent: [News](https://argobs.com/en/news.md) - Previous: [GDPR – The European and Italian public authorities to follow to stay up to date](https://argobs.com/en/gdpr-le-autorita-pubbliche-europee-ed-italiane-da-monitorare-per-tenersi-aggiornati.md) - Next: [OWASP code checks](https://argobs.com/en/i-controlli-owasp-sul-codice.md)