Technician GPS and timecard data: privacy rules before sharing

What technician location and time records reveal#

Technician GPS and timecard records reveal where a named employee was, minute by minute, which makes them personal information even when collected for dispatch or payroll. Joined with customer addresses, they also show which homes a technician entered and when.

The records are spread across systems that rarely talk to each other, so a sharing request for one of them often pulls in more than anyone intended.

Which privacy rules may apply#

Several layers of rules may apply to technician location and time data, and which ones do depends on where your technicians live and work. Treat the list as questions for counsel, not conclusions.

Because these rules differ by state and by record type, they are assessed deal by deal, before any record leaves the company.

• 1State electronic monitoring rules: a few states require employers to give written notice before monitoring employees electronically, and some limit tracking devices on vehicles.
• 2California's CCPA: its employee exemption expired on January 1, 2023, and the California Privacy Protection Agency opened preliminary rulemaking on April 20, 2026 on how the law applies to employee, applicant and contractor data.
• 3Other comprehensive state privacy laws: many exclude employment-context data, as the Virginia and Colorado laws do, though definitions differ.
• 4Biometric privacy laws: the Illinois Biometric Information Privacy Act covers fingerprint and face scans, with liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation; a 2024 amendment limits recovery to one violation per person when the same identifier is collected repeatedly by the same method.
• 5Wage-hour recordkeeping: Department of Labor guidance says time cards should be kept for two years and payroll records for three.
• 6Collective bargaining agreements and your own handbook, which may limit how tracking data can be used.

Why exact routes rarely leave the company#

Exact routes rarely leave the company because they identify people even after names are removed. A trace that starts and ends at the same house each day points to the technician's home, and every stop in between points to a customer's.

Outside parties seldom need that detail. Routing software vendors, benchmarking projects and AI developers studying field service work usually want the shape of the work: how long jobs take, how travel time varies by zone and hour, and how schedules hold up against emergency calls. Job-level aggregates answer those questions without exposing anyone's movements.

Keep raw traces inside the company for the purposes employees were told about, such as dispatch, safety and payroll checks, on retention settings you chose deliberately. Telematics vendors apply their own defaults: Samsara, for example, keeps DVIR and Hours of Service data in the cloud for as long as you are a customer unless you change its data retention settings.

What to aggregate before anything is shared#

Aggregation turns location and time records into work measures that no longer track a person. Apply these steps to any extract before it leaves the company, and leave the original data where it is.

Then test the result by trying to re-identify someone. If a dispatcher could look at the extract and name the technician or the customer, aggregate further.

• 1Convert GPS pings into job-level fields: drive time to the job, time on site and time to the next job.
• 2Drop the first and last legs of each day, which start or end at a technician's home.
• 3Replace street addresses with service zones large enough that a single home cannot be picked out.
• 4Replace technician names with stable codes, and remove codes for anyone whose role makes them easy to spot.
• 5Round timestamps and remove off-clock, lunch and personal-use periods entirely.
• 6Suppress small groups, such as a zone served by one technician or a job type only one person performs.

Notice and policy checks before sharing#

Notice and policy checks confirm that what technicians were told matches what you now plan to do. A GPS policy that says tracking is for dispatch and safety does not obviously cover sharing derived data with a vendor or licensing it.

Where the notice falls short, update it before sharing anything and explain the change to technicians in plain words. An employee notice about data licensing can do that job if licensing is on the table.

Illustrative: an electrical contractor reviews its fleet data#

Illustrative: a fictional electrical contractor runs service vans on a telematics platform and logs job timestamps in its field service system. A routing software vendor asks for historical data to tune a scheduling model, and separately the owner is exploring licensing de-identified job histories.

The COO finds that the GPS policy technicians signed mentions dispatch, safety and payroll only, and that one state where the company works has a monitoring notice rule. Counsel recommends updating the notice first. The company then shares job-level drive and on-site durations by service zone, with technician codes and no traces, and keeps raw GPS history inside the company.

How SourceX handles workforce location data#

SourceX treats technician location and time data as high-sensitivity material within the SourceX five-step transaction. The Rights step checks employee notices, monitoring rules and vendor terms, the Preparation step aggregates or removes location detail, and the supplier approves the final scope before Delivery.

The SourceX Evidence Packet documents what was aggregated or removed, the permitted use and who authorized release, so the company can show technicians and counsel exactly what left and in what form. Nothing is shared during the initial fit check.