GDPR & Fleet Video: What European Operators Still Get Wrong

Two years into stricter enforcement, GDPR compliance for in-cabin video remains a minefield. We outline the practical pitfalls.

Two years into stricter enforcement of GDPR for in-cabin video, European fleet operators still struggle with the practical compliance questions. Our desk reviewed enforcement patterns and operator pitfalls.

Lawful Basis: Consent Is Not Enough

Many operators rely on driver consent as the lawful basis — weak when the driver-employer relationship is unequal. Legitimate interest with a documented impact assessment is the more defensible posture, particularly for safety monitoring.

In-Cabin Audio: A Higher Bar

Audio recording triggers stricter rules than video in most EU member states. Several operators we spoke with have disabled audio entirely rather than manage the consent overhead — a defensible trade-off if video covers the safety case.

Retention & Subject Access

Default continuous retention beyond 14–30 days is hard to justify under data minimization. Flagged-incident retention is defensible; blanket long-term retention is not. Subject access requests remain operationally painful without purpose-built tooling.

Cross-Border Cloud

Where cloud footage is processed outside the EU, standard contractual clauses are necessary but not sufficient. Operators should verify vendor data residency commitments and sub-processor lists.

Practical Advice

Run a documented DPIA before deployment, configure aggressive retention defaults, and ensure drivers receive clear written notice. These three steps prevent most of the enforcement cases we've tracked.