Case Commentary: VG Wiesbaden, Judgment of 17 January 2022 – 6 K 1164/21.WI
Introduction and Facts
The judgment of the Administrative Court (Verwaltungsgericht, VG) Wiesbaden dated January 17, 2022, addresses the data protection law admissibility of GPS tracking in a logistics company with 76 employees. The company had installed GPS systems in 55 company vehicles, which enabled not only live location tracking but also the storage of location data for a period of up to 400 days. The data processing also included information from driver cards containing personal data such as name and date of birth. Employees were not informed about the introduction of GPS tracking, and no consents were obtained. The data protection authority subsequently prohibited the storage of GPS data and ordered the company to implement live tracking only and to delete all stored data.
Key Legal Issues
The core legal questions were whether the storage and evaluation of GPS tracking data in the employment context is permissible and whether employee consent can serve as a legal basis for such processing. Another issue was whether financial incentives, such as a salary increase, could influence the voluntariness of consent.
Court’s Reasoning
The court dismissed the company’s claim and upheld the orders of the data protection authority. It found that the long-term storage of GPS data for purposes such as efficiency improvement, theft prevention, and evidence preservation was not necessary and thus disproportionate under the GDPR. The court argued that storage of data was not the least intrusive means to achieve these purposes, as live tracking would suffice for short-term coordination and route optimization. For theft prevention, access to the live location in specific cases was deemed sufficient.
Storing location data for evidence preservation was also not justified, as it was not suitable for proving service delivery. The court emphasized that general, preventive monitoring without specific suspicion is impermissible. Storage of personal data for control or evidence purposes requires a concrete, documented initial suspicion.
On Consent in Employment Relationships
The court examined in detail whether employee consent could justify the data processing. According to Section 26(2) of the German Federal Data Protection Act (BDSG) and Article 6(1)(a) GDPR, consent is only valid if it is given voluntarily. The court referred to established case law of the Federal Labour Court, which holds that due to the hierarchical relationship in employment, true voluntariness of consent can rarely be assumed.
Financial Incentives and Voluntariness
However, the court explicitly left open whether a financial incentive—such as a salary increase—might, in an individual case, be sufficient to render consent voluntary. The court noted that it did not need to decide whether a financial benefit such as a salary increase could make consent voluntary, and thus effective. This leaves open the possibility that, under certain circumstances—such as a significant financial benefit—the voluntariness of consent could be assumed despite the inherent dependency in the employment relationship. The court, however, cautioned that even in such cases, the strict requirements for voluntariness and transparency of consent must be observed, and a case-by-case assessment would be necessary.
Guiding Principles (Leitsätze)
Long-term storage of GPS tracking data for monitoring employees in the logistics sector is disproportionate and violates the GDPR unless there is a specific reason.
Live tracking of vehicles may be permissible if it is limited to what is strictly necessary and no long-term storage occurs.
Employee consent to the storage and evaluation of GPS data is generally not a valid legal basis in the employment context, as it is usually not given voluntarily.
The court leaves open whether a significant financial incentive, such as a salary increase, could in individual cases render consent voluntary and thus effective.
Companies must fully inform employees about GPS tracking in accordance with Article 13 GDPR.
Storage of personal data for control or evidence purposes requires a concrete, documented initial suspicion.
Detailed Reasoning and Assessment
The VG Wiesbaden’s judgment is a significant addition to case law on employee data protection. It underlines that the requirements for the lawfulness of monitoring measures in employment are strict. Courts demand a rigorous assessment of necessity and proportionality for each individual measure. The storage of GPS data over a long period is only permissible in exceptional cases, such as when there is a specific suspicion of misconduct and storage is necessary for evidence preservation.
The court’s discussion of consent is particularly relevant. While consent under the GDPR is generally a valid legal basis for processing personal data, there are serious doubts about its voluntariness in employment due to the structural imbalance between employer and employee. The court follows the restrictive approach of case law and supervisory authorities, according to which consent in employment is only genuinely voluntary in rare exceptional cases.
By explicitly leaving open whether a financial benefit such as a salary increase could make consent voluntary, the court points to the need for a case-by-case assessment. It acknowledges that voluntariness is not categorically excluded if the employee receives a substantial benefit. However, it remains unclear how significant the financial incentive would need to be and how the balancing of interests would be conducted in practice. Companies wishing to rely on such consent must therefore carefully document that consent was truly voluntary and given without pressure or coercion. They must also ensure that employees have an unrestricted right to withdraw consent at any time and that there are no negative consequences for refusal or withdrawal.
Practical Implications for Companies
For companies, the judgment means that they should be extremely cautious when using GPS tracking systems. Storing location data beyond the moment of live tracking is generally impermissible. Obtaining consent is only a viable legal basis in the employment context in rare exceptional cases. Companies should therefore primarily rely on other legal bases, such as Section 26(1) BDSG (necessity for the employment relationship) or Article 6(1)(f) GDPR (legitimate interest), always subject to a strict proportionality assessment.
Conclusion
The VG Wiesbaden has set a high bar for the data protection-compliant use of GPS tracking in the employment context. The storage of location data is only permissible in narrowly defined exceptional cases. Employee consent is generally not a valid legal basis, although the court leaves open whether a significant financial benefit, such as a salary increase, could make consent voluntary in individual cases. Companies are therefore well advised to proceed with great care when introducing and using GPS tracking systems and to seek legal advice if in doubt.
Note:
Jüdemann Rechtsanwälte advise companies comprehensively on all data protection matters, particularly on the data protection-compliant design of GPS tracking and other monitoring measures in the employment context.
