Vehicle geolocation: CNPD vs CNIL on retention and oversight

In April 2026, CNIL set a default “in principle” 2‑month retention for professional vehicle geolocation data. By contrast, Luxembourg’s CNPD does not publish a universal numeric limit and requires a case‑by‑case proportionality justification, with a 15‑day staff delegation referral mechanism (Labour Code, Art. L.261‑1). This gap should guide your HR and fleet policies in Luxembourg.

The case

• France (CNIL): the “HR Data Retention Reference” (April 2026) sets, for vehicle geolocation systems, a 2‑month active retention “in principle,” with tightly framed extensions (up to 1 year to evidence a service where no other means exist). Sources: CNIL, HR Retention Reference (Apr 2026) and CNIL Direct.
• Luxembourg (CNPD): the guidelines frame the purposes, ban disciplinary uses outside the stated purpose (e.g., speed or routes if the purpose is anti‑theft), stress necessity/proportionality and DPIA. No universal numeric duration: retention must be strictly limited to the purpose. In parallel, Labour Code Art. L.261‑1 allows the staff delegation to refer to CNPD within 15 days; CNPD decides within one month. Sources: CNPD, vehicle geolocation and CNPD, Art. L.261‑1.

In short: CNIL provides a firm time marker (2 months). CNPD expects documented justification and offers a procedural safeguard via L.261‑1.

Legal reasoning

• Legal basis (GDPR Art. 6): typically legitimate interests (Art. 6(1)(f)) for asset security, logistics optimization, or—where no other reliable means exist—working time measurement; exceptionally a legal obligation. CNPD requires explicit, non‑diverted purposes. See CNPD, Necessity and proportionality. For the broader framework, see GDPR requirements.
• GDPR Art. 5 principles: data minimization, purpose limitation, and storage limitation. CNIL translates Art. 5(1)(e) into a practical benchmark (2 months “in principle” with narrow extensions), while CNPD keeps a contextual assessment to be evidenced. References: HR Retention Reference (Apr 2026) and CNPD, dossier.
• Information and transparency (Arts. 13/14): clear notice at the point of contact (vehicle/app), purposes, legal basis, retention, rights, DPO contact. A DPO mandate helps align notices and records.
• DPIA (Art. 35): systematic monitoring of employees is typically high risk. CNPD reiterates this and highlights processor accountability (Art. 28). See CNPD, DPIA – Geolocation.
• Social dialogue and oversight: in Luxembourg, the L.261‑1 referral window is a local procedural safeguard, distinct from the French reference framework. See Art. L.261‑1.

What this changes in practice

• Groups active in Luxembourg: do not mechanically import CNIL’s 2‑month benchmark. Document necessity and proportionality per purpose, anticipate the 15‑day referral window, and align automated purges.
• Ring‑fenced purposes: no disciplinary use outside the initial purpose (e.g., speed/routes if the aim is anti‑theft). See CNPD, Necessity and proportionality.
• Working time: only where no other “objective, reliable and accessible” means exist. CNIL’s ranges (2 months active, up to 1 year for evidence) may inspire, but in Luxembourg each duration must be tied to necessity and alternatives analysis.
• HR/IT governance: run a DPIA, put in place an Art. 28 data processing agreement with your telematics provider, and implement controls (off‑hours deactivation, private zones, reduced granularity, access logs, verifiable purges). For Luxembourg context, review GDPR compliance practices and reach out via our contact form.

Common pitfalls

1. Copy‑pasting “2 months” without local justification. CNPD expects proportionality evidence. See CNPD dossier.
2. Purpose creep: anti‑theft data reused for HR discipline is rejected by CNPD unless a specific legal obligation applies. See Necessity and proportionality.
3. No DPIA or alternatives analysis: geolocation is intrusive; a DPIA is expected. See DPIA – Geolocation.
4. Forgetting L.261‑1: plan information/consultation and the 15‑day window. See Art. L.261‑1.
5. “Retention for everything”: CNIL’s extensions are not reflexively portable to Luxembourg; CNPD’s lack of a number does not mean “unlimited.” See HR Retention Reference (Apr 2026).

Official sources

• CNPD — Vehicle geolocation dossier
• CNPD — Necessity and proportionality
• CNPD — Labour Code L.261‑1
• CNIL — HR Data Retention Reference (Apr 2026)
• CNIL Direct — Retention for vehicle geolocation

Luxgap regulatory expertise article. For personalised guidance on this topic, contact us or configure your online quote.