The use of GPS or “global positioning systems” in the management of vehicle fleets is increasing. An employer may determine that tracking the location of a company vehicle, mileage, speed and the like is useful for managing costs, protecting assets and employees, and reducing liability. However, GPS also can let employers track employee movements, assess productivity and potentially even identify poor driving skills.

The impact of this type of tracking is just beginning to be considered by privacy commissioners and courts. In one case, the Privacy Commissioner of Canada examined how an organization can use GPS.

While we know little about what privacy law has to say specifically when applied to GPS, it is clear that general privacy law principles will apply to how an employer collects personal information by way of GPS systems.

General Requirements for GPS Use by Employers

General privacy law requirements are:

  1. For private sector employers, the collection must be “reasonable and appropriate in the circumstances”. For BC government employers, the collection of such information must be expressly authorized under a BC law, collected for law enforcement purposes or must relate directly to and be necessary for an operating program or activity of the public body. For federal government employers the collection must be directly related to an operating program or activity of the institution;
  2. Only the personal information necessary for the particular purpose should be collected, not more;
  3. Once collected, the organization, government body or government institution is required to protect the personal information and keep it secure from access, use or disclosure that is unauthorized; and
  4. Individuals have a right to request access to their personal information and to request correction of their personal information.

GPS Use by Businesses, Non-profit Organizations and Associations

So far, only the Privacy Commissioner of Canada has considered when the use of a GPS system by an employer is permissible under privacy law. The company involved in that case was subject to the Personal Information Protection and Electronic Documents Act (Canada).

Because the privacy commissioners across Canada are trying to develop a consistent body of guidelines and rules, it is probable that the requirements developed by the Privacy Commissioner of Canada for that case would be applied under other privacy laws. Those requirements are:

  1. The purpose for the collection of GPS information must be reasonable and appropriate in the circumstances;
  2. The employer must limit the amount of information collected to that which is necessary for the purposes identified;
  3. The loss of privacy should be in proportion to the benefit gained and there should be no less privacy-invasive way to achieve the purpose;
  4. If any information is to be used for employee management or discipline purposes, that should be clearly communicated to employees before the system is used and those purposes should be limited, exceptional and defined in advance.  Acceptable uses include investigating an employee if there are reasonable grounds for concern;
  5. This type of information should not be used routinely in employee management situations, nor should it be used for continual monitoring of employees;
  6. The employer should develop a policy for GPS systems which should set out clear terms and conditions for the use of the personal information to manage employees;
  7. All employees should be trained to understand the policy and the system. Employees and managers who control or use the system should know their privacy obligations and how to use the information appropriately.