The camera points at your driver. Here is what that means.
Fleets across Europe run these cameras lawfully every day. The question is never whether you are allowed one — it is whether the paperwork was done before the fitter did the wiring. 14 things stand between you and a fitted van. 8 of them are software, and the software is written.
01 — Who does what
14 obligations. 8 of them are features.
Every other vendor page on this subject lists the law and stops. This one says which rows you still have to do yourself, and which ones stopped being your problem the day the platform shipped.
Ours, already running
-
Art. 17(1) · erasure
Subject erasure
Removing a driver cuts the link between the person and the footage. The vehicle's track survives; the person does not stay in it.
-
Art. 15(3) · a copy, on request
Subject export
Every clip and event belonging to one driver, as a single signed archive. A job that runs, not a week of somebody scrubbing a timeline.
-
Art. 5(2) · accountability
Access log
Who watched which clip, when and from where. Append-only — the database refuses an update to it, so it cannot be tidied afterwards.
-
Art. 5(1)(c) · data minimisation
Blurred export
Faces and plates out before a clip leaves. If the detector you asked for is not configured the export fails rather than shipping an unblurred file that claims it was blurred.
-
Art. 88 · employment context
Cabin privacy switch
The inward camera and its microphone switch off per vehicle, on the device itself — not a setting that hides the uploads while it keeps recording.
-
Art. 17(3)(e) · legal claims
Evidence hold
A clip needed for a claim outlives the retention clock until somebody releases it, and the hold is on the record with a name against it.
-
Art. 32(1) · technical measures
Roles, not logins
Twenty-two permissions over five roles. Playing video, pulling a window off the card, exporting it and holding it past retention are four separate rights.
-
Art. 5(1)(e) · storage limitation
Share links that expire
The link an insurer or a lawyer opens without an account dies on the date you set — one to ninety days, seven by default.
Yours, on paper
-
Art. 6(1)(f) · legitimate interests
A lawful basis, written down
A balancing test on paper: what you are protecting and why a camera is proportionate to it. Consent is the wrong basis for an employee — it cannot be freely given by someone whose job you hold.
-
Art. 35 · impact assessment
A DPIA, before the fitting
Systematic monitoring of people at work is on every supervisory authority's list of processing that requires one. Twelve vans is a shorter document than four hundred, not an exemption.
-
Art. 13 · information to the driver
The drivers told, provably
Written notice in the language they work in, before the first shift under a camera. A sticker on the windscreen is a legal requirement in several countries and a notice in none of them.
-
Art. 88 · employment context
The works council, where there is one
In Germany, Austria and the Netherlands monitoring equipment is co-determined before the kit goes in. Sweden and Norway run the same conversation through the union.
-
Art. 5(1)(e) · storage limitation
A retention period you chose
Ninety days is our default and a choice, not a law. Pick it against how long your drivers take to report an incident and your insurer takes to open a claim, then write it in the policy.
-
Art. 32(1) · organisational measures
A rule for who may watch, and when
Live view of a cabin is what turns a safety system into surveillance in the eyes of everyone who works for you. The platform logs every session; the policy is what makes the log mean something.
Start the works council first
It is the longest lead time on the project — longer than the freight from Shenzhen. Budget weeks for it, begin the day you start reading price lists, and a fleet that fits cameras before having it negotiates from a bad position.
Articles 5(1)(e), 32(1) and 88 appear in both columns on purpose: you decide the retention period, who may watch and what the agreement says, and the platform is what makes the decision true on every vehicle instead of true in a document.
02 — What actually leaves the van
One part in sixty thousand.
This is the distinction that settles half the room. The camera records continuously; the platform receives almost none of it. Whoever is arguing against the system is usually arguing about the first bar while you are buying the last one.
