Every modern fleet monitors its vehicles - tracking, telematics, dashcams - and most fleets have never read the rulebook that governs all of it. The ICO’s guidance on monitoring workers applies squarely to drivers, and its answers are more permissive in some places and much stricter in others than industry habit assumes. Here is the guidance translated into fleet.
Can you monitor work vehicles? Yes. But the ICO draws a bright line at private use: if workers are allowed to use the vehicle privately, you will rarely be able to justify monitoring during that private use. The ICO’s own example is a company car tracked during working hours for business reasons, with a system the driver can disable when not working. If your vans go home at night, that disable switch - or a policy that genuinely forbids private use - is the difference between a defensible system and a privacy complaint. And whoever is being watched must know: you must inform workers and passengers of any vehicle monitoring.
Where the law itself requires the monitoring, data protection follows it. Employers legally obliged to use tachographs to record driving time, speed and distance can rely on legal obligation as the lawful basis. No justification gymnastics needed - the duty to record is the answer.
Fleet telematics that record driver behaviour to calculate insurance premiums are personal information and sit fully inside data protection law - and if the insurer handles driver information, the insurer has its own obligations too. Driver-behaviour monitoring in general is harder to justify than location tracking: monitoring driving style, or using cameras or audio, carries a higher risk to the privacy of workers and passengers, so you must carry out a data protection impact assessment (DPIA), and you should consider - and document - whether a less intrusive method would achieve the same purpose.
Dashcams can protect drivers, passengers and assets and cut insurance costs, but identifiable people in footage are personal data, full stop. The ICO’s practical rules:
Because inward cameras are video surveillance of a worker, the general rules attach: complete a DPIA, consider why the monitoring is necessary for the purpose, inform workers of the extent and nature of the monitoring, and make others caught by it aware. Think about subject access requests before you need to - if a driver or a filmed member of the public asks for their footage, you may have to redact third parties from it. Covert monitoring is unlikely ever to be justifiable in ordinary circumstances, and facial recognition is a step change: biometric data, special category rules, mandatory DPIA.
One reading tip before you open the guidance itself: the ICO writes in three registers. “Must” is a legislative requirement - breach it and you are simply unlawful. “Should” is not strictly required, but the ICO expects it, and if you take a different approach you must be able to demonstrate that your way also complies. “Could” is an option to consider. Most fleet failures are not ignored “musts” - they are undocumented “shoulds”, the disable switch that existed but was never written down.
The ICO is not anti-telematics; the guidance blesses tracking, tachographs and cameras with conditions attached. Fleets that meet the conditions get the safety and insurance benefits. Fleets that skip them are one disgruntled driver away from finding out what a DPIA is.