Driver Monitoring and Data Privacy in European Last Mile: Why What You Measure Decides Who Approves it

Driver monitoring in European last mile delivery falls into two categories that are frequently discussed as one. Behaviour monitoring observes the driver, covering speed, braking, cornering, camera footage and in some systems attention or fatigue inference. Outcome measurement observes the delivery, covering completion, sequence adherence, service time and exception type. The distinction matters commercially rather than philosophically, because the two carry materially different legal footprints in Europe and therefore different approval paths, different timelines and different odds of deployment.

Why Driver Data is a Procurement Question in Europe

European employee data sits under a specific provision rather than the general regime. Article 88 of the GDPR allows member states to set more specific rules by law or collective agreement for processing employee data, covering management, planning and organisation of work among other purposes, and requires those rules to include measures safeguarding the data subject’s human dignity, legitimate interests and fundamental rights. The practical consequence is that driver data compliance is not uniform across the EU. It varies by country and by collective agreement, so a single deployment can face several different standards at once.

Germany is the clearest illustration. Under the Works Constitution Act, section 87(1) no. 6 gives the works council a co-determination right over the introduction of technical equipment intended to monitor employee conduct or performance. The Federal Labour Court has held that objective suitability for monitoring is sufficient to trigger the right, meaning a system can fall within it even where the employer has no intention to monitor. That is the sentence to take into a vendor conversation, because it moves the test from what you plan to do with the data to what the system is capable of observing.

The regime tightens further this year. Directive (EU) 2024/2831 on platform work entered into force on 1 December 2024 and must be transposed into national law by 2 December 2026. It requires that decisions made or assisted by automated means which substantially affect working conditions be overseen by human beings with the requisite knowledge, skills and authority, gives workers the right to an explanation and to contest such decisions, and requires platforms to inform workers and their representatives about the use of automated monitoring or decision-making systems. EU-OSHA’s summary sets out the scope. Notably, it also prohibits using algorithms to process emotional or psychological data, which removes an entire feature category from consideration rather than merely regulating it.

Against that, the operational direction of travel is toward more automation, not less. Gartner predicts that by 2031, 60% of supply chain disruptions will be resolved without human intervention. Reconciling that trajectory with a legal requirement for meaningful human oversight of decisions affecting workers is the actual design problem, and it is solved at the architecture level rather than in a policy document.

The cost of getting this wrong is rarely a fine. It is a delayed deployment. A works agreement that stalls for two quarters while a council and an employer argue about camera retention does not appear in a compliance register, but it removes two quarters of the operational benefit the business case was built on. European operators who have been through it tend to describe the lesson the same way: the constraint was never whether the technology was lawful, it was how long it took to agree the terms on which it could be used.

Mixed labour pools compound this. An operator running employed drivers, subcontracted courier partners and gig riders in the same city faces three different legal characterisations of the same person-shaped data. Employed drivers bring works council and national employment law. Subcontracted drivers belong to another employer, which raises questions about who is controller and who is processor. Gig riders fall squarely inside the Platform Work Directive. Holding one measurement standard across all three is usually easier than defending three, and the standard that travels is the least invasive one.

Also Read: Driver Tracking vs Performance Management in Last-Mile

How the Two Measurement Models Diverge

1. What the system observes

Behaviour monitoring observes the person. Telematics captures speed, harsh braking, acceleration, cornering and idling, and camera-based systems add footage of the cab and in some products inference about attention or fatigue. Outcome measurement observes the delivery: was the stop completed, in sequence, within the window, and if not, what exception was recorded. Both produce a number against a driver’s name. Only one of them is a record of how a person’s body behaved over a shift. The distinction survives aggregation, too. A weekly average of harsh-braking events is still derived from continuous observation of a person, whereas a weekly completion rate is derived from observation of parcels.

2. Which approval path each triggers

This is where the commercial difference appears. A system objectively capable of monitoring conduct engages co-determination in Germany and equivalent consultation regimes elsewhere, which means the works council is a party to the deployment rather than an audience for it. Outcome measurement is not automatically outside that scope, since performance monitoring is also named in the provision, but the negotiation is narrower because the data does not extend to the driver’s physical conduct. The difference shows up in what the council asks for. Behaviour data invites demands about camera retention, review rights, disciplinary use and deletion schedules. Outcome data invites demands about how targets are set and how disputes are handled, which are questions an operations leader can usually answer without redesigning the system.

