GPS tracking has become an increasingly common tool for Kenyan businesses that operate company vehicles. Logistics firms, distributors, construction companies, security providers and other fleet operators now use tracking technology to monitor vehicle location, improve route planning, respond to theft and gain greater visibility over how company assets are being used. But when a company vehicle is assigned to an employee, tracking the vehicle can also mean tracking the person driving it.

That is where vehicle security begins to intersect with employee privacy. A modern GPS tracking system can reveal far more than the position of a car on a map. Depending on the technology installed, it can record routes travelled, locations visited, time spent at particular places, speed, ignition activity, idling and other driving behaviour. Once that information can be linked to a specific employee, it may become personal data under Kenya’s data protection framework.

Kenya’s Data Protection Act, 2019 defines personal data broadly and recognises location information as one of the identifiers that can be associated with an identifiable person. This means that an employer may own the vehicle, but information generated from that vehicle can still relate directly to the employee using it. A registration number may identify an asset, but when the employer knows exactly who was driving that vehicle at a particular time, its tracking history can effectively become a record of that employee’s movements.

This does not mean employers cannot use GPS trackers on company vehicles. There are legitimate business reasons for doing so. A transport company may need to know where its trucks are, a distributor may need to confirm deliveries, and a construction company may need to ensure that vehicles remain within authorised project areas. Businesses may also use tracking systems to reduce unauthorised vehicle use, improve fleet efficiency, manage fuel consumption and respond more quickly when a vehicle is stolen.

The important issue is how the tracking is introduced and managed. Employers should have a clear reason for collecting location information and should avoid collecting more information than is reasonably necessary for that purpose. A business that installs trackers to protect vehicles and improve fleet operations should be able to explain why the monitoring is necessary, what information is being collected and how that information will be used.

Transparency is therefore one of the most important principles employers should consider. Employees should know that the vehicles they operate are being tracked. They should also understand the purpose of the monitoring, the type of information being collected and who within the organisation can access it. Employees should not have to discover by accident that their movements have been recorded for months.

This becomes particularly important when employees are permitted to take company vehicles home. A delivery vehicle that operates only during working hours presents a relatively straightforward business case. A vehicle that remains with an employee during evenings, weekends and public holidays can create more complex privacy questions because continuous tracking may reveal information about the employee’s personal life outside work.

Employers should therefore consider whether monitoring outside working hours is genuinely necessary. There may be legitimate security reasons for maintaining location visibility over a valuable company vehicle even when it is parked at an employee’s home, but the purpose should be clearly defined. The ability to monitor a vehicle continuously should not automatically become a reason to monitor an employee continuously.

A written fleet tracking or employee vehicle policy can help establish these boundaries. The policy should explain why vehicles are tracked, what information is collected, when monitoring takes place, who is authorised to access the data and how long the information will be retained. It should also explain the circumstances under which tracking information may be used during investigations or disciplinary processes.

Access control is another important issue. A company operating a fleet of 50 or 100 vehicles does not necessarily need to give every manager unrestricted access to every vehicle. A fleet manager may require visibility across the entire operation, while a branch manager may only need access to vehicles allocated to a particular location. Limiting access to people who genuinely require the information reduces the risk of tracking data being misused.

Businesses should also review access whenever employees change roles or leave the organisation. Former employees should not retain access to fleet tracking systems simply because nobody remembered to disable their credentials. Good GPS security therefore involves both protecting vehicles and carefully managing access to the information generated by those vehicles.

The role of the GPS tracking company should also receive attention. In many cases, the tracking provider may process location information on behalf of the employer. Businesses should therefore carry out proper due diligence before selecting a tracking company and should understand how customer information is stored, protected and accessed.

A tracking provider should not be evaluated only on the price of its devices. Employers should also consider whether the company operates professionally, provides reliable technical support, protects customer information and has appropriate systems for managing access to tracking platforms. The more sensitive the information being collected, the more important these safeguards become.

Employers should also be careful about changing the purpose of tracking information after it has been collected. A GPS system introduced primarily for vehicle security should not automatically become a tool for unrelated employee surveillance. If the information is later used for productivity monitoring, attendance management or disciplinary purposes, the employer should consider whether that use is appropriate, proportionate and consistent with the purpose originally communicated to employees.

This does not mean GPS information can never be used during an investigation. If a company vehicle is found hundreds of kilometres away from an authorised route, the employer may have legitimate reasons to investigate what happened. Tracking records can provide useful evidence, but they should be considered together with other available information rather than automatically treated as unquestionable proof.

GPS systems can experience delayed updates, communication interruptions or occasional positioning errors. Employers should therefore avoid making serious employment decisions solely on the basis of a single tracking event without examining the wider circumstances. The reliability of the system and the context surrounding the information should always be considered.

The growing use of driver scoring and automated fleet management systems creates another area employers should watch closely. Some platforms can analyse speeding, harsh braking, acceleration, idling and other driving patterns before generating scores or rankings for individual drivers. These tools can be useful for safety and fleet management, but employers should be cautious about allowing automated scores alone to determine significant decisions affecting employees.

Data retention also deserves attention. Modern GPS platforms can maintain extensive historical records showing where vehicles travelled over long periods. While this information may be useful for operational analysis or investigations, employers should consider whether there is a genuine reason to keep detailed movement records indefinitely.

A sensible retention approach should reflect the purpose for which the information was collected. A logistics company may need historical journey information for a particular period to resolve customer disputes or review operational performance. That does not necessarily mean every movement of every employee should remain permanently available without any review of whether the information is still needed.

For larger organisations, particularly those conducting extensive and systematic monitoring, the privacy risks may become more significant. Businesses collecting detailed location and behavioural information across large fleets should consider whether additional data protection assessments, policies and controls are necessary before expanding their monitoring activities.

Ultimately, responsible employee vehicle tracking is about balance. Employers have legitimate reasons to protect valuable assets, improve efficiency and understand how company vehicles are being used. Employees, however, do not lose all expectations of privacy simply because they are driving a company owned vehicle.

The strongest approach is for businesses to introduce tracking openly and professionally. Employees should know why the technology is being used, what it records, who can view the information and how long it will be retained. Managers should also understand the limits of their access and the circumstances in which tracking information may legitimately be used.

When properly implemented, GPS tracking can benefit both employers and employees. It can improve vehicle security, support faster recovery after theft, provide evidence where drivers are wrongly accused, improve route management and create clearer accountability across the fleet.

The problem arises when useful fleet management technology gradually becomes uncontrolled employee surveillance.

As GPS tracking becomes more advanced in Kenya, employers will increasingly need to think beyond the question of whether they can track company vehicles. The more important question will be whether the information is being collected and used in a way that is necessary, transparent and proportionate.

GPS technology gives employers unprecedented visibility over their vehicles.

Responsible management determines where that visibility should end.

For professional GPS tracking and fleet telematics solutions in Kenya, Finatrack Global Ltd can be contacted on 0723 645 810 or through www.finatrack.co.ke.

This article provides general information and should not be considered legal advice.