One month of recording, in the vehicle
2,500 GB
The first hundredth of it, magnified
25 GB
And the first hundredth of that
250 MB
Stays on the card
Overwritten, never uploaded
- Continuous road and cabin video, every channel
- Audio, where the vehicle has it switched on
- Gone in about nine hours on a 128 GB card, whether or not anyone wanted it
Uploaded by itself
Events only, about 40 MB a month
- The event, its position, speed and time
- One still frame per event
- The clip around it, seconds long
Only when a person asks
Manual, logged, time-limited
- A live session — ten minutes, with a visible countdown, then it closes itself
- A window of footage pulled off the card
- Every one of these in the access log, with a name against it
03 — How long any of it lives
Nine hours, ninety days, or until you release it.
Three clocks, and none of them needs a person to remember. The sweep runs every minute against the retention period your policy set.
Before the chart begins
~9 hours
The continuous recording never reaches any of these clocks. A 128 GB card holds about nine hours of two channels and then writes over the oldest of it — which makes the shortest retention in the system the one nobody configured.
An event clip, at the default retention
90 days
The same clip, put on evidence hold
until released
The log of who watched it
180 days, then your call
Paperwork aside — the cameras ship now and work in Wialon today.
Run the works council conversation in parallel with the order, not after it. It is the longest lead time on the project and the freight is four to six weeks.
04 — Where the limits are
What we are not.
A vendor page on data protection is worth reading only for the parts that are inconvenient to the vendor, so here are ours.
-
You are the controller, not us
We are the distributor and the software vendor. The fleet controls this data and your integrator is usually the processor — that Art. 28 contract is between the two of you, and it should exist before the vans are fitted.
-
Redaction is a detector, not a guarantee
deface is the default engine for faces and it is good. It is not a signed promise that no face survived a frame. Review an export before it goes to a court.
-
None of this is legal advice
It is not a substitute for your own DPO. The article numbers here are the shape of the conversation, not an opinion on your case, and national employment law adds to them in most of Europe.
The rest of the project, while the paperwork runs: what it costs, what the fitting involves, and who the supplier behind the processor contract is .
05 — Asked by every HR department
The questions before the price question.
Where is the video actually stored?
On your integrator's platform, on their server, in whatever country they run it in — the software is shipped to them to run under their own brand and their own domain. Ask them where it is and put the answer in the contract. The camera is pointed at that address at commissioning and sends nowhere else; nothing routes to us and nothing to the manufacturer.
Can a manager watch a driver live whenever they want?
Technically, if you give them the permission. A session is started by hand, runs ten minutes with a visible countdown, closes itself and is logged against a name. Continuous background streaming does not exist in the product at any tier — not as a policy setting, as an absent feature. Whether a manager should hold that permission is your policy, and it is the question the works council asks first.
How long does the access log itself live?
By default, forever: it is the evidence the product is sold on. You can age it out where your own policy says to, and 180 days is the floor — the database refuses to delete an entry younger than that, whatever the setting asks for.
Do I need a DPIA for twelve vans?
Almost certainly yes. It is the nature of the processing that triggers Art. 35 — systematic monitoring of employees — not the number of vehicles.
A driver has asked for their footage. What happens?
You run the subject export: every event and clip tied to that driver, as one signed archive. Other people in the frame are why blurred export exists — faces and plates come out before the file is handed over.
A driver refuses to be filmed in the cabin.
Then do not film the cabin in their vehicle: the inward camera and its microphone switch off on the device, per vehicle, and the road channel keeps working. Most of the insurance value is in the forward-facing footage anyway. Note that consent was never your legal basis, so this is a policy decision rather than a right they are exercising — which is exactly why it belongs in the agreement rather than in the cab.
Can we turn off the driver-monitoring AI and keep the rest?
Yes. ADAS on the road channel and DMS on the cabin channel are separate detectors. A fleet that wants collision evidence without fatigue scoring runs the first and not the second.
Bring the questions, we will bring the answers in writing.
Tell us the country, the fleet and what you need the footage for. You get the data-protection notes for that jurisdiction, the retention and redaction settings written out, and the integrator covering your region — who holds the processor contract, not us.
Or write to [email protected]