Chapter 8 — Privacy and driver data

Lesson map

Lesson 08 published. Map, example, EX036.

flowchart TD
  N0["Learning outcomes"]
  N1["8.1 Telematics"]
  N2["8.2 Assessment"]
  N3["8.3 Involving drivers"]
  N4["8.4 Minimisation"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX036"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["8.1 Telematics"]
  N2["8.2 Assessment"]
  N3["8.3 Involving drivers"]
  N4["8.4 Minimisation"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX036"]

[Learning outcomes]
    |
    v
[8.1 Telematics]
    |
    v
[8.2 Assessment]
    |
    v
[8.3 Involving drivers]
    |
    v
[8.4 Minimisation]
    |
    v
[Worked example] --> [Exercise EX036]

Learning outcomes

You will (1) assess privacy risks in vehicle telematics; (2) apply purpose limitation and minimisation; (3) involve affected people.

8.1 Telematics

Corran's lorries record location, speed, braking and engine data every few seconds. These data support route planning, fuel efficiency and safety. Because each lorry is assigned to a driver, the data are personal data about drivers under the GDPR. Lucía finds that managers have begun using telematics to monitor drivers' break times, a purpose not mentioned in the driver privacy notice. She raises this with the data protection officer as a potential purpose limitation problem. The officer agrees and opens an assessment.

8.2 Assessment

Lucía helps the data protection officer carry out a data protection impact assessment for telematics. It describes the processing, assesses necessity and proportionality, identifies risks to drivers, such as unfair discipline based on misread data, and proposes safeguards. The NIST Privacy Framework's govern and control functions help structure the safeguards: policies on permitted uses, access limited by role and retention of detailed location data for ninety days, with aggregates kept longer. The assessment is signed by the officer and the fleet manager as owner.

8.3 Involving drivers

The assessment recommends consulting drivers. Lucía helps organise sessions with driver representatives. Drivers accept safety and route uses but object to minute-by-minute break monitoring, noting that legal break rules are already recorded by tachographs. Corran agrees that telematics will not be used for break monitoring and that any disciplinary use requires review by a second manager with the driver's representative present. The privacy notice is updated to describe permitted uses clearly. Driver representatives review the new notice before it is issued to all drivers.

8.4 Minimisation

Lucía examines whether all collected data are needed. Engine data at second-by-second detail serve maintenance but not planning; she proposes that planners receive data aggregated per trip. Location data outside working hours, when drivers take lorries home in some depots, are switched off. Dr. Achebe notes that these changes reduced risk without losing operational benefit, and that involving drivers produced better safeguards than managers alone would have designed. The fleet manager approves both changes, and the assessment is updated to record them with the date of each decision.

Worked example

Lucía finds telematics used for unannounced break monitoring, supports an impact assessment with role access and ninety-day retention, consults drivers who reject break monitoring and minimises engine and off-duty location data.

Synthetic case. Practices are synthetic; the GDPR and NIST Privacy Framework 1.0 are real. This is not legal advice.

Errors and limits

New uses of employee data without notice breach purpose limitation.

Exercises

• EX036 — Unannounced use. What unannounced use did Lucía find?
  Show marking criteria

  Rubric: 3 = monitoring driver break times;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX037 — Location retention. How long is detailed location data kept?
  Show marking criteria

  Rubric: 3 = ninety days;; 2 = partly correct;; 1 = wrong;; 0 = none.
• EX038 — Driver objection. What did drivers object to?
  Show marking criteria

  Rubric: 3 = minute-by-minute break monitoring;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX039 — Discipline safeguard. What safeguard applies to disciplinary use?
  Show marking criteria

  Rubric: 3 = second manager review with representative present;; 2 = partly correct;; 1 = partial;; 0 = none.
• EX040 — Off-duty data. What happens to location data outside working hours?
  Show marking criteria

  Rubric: 3 = switched off;; 2 = partly correct;; 1 = vague;; 0 = none.