2 Ausgaben kostenlos für Sie
Fachmagazin taxi heute: Ihr Zugang zu exklusiven Inhalten rund um die Taxi- und Mietwagenbranche.
Aktueller Termin
Meist gelesen
Data protection in the taxi industry: Messengers, cameras and GPS in the legal focus
Taxi and rental-car companies regularly process personal data and, in some cases, particularly sensitive information. This includes customer and order data such as names, addresses, and telephone numbers, but also health data from medical transports, payment information, as well as employee data. Key to compliant data processing are the provisions of the GDPR and the BDSG (Federal Data Protection Act) as well as relevant court decisions and requirements of the supervisory authorities. Violations can lead to substantial fines, prohibitions, and civil claims. The use of external communication services such as WhatsApp is considered particularly critical, as data transfers to third countries regularly occur when using them. The Bavarian State Association of Taxi and Rental Car Companies e. V. has presented a risk analysis of data processing in the taxi trade and, therein, formulates concrete recommendations for businesses.
Risks posed by messenger services and social media
Several incidents show that, especially smaller businesses, in WhatsApp groups share personal and sensitive passenger data, such as photos of transport certificates or details of health and payment information. In North Rhine-Westphalia, such a practice was criticized by the state data protection authority and an administrative fine was initiated. Meta's messenger services often store data outside the EU, which, without appropriate contracts and safeguards, does not meet the GDPR requirements and makes internal use especially problematic.
Significance of current case law
Three decisions shape the data protection assessment in the industry:
- BGH on dashcam usage (2018): Permanent, indiscriminate recording in road traffic is impermissible. Although recordings in individual cases may be usable as evidence, this does not justify permanent storage.
- BAG on video surveillance (2019): Open video surveillance at the workplace is possible only within narrow limits and requires a balancing of interests. Transparency, purpose limitation and proportionality are decisive.
- VG Lüneburg on GPS tracking (2019): GPS tracking can be permissible if purpose limitation and retention periods are tightly defined. Permanent movement profiles are impermissible.
These decisions have direct implications for the design of camera, tracking and telematics systems in operation.
Implications for day-to-day operations
WhatsApp groups for driver communication, in which personal data of passengers is shared, regularly violate the GDPR and can lead to prohibitions by supervisory authorities. The use of cameras inside the vehicle also remains critical: Permanent recording generally infringes on the passengers' personality rights. Only tightly limited, purpose-bound measures with clearly defined technical and organizational requirements are permissible.
When using telematics systems, permanent location recordings are impermissible. Only if there is a compelling operational interest and at the same time transparency, purpose limitation and retention periods are ensured can such systems be operated legally.
Recommendations for taxi and rental-car companies
According to LVBTM, companies should refrain from using private messengers or restrict them strictly. For customer communication GDPR-compliant business solutions should be considered, and for internal processes suitable professional communication platforms should be used.
Furthermore, clear procedural instructions and regular training for drivers are recommended, especially for assignments involving sensitive health data. Technical and organizational measures such as encryption, access controls, deletion policies and data processing agreements are necessary to meet legal requirements.
When introducing video or tracking technologies, the works council's co-determination should be taken into account. Basic principles such as data minimization, purpose limitation and defined retention periods should be consistently implemented and documented.
Conclusion
Taxi and rental-car businesses face the challenge of aligning operational communication and control processes with stringent data protection requirements. Recent court decisions and supervisory authority measures illustrate that, in particular, the unreflective use of messengers, permanent video surveillance and inadequately constrained tracking carry significant legal risks.
Content automatically translated.
Taxi-Fahrzeuge (Pkw) , Taxi-Newsletter, Taxameter, Taxi-Fahrer , BZP – Deutscher Taxi- und Mietwagenverband , Straßenverkehrsordnung (StVO) , Krankenbeförderung , Weiterbildung , Taxi-Konzessionen , Verkehrspolitik , Mietwagenbranche , Taxi-Apps , Berufskraftfahrer-Qualifikations-Gesetz BKrFQG) , Taxizentralen , Personal, Gehälter, Arbeitsschutz , Wirtschaftsnachrichten , Werbung , Taxi-Folierung , Taxi-Umrüster , Straßenverkehr , Elektromobilität, Taxifuhrpark und -flottenmanagement , Taxi-Versicherungen , Hybrid, Diesel, Erdgas , Taxi-Magazin
