The European General Data Protection Regulation and Webfleet

Empowering people regarding their data is key to the GDPR. After all, data from or about an individual is a reflection of their identity, their behaviour and their preferences: it is who we are. The GDPR determines that individuals must be fully informed in advance about what happens to their data: what data is used, why it is used, how long it is used and by whom it is used. They must also have an influence on that, e.g. either by giving permission, by engaging in a contract and, with some restrictions, by being able to have the use of their data stopped upon request.

If, as a business, you decide what happens to data from individuals, you must step up to that respons­ib­ility and be able to demonstrate you do this properly, respecting the rights of the individuals as well as the GDPR. With everything you do with data, you must take into account the risks to the individual concerned. In our view, this requires the need to have documentation pertaining your activities regarding data and why you deem that data to be processed. The GDPR provides for a (part-time) Data Protection Officer to be appointed to oversee this if you meet the threshold for this in the GDPR (e.g. if your core activity involves monitoring people at a large scale).

In our opinion, the GDPR was drafted to unify the previous and diverging privacy laws across the EU. That could be considered a plus for multi-n­a­tional businesses using our services, especially those that have vehicles crossing boundaries. It also could mean that if you run a multi-n­a­tional business across the EU, you will only have to deal with one regulator: the one in the country where your main establishment is. Likewise, individuals can liaise with the regulator in their own country.

Key in the GDPR is the notion of Personal Data. Essentially that is any data that can or could be related to an identifiable human being. This includes data that could be abstracted with unique identifiers such as number plates, a VIN (Vehicle Identi­fic­ation Number) and/or other device identifiers. It’s important in our view to consider that under the GDPR it does not matter who is actually able to identify. If someone can identify an individual from the data, the data has to be considered personal data even if actual identi­fic­ation is not performed at all. In our opinion, it is not required to know someone’s name in order for data about them to be considered personal data. It’s important to note that having personal data does not mean that it cannot be used, it just means the GDPR applies and certain conditions must be fulfilled.

The GDPR provides for personal data to be used for one or more predefined purposes. These need to be specific and clearly described. The individual must be able to understand what a purpose means. An individual should be able to answer the question: does this use case indeed fit within the purpose?

The GDPR provides for personal data to be ‘rightsized’ in terms of kind, volume and how long it’s stored, based on the purpose that was defined. Rightsized means only process what is strictly necessary, not more or longer.

In our view, personal data processing requires a well-written, user-friendly explanation. Like a manual, not like a contract. Of course, the explanation must be available to the individuals before you start using their data and also remain available to them.

Webfleet always operates under instructions from the Webfleet customer. The data relates only to the customer, the customer is in control. This means that we offer the customer a highly configurable solution. While we propose various purposes for which it can be used, the Webfleet customer takes the final decisions for what purposes it is used and how in detail you configure and operate the system.

Our system can be configured to recognise many different stakeholders with different roles, respons­ib­il­ities and capabilities in different situations. Webfleet customers, for example, can allow drivers to distinguish between business and private trips and supervisors of drivers can be restricted in what they can see and do. We also support the Webfleet customer in honouring the rights the individuals have, for example, with respect to the access and erasure of their data.

Webfleet customers in various ways can configure what data is being collected and how long it is kept. To make it easier for Webfleet customers, we have included reasonable defaults, related to various use cases which our fleet customers typically have, but Webfleet customers are free to deviate from these default settings.