3. How long the approval takes

Approval path is timeline. A camera-based behaviour programme typically requires a works agreement negotiated with the council, a data protection impact assessment, retention and access rules, and often a pilot with defined review points. Outcome measurement requires the assessment and the transparency obligations, and a conversation about performance use, without the additional argument about filming people at work. Neither is trivial and one is materially shorter. It is worth asking your works council directly how long comparable approvals have taken, since the answer is specific to your site and your relationship, and it belongs in the business case rather than in a risk annexe. An operator who can state the approval timeline for each shortlisted architecture is making a better decision than one comparing licence fees.

4. Whether the feature survives the Directive at all

Emotional and psychological data processing is prohibited for platform work under the Directive rather than permitted subject to safeguards. Any roadmap item that infers driver mood, stress or attention state from video or biometric input therefore needs re-examination for platform-work populations, and a cautious reading extends the logic to employed drivers in jurisdictions that align their rules.

5. Who can contest a decision, and against what record

The Directive gives workers a right to explanation and contestation of automated decisions substantially affecting their working conditions. That requirement is easier to satisfy against outcome data than against behaviour scoring, because a delivery outcome is a discrete event with a cause the driver can dispute on the facts. A composite behaviour score derived from a proprietary model is considerably harder to explain in terms a driver can meaningfully challenge, and an explanation the worker cannot act on does not discharge the obligation.

6. What the data is actually for

Worth asking plainly. If the purpose is delivery reliability, outcome data measures it directly and behaviour data measures a proxy. If the purpose is road safety, behaviour data is the right instrument and should be scoped, governed and negotiated as a safety programme rather than folded into a performance system. Most disputes about driver monitoring are really disputes about a system built for one purpose being used for the other. Purpose limitation is a GDPR principle rather than a preference, so this is not only a governance nicety. A safety system repurposed for performance management has changed its purpose, which means the original assessment and the original consultation no longer cover what is happening.

Also Read: Logistics AI Governance EU 2026: Six Architectural Mechanisms

Behaviour Monitoring and Outcome Measurement Compared

The table is not an argument that behaviour monitoring is illegitimate. Fleet safety is a genuine obligation and telematics is the correct tool for it. The argument is narrower: using a safety-grade surveillance instrument to answer a delivery-reliability question imports the heaviest available compliance burden to solve a problem that outcome data answers directly.

There is a second-order benefit worth naming. Drivers can tell the difference. A system that measures deliveries is legible to the person being measured, because they can see the connection between what they did and what the number says. A behaviour score built from a proprietary model is not legible in the same way, and a measure a worker cannot interpret tends to be experienced as surveillance whatever its intent. That perception has operational consequences in a labour market where retention is already difficult.

Five Questions for a European Driver Technology Review

1. What is this system objectively capable of observing, regardless of configuration? Ask for the full data dictionary rather than the enabled feature list, because the German test turns on capability rather than intent and a disabled field is still a capability.

2. Can behaviour and outcome data be separated at the architecture level? Not merely by permissions. If safety telematics and delivery performance sit in one store with one access model, the whole system inherits the stricter regime.

3. Does the platform infer any emotional, psychological or attention state? Including from video, voice or interaction patterns. Under the Platform Work Directive this is prohibited rather than restricted, so a yes changes the shortlist rather than the configuration.

4. What explanation does a driver receive for an automated decision that affects their work? Test it with a real example. An explanation a driver cannot act on will not satisfy the contestation right, and the requirement lands in national law by 2 December 2026.

5. Where does human oversight sit, and does that person have authority? The Directive requires oversight by humans with the requisite knowledge, skills and authority. A reviewer who can see a decision but cannot change it does not meet that standard. Ask where that person sits in the organisation and what their span of control is, because oversight assigned to someone without operational authority is a documentation exercise rather than a safeguard.

