“Can I put GPS on the vans and see where the drivers are?” It’s one of the most common — and most misunderstood — questions for anyone running a fleet. The short answer is yes, but under precise conditions: geolocating company vehicles touches two bodies of law at once, the Italian Workers’ Statute and the GDPR, and ignoring them exposes the company to penalties and to the data collected being unusable.
This guide explains what it takes to use fleet GPS legitimately, without turning an efficiency tool into a liability.
Is it legal to install GPS on company vehicles?
Yes, geolocating company vehicles is legal, provided three conditions are met: a legitimate purpose (security, organization, asset protection), the procedure set out in Article 4 of the Workers’ Statute, and the GDPR obligations toward employees. The device itself isn’t banned: what’s prohibited is its unauthorized use and the disproportionate monitoring of the worker.
The underlying principle is that GPS must not become a tool for systematic surveillance of the individual, but it can legitimately serve to manage vehicles, safety and logistics.
Article 4 of the Workers’ Statute: remote monitoring
Article 4 of Law 300/1970, as amended by Legislative Decree 151/2015 (the Jobs Act), governs tools from which the possibility of remote monitoring of workers also arises. A GPS tracker normally falls into this category.
The rule is:
- Installation is allowed only for organizational and production needs, workplace safety or protection of company assets.
- It requires an agreement with the union representatives (RSA/RSU) or, failing an agreement, authorization from the territorial office of the National Labour Inspectorate (INL).
There is an exception (paragraph 2) for “tools used by the worker to perform their job”. Be careful, though: according to the Labour Inspectorate’s guidance, GPS does not generally fall under this exception — it isn’t indispensable to driving the vehicle — so the agreement or authorization remains necessary.
Finally, paragraph 3 is decisive: the data collected is usable for all purposes connected to the employment relationship (including disciplinary ones) only if the worker has been given adequate notice of how it is used and monitored, and in compliance with the GDPR. Without that notice, the data cannot be used.
GDPR: notice, legal basis, minimization
Locating a vehicle driven by a person means processing personal data. Regulation (EU) 2016/679 requires you to:
- Identify a legal basis (typically the controller’s legitimate interest, balanced against the worker’s rights).
- Provide clear privacy notice to employees on what is collected, why, for how long and who accesses it.
- Apply minimization: collect only the data necessary for the stated purpose.
- Consider a DPIA (data protection impact assessment) when monitoring is systematic.
- Set retention periods that are limited and proportionate.
The limits set by the Garante (Italian DPA)
The rulings of the Italian Data Protection Authority on the geolocation of company vehicles converge on a few practical boundaries:
- No constant monitoring of position when it isn’t necessary for the purpose: tracking must be proportionate, not continuous by default.
- Deactivation off-duty: where possible, the system must allow tracking to be suspended during breaks and outside working hours.
- Limited access to data, restricted to authorized roles with defined purposes.
- Transparency: the worker must know the vehicle is geolocated.
In short: the purpose must be managerial and safety-related, not surveillance of the individual.
How to use fleet GPS compliantly
- Define the purpose: security, anti-theft, logistics optimization, asset protection. Put it in writing.
- Run the Article 4 procedure: union agreement or, failing that, an authorization request to the INL.
- Prepare the GDPR notice for employees and, if needed, the DPIA.
- Configure minimization: no tracking off-hours, limited retention, role-based access.
- Communicate transparently: explain the purpose and limits of the system to drivers.
- Document everything: agreement/authorization, notice, record of processing.
A good fleet tracking and management system is built with these capabilities from the start: access profiles, purpose configuration, and proportionate data collection. Technology doesn’t solve the procedure — that’s on the company — but it should make it workable rather than getting in the way.
Frequently asked questions
Is a union agreement mandatory to install GPS on company vehicles?
Usually yes: Article 4 of the Workers’ Statute requires an agreement with union representatives (RSA/RSU) or, failing that, authorization from the National Labour Inspectorate. GPS is generally considered a tool from which remote monitoring may arise, so it doesn’t fall under the “work tools” exception.
Can I use GPS data for disciplinary action?
Only if you have given employees adequate notice of how the system is used and monitored, and you comply with the GDPR (Article 4, paragraph 3, of the Workers’ Statute). Without prior notice, the data collected cannot be used for disciplinary purposes.
Must I be able to turn GPS off outside working hours?
The Garante’s rulings indicate that, where possible, the system must allow tracking to be suspended during breaks and off-duty, applying the minimization principle. Continuous, indiscriminate tracking is hard to justify as proportionate.
Does vehicle GPS require a DPIA?
When geolocation involves systematic monitoring of workers, the GDPR requires a data protection impact assessment (DPIA). It’s good practice to prepare one and keep it up to date.
This article is for information only and does not constitute legal advice. For your specific situation, check with a trusted labour or legal advisor.
Want a fleet management system built with access profiles and proportionate data collection? Discover OptivoTrack or book a demo.