Jordan's Court of Cassation delivered the first binding appellate ruling interpreting the Personal Data Protection Law No. 28 of 2023 (PDPL), holding that an employer's continuous GPS tracking of delivery drivers — extending beyond working hours and into private residences — constituted unlawful processing of personal data. The Court ruled that blanket consent clauses in employment contracts do not satisfy the PDPL's requirement for specific, informed, and granular consent, and provided the first judicial guidance on the boundaries of the "legitimate interest" exception in Jordanian data protection law. The decision is the most significant privacy ruling in the Hashemite Kingdom to date and is expected to shape compliance programmes across the Jordanian private sector ahead of the PDPL's full enforcement timeline.
Amman-based Sameh Delivery Services LLC, one of Jordan's largest last-mile logistics providers with a fleet of 230 motorcycles, installed GPS tracking devices in all company vehicles as part of a fleet management system. The tracking software recorded location data continuously — 24 hours a day, seven days a week — including when drivers were off-duty and the vehicles were parked at their homes. Seven delivery drivers, represented by the General Federation of Jordanian Trade Unions, filed a complaint with the Ministry of Digital Economy and Entrepreneurship, Jordan's interim data protection authority, alleging violations of the PDPL. Following an investigation, the Ministry issued an administrative order requiring Sameh to cease continuous tracking outside working hours and to obtain fresh, specific consent from each employee. Sameh appealed the order to the Amman Court of First Instance, which upheld the Ministry's decision. The company then appealed to the Court of Cassation on points of law.
The Court of Cassation identified four questions of principle: (1) Whether the PDPL's consent requirement can be satisfied by a general clause in an employment contract, or whether it requires separate, specific consent for each processing purpose; (2) Whether an employer's "legitimate interest" under Article 6(1)(f) of the PDPL — which mirrors the GDPR structure — can override the consent requirement for employee monitoring; (3) Whether continuous geolocation data constitutes "sensitive personal data" under Article 8 of the PDPL, attracting heightened protections; and (4) Whether the Ministry of Digital Economy and Entrepreneurship had jurisdiction to issue binding administrative orders under the PDPL before the establishment of the permanent Personal Data Protection Authority.
The Court of Cassation dismissed the appeal in a unanimous decision, ruling that:
(1) The PDPL consent requirement cannot be satisfied by a blanket clause in an employment contract. Article 5(1) of the PDPL requires consent to be "specific, explicit, and given freely for a clearly identified purpose." A generic contractual provision authorising the employer to "monitor company assets" does not meet this threshold. The employer must separately obtain and document consent for each distinct processing activity — here, GPS tracking during working hours and GPS tracking outside working hours are distinct activities requiring separate consent.
(2) The "legitimate interest" exception under Article 6(1)(f) does not permit processing that overrides the fundamental rights and freedoms of the data subject. The Court adopted a three-part balancing test: (a) the employer must demonstrate a legitimate interest of substance; (b) the processing must be strictly necessary for that interest; and (c) the interest must not be overridden by the data subject's rights. Here, fleet management is a legitimate interest, but 24/7 tracking is not necessary for fleet management — off-duty tracking is disproportionate.
(3) Continuous geolocation data revealing an individual's home address, patterns of movement, and religious observance (through mosque attendance patterns) qualifies as data "revealing religious beliefs" and therefore constitutes sensitive personal data under Article 8 of the PDPL, requiring explicit consent and a heightened justification standard.
(4) The Ministry of Digital Economy and Entrepreneurship, as the interim supervisory authority designated under the PDPL's transitional provisions, has full jurisdiction to issue binding administrative orders and impose corrective measures pending the establishment of the permanent Authority.
This is the first judicial decision interpreting Jordan's PDPL — a statute modelled closely on the GDPR and enacted as part of Jordan's Economic Modernisation Vision 2033 — and it sends an unmistakable signal that the Jordanian judiciary will interpret the law in line with European data protection norms. The ruling has immediate implications for all Jordanian employers using workforce monitoring technologies, from GPS tracking to biometric timekeeping to productivity surveillance software. Employment lawyers in Amman predict a wave of compliance reviews and consent-refresh exercises across the logistics, manufacturing, and security sectors. The decision also confirms the Ministry's enforcement powers, lending credibility to Jordan's data protection regime as the Kingdom seeks an EU adequacy finding to facilitate cross-border data flows with European partners.
"Consent under the Personal Data Protection Law is not a formality to be buried in the fine print of an employment contract. It is a living, continuing safeguard — one that must be renewed and refined each time the employer's hand reaches into the employee's private sphere. The imbalance of power in the employment relationship makes this safeguard all the more essential, not less." — Chief Justice Mohammad Al-Tarawneh