Also Read: Driver Performance Management: Fleet Output 2026

What This Looks Like in Deployment

Scale without behaviour surveillance. A Fortune 50 operation running more than 4,500 drivers moved execution rate from 75% to 92% and surfaced more than $14M in annualised operational opportunity. The relevant point for a European review is that a 17-point execution improvement at that scale was produced by better allocation and sequencing decisions rather than by observing drivers more closely, which demonstrates the outcome route is sufficient for the performance objective.

Consolidation reduces the data estate. A retail enterprise consolidated six legacy systems into a single execution layer, cut manual dispatch effort by more than 80% and held 99%+ on-time delivery. Fewer systems holding driver-identifiable data means fewer processing records, fewer access models and a smaller surface for a data protection impact assessment, which is an underrated compliance benefit of consolidation.

Governance as a deployment accelerant. Locus customers connecting warehouse readiness signals to automated dispatch have reduced planning cycle time by 66%. The compliance-relevant detail is that the decisions producing that gain are traceable, which is what allows an operator to answer a works council question about why a particular driver received a particular route. That specific question is the one most likely to be asked in a consultation, and an operator who cannot answer it concretely will usually be asked to restrict the system until they can.

Four Mistakes European Operators Make

Treating driver monitoring as a single procurement category. Bundling safety telematics and delivery performance into one requirement imports the strictest regime to the whole scope and slows both.

Assuming intent limits exposure. The German test is objective suitability for monitoring, so a promise not to use a capability does not remove the co-determination trigger.

Leaving the works council until after vendor selection. Consultation after a contract is signed converts a negotiation into a confrontation, and the council’s leverage is highest precisely when the commitment is already made.

Reading the Platform Work Directive as a gig-only concern. Its algorithmic management provisions are shaping national expectations more broadly, and operators running mixed employed, subcontracted and gig pools will find it easier to hold one standard than three.

Also Read: Agentic Driver Management for Last-Mile Delivery 2026

How Locus Approaches Driver Data

Locus, the world’s first Decision-Intelligent, Agentic TMS, measures delivery output rather than driving behaviour. The platform is built to improve allocation, sequencing and execution decisions, so the driver-linked data it works with concerns deliveries and their outcomes rather than a record of how a person drove. That is a design choice with a compliance consequence in Europe, since it keeps the system out of the behaviour-surveillance category that carries the heaviest consultation burden.

The governance architecture maps closely onto what the Platform Work Directive now requires. Six mechanisms covering explainability, traceability, evaluation, autonomy levels, execution sandbox and human-in-the-loop mean an automated allocation can be traced to the state and logic that produced it, and autonomy levels from L1 recommendation through L3 autonomous execution can be set per decision class. Human oversight with real authority is a configuration rather than a policy statement, which is the distinction the Directive draws when it requires overseers to hold the requisite knowledge, skills and authority.

Explainability does the work on the contestation right. A driver disputing an assignment or an exception is disputing a discrete event with a stated cause, and traceability means the operator can produce the reason rather than a model output. That is a materially easier conversation than defending a composite behaviour score, both with an individual driver and with a works council reviewing the system.

Locus runs at 1.5B+ deliveries across 360+ enterprise customers in 30+ countries at 99.99% uptime, modelling 250+ real-world constraints simultaneously including rider skills and shift limits. Locus has been recognised by Gartner for seven consecutive years across multiple research categories, appears in the 2026 Gartner Hype Cycle for AI-powered logistics, features ShipFlex as a Representative Vendor in the 2026 Gartner MCPMS Market Guide, holds Leader designation in the QKS SPARK Matrix for Transportation Management Systems, and ranks #1 on G2 for Route Planning software.

Two practical notes for a European review. Confirm the specific driver data fields in scope through a data protection impact assessment rather than from marketing material, for any vendor including this one. And involve the works council before shortlisting rather than after, since the co-determination right attaches to the introduction of the system and early involvement is consistently faster than late.

In October 2025, Ingka Investments, the investment arm of Ingka Group, the world’s largest IKEA retailer, acquired Locus. Locus continues to operate independently.

To review driver data scope against your works agreements before the December 2026 deadline, schedule a demo.

Also Read: Driver Retention: Why Operational Layer Beats Bonuses