What rules govern the geolocation of construction equipment?

Why are the thefts of equipment forcing the building to upgrade its equipment?

Vehicle thefts are declining in France, while thefts of construction equipment are on the rise. The ranking published on February 18, 2026, by France Assureurs and Argos, lists 64,088 vehicles stolen in 2025, compared to 70,459 the previous year, representing a 9% decrease . Over the same period, earthmoving, lifting, gardening, and agricultural equipment accounted for 1,529 thefts, a 14% increase.

The most striking difference lies in the recovery rate. 249 of these machines were recovered in 2025, representing 16,3% of the total, while 40% of stolen cars are recovered, a third of them in less than a week. Therefore, an excavator or aerial work platform that disappears from a construction site has a five in six chance of never returning.

The two reasons given by insurers relate to the nature of the equipment, the lack of registration , and the lack of identification . A vehicle has neither a license plate nor a central database comparable to that of road vehicles, and nothing allows an inspection to link the machine to its owner. It is this gap that onboard telematics fills, just as the marking or identification of company vehicles does.

At what point does the location of a device become personal data?

A telematics unit produces two types of information. One describes the machine, including operating hours, fuel consumption, fault codes, and location. The other describes, indirectly, the person operating it. The switch between these two types of information depends not on the installed hardware, but on the company's organizational structure.

The General Data Protection Regulation (GDPR) defines personal data as any information relating to an identified or identifiable natural person . Therefore, as soon as a vehicle is assigned to a specific person, or a schedule reveals who was driving it at a particular time, its location becomes personal data and the processing falls within the scope of the regulation.

The consequence is immediate. Article L. 1121-1 of the French Labor Code only allows restrictions on an employee's freedoms if they are justified by the nature of the task to be performed and proportionate to the objective pursued. In its guidance document on monitoring the activity of employees, updated on July 9, 2026 , the French Data Protection Authority (CNIL) concludes that continuous surveillance of personnel generally constitutes an excessive infringement. Geographic information systems applied to construction sites encounter the same limitation as soon as they track people rather than structures.

What purposes does the CNIL allow and which does it exclude?

The CNIL (French Data Protection Authority) does not reason in terms of technology but in terms of purpose, that is to say, declared objectives. The same device is lawful or not depending on its use. Its guide on the geolocation of employee vehicles lists acceptable and unacceptable objectives.

Two points are of direct interest to a construction company. Combating theft is among the accepted objectives, thus securing the primary intended use of a fleet of vehicles. However, collection must cease outside of working hours, which implies a means of deactivation when the driver parks the vehicle at home, a common situation as soon as worksites are dispersed.

Monitoring working hours through geolocation remains the exception

This is the point on which companies most often go wrong. The French Council of State , in a decision dated December 15 , 2017 (no ^. 403776), ruled that the use of a geolocation system to monitor working hours is only lawful when such monitoring cannot be carried out by any other means . In the case at hand, the employer had access to self-reported data, and the data collection was deemed excessive.

The CNIL's position is identical. Monitoring working time is only permitted as a secondary measure, and only when no other system can ensure it. A company equipped with a time clock, site reports, or a time-tracking application cannot therefore invoke this reason, since it already has another means at its disposal.

Two categories of people are exempt from this system. Employees who have freedom in organizing their travel cannot be monitored for this purpose, and employee representatives can never be monitored in the exercise of their mandate.

What formalities must be completed before putting the device into service?

The obligations are divided into three stages: informing, consulting, and documenting. Article L. 1222-4 of the French Labor Code prohibits collecting information concerning an employee personally through a device that has not been previously disclosed to them. The information must be provided individually and specify the purpose, the data collected, its retention period, and its recipients.

The Social and Economic Committee (CSE) must be consulted before the implementation decision, pursuant to Article L. 2312-38 , in companies with at least 50 employees . Article L. 2312-8 further requires that the CSE be informed about the introduction of new technologies. The processing is recorded in the register of processing activities, and an impact assessment becomes necessary when it falls under the list established by the CNIL (French Data Protection Authority), which notably includes processing intended to constantly monitor employee activity and large-scale location tracking.

Finally, storage periods are limited purpose by purpose.

These durations are configured within the tool itself, not in an internal memo, and maintaining a history as a precaution constitutes a breach in itself. The same reasoning applies to access, which is limited to authorized personnel and is logged, as with any building video surveillance system.

What the recommendation of April 16, 2026 changes for fleets

On April 16, 2026, the CNIL adopted a recommendation concerning the use of location data from connected vehicles, deliberation no ^. 2026-063, published on June 30, 2026. It deals with consent, the exercise of rights when several drivers take turns driving the same vehicle, and the location of a vehicle not returned.

Its scope requires careful reading. The text targets connected vehicles used by private individuals, whether owners or lessees, and expressly excludes company or service vehicles made available to employees by their employers . A construction company that geolocates its vans and equipment will therefore not find its rule here, and remains bound by the labor code and the CNIL's (French Data Protection Authority) guidelines on the geolocation of employee vehicles.

The tachograph falls under a different set of regulations, often confused with geolocation. Mandated by Regulation (EU) No ^165/2014 , as amended by Regulation (EU) 2020/1054, it applies only to road transport. Its implementation schedule targets international transport, new vehicles over 3,5 tonnes since 21 August 2023 , replacement of older equipment by 31 December 2024 and then by 18 August 2025 , and commercial vehicles over 2,5 tonnes by 1 July 2026. Companies that do not engage in international transport are not subject to these regulations^.

Distinguishing between these regimes avoids the most costly mistake: believing that technically compliant equipment is sufficient to make data processing lawful. The device itself is never the issue; compliance depends on the declared purpose, employee information, and data retention period, and these are what an audit examines. At the fleet level, equipment is evolving faster than the formalization that should accompany it, whether it concerns the vehicles themselves or the digital management of skips and leased equipment.