As EU Data Act Looms, Companies Face Growing Liability Over Vehicle GPS Tracking
Published on 07/11/2026 at 20:16 | Redaktion boerse-global.de
A €120,000 penalty against Belgian fintech Isabel SA highlights the costly pitfalls of misclassifying data roles — a risk that will sharpen when the European Union’s Data Act takes full effect on 12 September 2026. The company had wrongly declared itself a “processor” rather than a “controller” under the General Data Protection Regulation (GDPR), triggering additional violations over information duties and the right of access.
The coming EU Data Act adds a fresh layer of obligation: vehicle manufacturers must make connected-car data available to users and third-party service providers. Companies deploying GPS systems in their fleets now face a dual challenge — comply with both the new openness mandate and the strict privacy rules that already govern location tracking.
Under the GDPR, satellite-based geolocation of company vehicles becomes subject to data protection law as soon as the information can be linked to an individual driver. The Bavarian State Office for Data Protection Supervision has clarified that the regulation applies immediately in such cases. Consent from employees is rarely a valid legal basis because of the power imbalance in the employment relationship. When companies rely on legitimate interests, they must conduct a detailed test of necessity and proportionality.
A ruling by the Cologne Regional Court illustrates the boundaries: permanent, non-incident-related dashcam recordings are unlawful. Footage may only be used to investigate specific accidents and must be deleted after a defined period. These principles carry over to GPS monitoring.
European data enforcers are stepping up enforcement. In June 2026, a Norwegian retail chain was fined more than €1.8 million for unlawful consent practices, and a Spanish telecoms provider received a €1.05 million penalty. The German Federal Court of Justice (BGH) will hear a case in October 2026 on the liability of analytics companies that use trackers without explicit consent. Lower courts had already confirmed damage claims, raising the due-diligence bar for firms contracting external tracking services.
To help businesses navigate the regime, the European Data Protection Board (EDPB) published new anonymisation guidelines in July 2026. Data is considered safely anonymised only when re-identification is permanently and technically impossible. Fleet operators must regularly reassess how they process vehicle data.
Despite the regulatory headwinds, the market for digital fleet tools is expanding. A major technology group launched an OBD-dongle solution in June 2026 for operations with up to 100 vehicles, capturing mileage and maintenance intervals. In mid-July 2026, another provider introduced an interface that gives access to live data via natural language queries, drawing on roughly 37 trillion data points annually from millions of vehicles. Smaller businesses and construction firms can buy specialised GPS trackers for heavy machinery — no subscription required — with geofencing and hour counters. Other vendors promote electronic logbooks that could yield tax savings of up to €2,700 per year per vehicle.
Disclaimer regarding our articles: No investment advice, no buy or sell recommendation. Information on prices, companies, and markets is provided without guarantee; changes are possible at any time. Stock market transactions can lead to substantial losses. Our articles are created and reviewed in whole or in part automatically with the support of AI.
