GDPR and AI in logistics: what can you do with personal data?

As soon as an AI system reads an order email, a consignment note or a time export, it processes personal data and the GDPR applies, even if the system is only looking for an order number. GDPR and AI in logistics then comes down to four questions. Which data is in there, on what basis may you use it, what do you sign with the builder and when does the works council get a say? It is not legal advice: when in doubt, ask your privacy lawyer or data protection officer.

What does the GDPR mean for AI in logistics?

The GDPR applies to every AI system that reads, stores or passes on data about identifiable people. Around a warehouse floor that is almost every system. The GDPR (General Data Protection Regulation, Regulation (EU) 2016/679) is the European law that sets when and how you may process personal data. Under article 4, personal data is any information about an identified or identifiable person. The law explicitly mentions a name, an ID number and location data.

For the GDPR it makes no difference whether a person or a language model reads the consignment note. Processing is any operation, automated or not. The AI Act is a separate law with its own requirements. What it means for a warehouse is in the AI Act in logistics.

Which personal data is in your logistics paperwork?

Names, signatures, registration numbers, clock data and addresses, spread across documents that seem to be about goods.

Drivers

A CMR consignment note, a loading list or a proof of delivery carries the driver’s name, a signature and often a registration number. Let a system read along with planning or track and trace and you add times and locations. That is personal data about drivers, also when they work for a carrier and not for you.

Temp workers and your own staff

Clock data links a badge number to start times, end times, breaks and a department. Staffing agency invoices carry names, staff numbers and roles. If your warehouse clocks in with a fingerprint, that is biometric data in the special categories of article 9. The Dutch Data Protection Authority writes that in the Netherlands this is only allowed when strictly necessary for authentication or security (article 29 of the Dutch GDPR Implementation Act). A citizen service number (BSN) may only be used for the purpose a law sets (article 46 of the same act), so an AI system that reads invoices has no need for it.

Consignees and contacts

A parcel for a consumer carries a name, an address and a phone number. An order email from a client ends with the buyer’s name, role and mobile number. A system that reads orders from email sees all of it.

On what legal basis may an AI system process that data?

Every processing operation needs one of the six legal bases in article 6(1) GDPR. In the paperwork around a warehouse you mostly meet three.

• Performance of a contract to which the data subject is a party (point b).
• A legal obligation that rests on you (point c).
• A legitimate interest (point f), such as checking agency invoices against your clock data. That only holds if the interests of the people concerned do not outweigh it. Write that balancing test down, because you have to be able to show that you comply (article 5(2)).

In fulfilment you may well be the processor for the web shop when it comes to consumer addresses. The legal basis then sits with your client and you work on its instructions.

An AI system does not change the legal basis. It does change what you can do with the same data, and that is where purpose limitation in article 5(1)(b) comes in. Data you collect for one purpose may not later be used in a way that is incompatible with it. Clock data for the invoice check does not quietly turn into a performance measure per person.

How much data may the system see?

An AI system may only see the data it needs for its task. Article 5(1)(c) calls this data minimisation: adequate, relevant and limited to what is necessary.

For order processing from email that means order number, items, quantities, delivery address and delivery date. The signature under the email does not need to go into the WMS. For an invoice check you need a badge number, a date and hours per line. The name only comes back on the list of differences that a person reviews.

Privacy for AI in the warehouse is mostly a matter of which fields the system gets. Agree with the builder which fields are dropped or masked before the model sees them, after how many days raw files are deleted and that logs never hold full documents.

Do you need a data processing agreement with whoever builds the AI system?

You need a data processing agreement as soon as the builder or its system processes personal data on your behalf. Article 28(3) GDPR then requires a contract that sets out the subject matter, duration, nature and purpose of the processing, and the types of data and people involved.

With AI, these parts of article 28 matter most:

• The processor only acts on your documented instructions, also for transfers outside the EU (paragraph 3, point a).
• It engages no other processor without your written authorisation (paragraph 2). The provider of the language model is usually such a sub-processor and belongs on the list.
• At the end it deletes the data or returns it, as you choose (paragraph 3, point g).
• It helps you with security, data breaches and a DPIA (paragraph 3, point f) and allows audits (paragraph 3, point h).

Does your data stay in the EU and out of model training?

You set that in the data processing agreement. The GDPR only allows transfers outside the EU under the conditions of chapter V (article 44), such as an adequacy decision by the European Commission (article 45) or appropriate safeguards (article 46). If you want your data in the EU, make that a contract requirement, sub-processors included.

Model training is a separate point. If a processor, in breach of the GDPR, decides the purpose of processing itself, it counts as the controller for that processing (article 28(10)). So put in writing that your data is not used to train models, also not by the model provider. With us that is in the agreement from the start, as our way of working describes: data in the EU, used only for this job and never for model training.

When is a DPIA required for AI in the warehouse?

A DPIA is required when processing is likely to result in a high risk to people’s rights and freedoms, and you carry it out before you start (article 35(1) GDPR). A DPIA, a data protection impact assessment, describes the processing, tests whether it is necessary and proportionate and sets out the risks and the measures (paragraph 7). The law names the use of new technologies explicitly.

On 19 November 2019 the Dutch Data Protection Authority adopted a list of processing for which a DPIA is mandatory. For logistics these points stand out:

• Employee monitoring: large-scale or systematic monitoring of what employees do. The authority gives GPS systems in employees’ cars and trucks as an example.
• Location data: large-scale or systematic tracking of locations that can be traced to people.
• Profiling: automated assessment of personal aspects, such as work performance.
• Biometric data to identify someone, such as a fingerprint on the clock.

The authority itself says the list is not exhaustive. A system that pulls orders from email is not on it. A system that tracks how fast each temp worker picks comes close to profiling and monitoring. You may also do a DPIA when it is not required. It makes you write down what the system may see and why.

Does the works council have to agree to AI on hours or monitoring?

The works council has a right of consent over a scheme for the personal data of your staff and over any facility that is suited to monitoring their attendance, behaviour or performance (article 27(1), points k and l, of the Dutch Works Councils Act).

The word suited matters. An invoice check on clock data is meant to recalculate invoices. Yet it shows per person who started and stopped when, so it can fall under point l. Temp workers count for the act once they have worked for you for at least 15 months (article 1(3)).

The act asks you to put the decision to the council in writing (article 27(2)). Do that before the system goes live, with the DPIA attached if you have one. We supply the documents for the council. How such a check works is in checking staffing agency invoices.

What do you put in writing before the first file goes to the builder?

Before a real file with personal data leaves the building, this is on paper:

1. Which personal data the system sees, and which fields it does not need.
2. The legal basis per processing operation, with the balancing test if you rely on legitimate interest.
3. A signed data processing agreement with the sub-processors, where the data is stored and the agreement on model training.
4. A DPIA, or a short note on why one is not needed.
5. The request for consent to the works council if the system touches people’s hours or behaviour.

Fill the list in one process at a time, for example orders from email into the WMS. The first one we can do together in an introductory call.