The General Data Protection Regulation (GDPR) is the biggest change in how businesses handle personal data since the introduction of the Data Protection Act in 1998. It dramatically increases personal rights around consent, collection, usage, storage and access to personal data, whether that of consumers or employees.<\/p>\n\n\n\n
GDPR impacts companies using vehicle tracking and telematics systems, as it is deemed to be \u2018collecting and storing personal data\u2019. Vehicle tracking can improve operational performance and reduce costs, but fleet managers need to ensure the correct processes and documentation are in place to comply with the new legislation. This guide is an introduction to GDPR, based on current industry interpretations. However, companies are advised to seek their own legal advice, as Quartix is not a law firm.<\/p>\n\n\n\n
Companies need to comply by 25 May 2018. Failure to meet GDPR\u2019s terms will be punishable by stiff penalties \u2013 businesses can be fined \u20ac20 million or up to 4% of global annual turnover, whichever is the greater.<\/p>\n\n\n\n
The UK is leaving the EU, do we still need to worry about GDPR?<\/p>\n\n\n\n
Yes. Although it is EU legislation, the UK Government has said it is likely to implement similar rules, and any company doing business in the EU post-Brexit will need to be compliant with GDPR.<\/p>\n\n\n\n
GDPR makes clear that personal data includes online identifiers and location data \u2013 meaning that IP addresses and mobile device IDs are all personal and must be protected accordingly. All of these will now be subject to the same data protection requirements as every other type of personal data.<\/p>\n\n\n\n
Key Rights:<\/p>\n\n\n\r\n Key Roles:<\/p>\n\n\n\r\n Companies need to look at all the ways they collect, store, and process personal data. When it comes to handling telematics data involving drivers, these are the three areas companies should focus on:<\/p>\n\n\n\n 1. Consent or Legitimate Interest<\/strong><\/p>\n\n\n\n Companies have two options when it comes to justifying the collection and management of personal data. They can either gain consent from drivers or make a case based on legitimate interest.<\/p>\n\n\n\n Option 1: Consent<\/p>\n\n\n\n Consent must be freely given, specific, informed and unambiguous. Companies will need to prove that they have received consent and that drivers understand what data is being collected and why. If drivers do not give consent, or withdraw it later, the tracking would need to be removed.<\/p>\n\n\n\n Option 2: Legitimate Interest<\/p>\n\n\n\n An alternative is to use a justification of legitimate interest, i.e. it is essential to business operations or to prevent fraudulent activities. Examples of legitimate interest could include:<\/p>\n\n\n\r\n This needs to be specific and documented \u2013 simply stating the need to check on \u2018good and \u2018bad\u2019 drivers may not be sufficient. To show legitimate interest, companies must conduct a risk assessment that balances the rights of the data subject against the interests of the business.<\/p>\n\n\n\n 2. Transparency<\/strong><\/p>\n\n\n\n GDPR also provides staff with the right to access any personal data held on them quickly and easily. This includes any telematics data where they are identifiable as the driver of a vehicle. They will also have the right to ask to change any errors and to erase personal data if required.<\/p>\n\n\n\n 3. Security<\/strong><\/p>\n\n\n\n The GDPR increases requirements to protect personal data. It will compel all organisations to report any data breach that \u201cis likely to result in a risk to people\u2019s rights and freedoms\u201d, to their relevant supervisory authority (the Information Commissioner\u2019s Office in the UK), as well as notifying the individuals affected. This all has to happen within 72 hours of the breach being discovered, and failing to notify the authorities can result in significant fines.<\/p>\n\n\n\n It is important to bear in mind that this doesn\u2019t just cover personal data being lost or stolen by hackers \u2013 it also covers access by those that are not authorised to view it as part of their role. Data, therefore, needs to be stored securely and organisations have to look at how they grant permissions to view information internally.<\/p>\n\n\n\n Quartix has always followed industry best practices and legislation (such as the Data Protection Act).<\/p>\n\n\n\r\n While compliance is a matter for individual organisations, who are the \u2018data controllers\u2019 under GDPR, Quartix, as the \u2018data processor\u2019, is fully committed to helping our customers meet GDPR needs and we are working towards compliance with the General Data Protection Regulations by the deadline on 25th May 2018. Key features of our system designed to assist with GDPR compliance:<\/p>\n\n\n\n 1. Access to data and potential rectification<\/p>\n\n\n\n Quartix customers have self-service access to their data and can easily make recent data available to drivers, if required. This reduces the time, effort and resources required to deal with any driver requests for the personal information held on them.<\/p>\n\n\n\n 2. Security and auditability<\/p>\n\n\n\n Data has always been protected in Quartix, both within vehicle units and in our secure data centres. Customers\u2019 access permissions to data can be set at a granular level, allowing them to restrict the information that specific employees can view. Any changes to vehicle and driver data made through our web application are automatically recorded, providing an audit trail to support compliance.<\/p>\n\n\n\n 3. Access to data<\/p>\n\n\n\n Under GDPR, customers and individual \u2018data subjects\u2019 have the rights to access and request changes to the data concerning them. Quartix will refer any such request from an individual \u2018data subject\u2019 to the customer as the \u2018data controller\u2019. Customers will have the option to request extracts of the data concerning their vehicles and \/ or have it removed from the system.<\/p>\n\n\n\n If a company is collecting and using telematics data (the data controller), responsibility needs to be upheld for the personal data collected. To help achieve compliance, start by asking these questions:<\/p>\n\n\n\r\n For an official overview of GDPR visit the Information Commissioner\u2019s Office (ICO) website at For information on how GDPR affects employment contracts: For information on the UK Government Cyber Essentials scheme for IT security: Quartix has delivered real-time vehicle-tracking and telematics solutions to small and mid-size fleets for over 16 years. Businesses choose Quartix because we offer cost-efficient solutions that are easy-to-use from installation through reporting. Over 10,000 companies are using Quartix solutions to gain actionable insight into vehicle movements, engine usage, driver behaviour, and fuel consumption.<\/p>\n\n\n\nThree areas to focus on<\/h2>\n\n\n\n
Quartix and GDPR<\/strong><\/h2>\n\n\n\n
Checklist \u2013 Questions to consider<\/strong><\/h2>\n\n\n\n
<\/h4>\n\n\n\n
Additional Resources<\/strong><\/h2>\n\n\n\n
https:\/\/ico.org.uk\/for-organisations\/data-protection-reform\/overview-of-the-gdpr\/<\/a>
https:\/\/ico.org.uk\/media\/fororganisations\/documents\/1064\/the_employment_practices_code.pdf<\/a><\/p>\n\n\n\n
http:\/\/www.shoosmiths.co.uk\/client-resources\/legal-updates\/hr-gdpr-changing-employment-contracts-andpolicies-13115.aspx<\/a><\/p>\n\n\n\n
https:\/\/www.cyberessentials.ncsc.gov.uk\/<\/a><\/p>\n\n\n\nAbout Quartix<\/strong><\/h2>\n\n\n\n