A fleet management system based on telemetry is essential to be able to collect a set of information that, when properly processed, allow us to have a global view of the performance of vehicles and their users. But this need to increase fleet efficiency often comes up against on the individual rights of the worker.
So, how to reconcile the installation, use and processing of data collected by these tools with the present Portuguese law on the right to privacy and the processing of personal data, including those of workers in the exercise of their activity?
The task is not easy given the spirit of the Personal Data Protection Law No. 67/98, of 26 October, which transposed a European directive to the Portuguese legal system.
This set of articles and successive additions, which establish the scope of the collection and processing of information that may be considered of a personal nature, aims, in the professional sphere, to protect the worker and prevent the employer from acting in a way that is harmful to the employee's interests, resorting to intrusive and abusive methods of their privacy, especially outside the activity or working hours.
Hence, with regard to motor vehicles, they must include a command that can turn them off whenever the user deems it justifiable.
So under what conditions is it really possible to equip vehicles with geo-location instruments and/or that allow the collection of information relating to its driving?
One of the exceptions is whenever the vehicle's activity makes its introduction justifiable (transport of valuables, dangerous goods, passengers or provision of private security, for example), in compliance with certain requirements, including prior authorization from the National Commission of Data Protection (CNPD). In addition to the worker's knowledge. But not only.
The company is also obligated to a set of procedures and deadlines for the conservation of collected information , which may serve for statistical purposes, and should never be treated individually and publicly disclosed, either with the direct identification of the user or even the registration of the vehicle.
There must also be a responsible for conducting and managing the process.
It is responsible for making a prior analysis regarding the compliance of data processing with the law, particularly when what is at stake is locating the vehicle in case of theft, controlling the accident rate or establishing liability for fines in the case of vehicles shared by several conductors.
New European regulation increases fines
Personal data protection obligations will change. As of May 25, 2018, the new General Regulation on Data Protection – Regulation (EU) 2016/679, of April 27, 2016 – has as main objectives to update legislation approved more than 20 years ago, ie , prior to the widespread use of the internet and the digital revolution, and to harmonize it among the various member states of the Union.
Citizens now have new rights and the obligations for companies will increase.
In particular the requirements to provide users with access to the personal data collected, as well as the duties to adopt more demanding policies and procedures for data security, including the creation of a figure responsible for protecting the information, its processing and use, as well as the notification of breaches of security or cases of breaches of personal data to the competent authorities and to the data subjects themselves.
It is also substantially aggravated the fine regime , which could reach up to 20 million euros or up to 4% of the company's annual turnover worldwide, whichever is higher.
Consult Fleet Magazine for more articles on the automotive market.