GPS that never switches off on staff: where the line is

A European data protection authority once looked at a haulage firm that had fitted GPS to its vehicles and simply left it running. Position, speed, mileage, the state of the van, logged without a pause across roughly fifty people. During lunch breaks. While the work was stopped. The fine that landed was fifty thousand euros, and it had nothing to do with the GPS itself. It was about how the firm used it. That distinction is worth sitting with, because plenty of honest UK employers walk straight into the same trap convinced they are on the right side of the line.

Locating a vehicle or a person for a genuine reason, planning jobs, proving an attendance, covering yourself when a client disputes the work, is not banned under UK GDPR. What turns a lawful system into a problem is the disproportion: collecting far more than the job needs, leaving the tracking switched on when there is no work reason to track anyone, holding the data for months with no purpose behind it. The principle has a dry name, data minimisation, and it says something very simple. Take only what you need, for as long as you need it, and not a gram more.

A person’s location logged while they are eating a sandwich serves no legitimate business purpose at all. It does not tell you whether they worked, it does not protect you in a dispute, it organises nothing. It just sits there, a record gathered for no reason, and that one surplus data point is exactly what tips a lawful arrangement into a breach. The ICO has gone back to this ground more than once in its guidance on monitoring workers, and the message holds steady: GPS left on by default, all day, is the wrong way to run it.

The difference between proof and a tail

Picture it. One thing is a photograph taken the moment you walk on and off the site: it says where you were in that instant, it does its job, and it ends there. Another thing is a camera that follows you all day, films you while you eat, while you take a private call, while you head home. The first is proof. The second is surveillance, a tail. On the legal side, and on the plain common-sense side too, those are two different worlds, and the law rewards the first and punishes the second.

The trouble is that a lot of systems on the market are built like the camera, not like the photograph. They are designed to scoop up as much as they can, because that suits the people selling them, and they leave the employer with the job of holding back. Except the responsibility, when the complaint arrives, falls on whoever gathered the data, not on whoever sold the software. You end up answering for a feature you never even asked for, switched on by default because “you never know”.

Collecting less is safer, not less useful

There is a myth to clear up here, the idea that collecting less data means having less control over the work. It does not. To run a field team and genuinely cover yourself you do not need to know where every person is in every second of the day. You need to know where the shift started, where it closed, at what time, and to have proof of attendance when the work has to be demonstrated. That is the whole of it. That handful of data covers every real need, and it carries the enormous advantage of never putting you in the seat of the haulage firm in that complaint.

Collecting the minimum also makes life with your workforce easier. The privacy notice is cleaner, the lawful basis is simpler to stand behind, and the conversation with staff or their representatives is far less tense, because you are not asking anyone to accept being followed around, only to log two timestamps. People take to a tool that respects them far more readily, and you spare yourself the wall of grievances that continuous tracking always drags along behind it.

---

Built to take the location only when it counts

GeoTapp is built to sit on the photograph side, not the camera side. The location is captured only in the instant someone clocks the start and the end of a shift, there is no continuous tracking, there is nobody following people through their break or after work. Once a session is closed it cannot be altered. That means you hold solid proof of where and when the work happened, and at the same time you gather not a single one of the data points that set the penalties going. Live-camera-only photos, sessions that stay put, device attestation behind them.

The fifty thousand euro fine on that firm did not arrive because it used GPS. It arrived because it left the GPS on when there was no reason to. The whole thing lives in the how, and the how is the difference between sleeping soundly and waiting for the complaint. Your current setup, if you look at it honestly, does it collect what you actually need, or all the rest as well, just in case?