Europcar has been tracking its customers' journeys for eight years using the satellite navigation systems installed in their cars, Der Spiegel magazine reported on Tuesday.
The GPS systems were installed in 1,300 cars in the car hire giant's premium category, which includes Mercedes E class, BMW 5 series and Audi Q7.
"The secret tracking of rented vehicles and the secret monitoring of the customers is a serious infringement of the right to privacy," wrote Johannes Caspar, Hamburg Commissioner for Data Protection and Freedom of Information in a press release on the authority website.
"The car hire company is in a position to create movement profiles of their customers. With the help of the location technology, they only have to reconstruct who went where when, who drove at a particular time at what speed."
The Hamburg authority said they first realised what was happening when a complaint was filed to their office this January. They confronted Europcar at the end of March and ordered them to stop the tracking.
The car hire company said they had to track the cars to ensure their customers kept within the confines of the rental agreement, which forbids driving in certain countries. That was why, they insisted, surveillance was only activated when vehicles were driven into particular areas.
However the company promised the data protection authority it would to stop the practice, a spokesman told the magazine.
But when officials returned in April to check, they found that not only were customers still being tracked - but that their location was being determined every 48 hours, regardless of where the vehicle was.
Also, said the authority, the company was automatically informed when the car was driven in certain port areas, and that the date, time and the speed of travel were also being recorded, wrote the paper.
Europcar must now pay €54,000 in fines for "irregular collection and storage of personal data."
The magazine said Europcar had stopped checking on the cars' location regularly – but had altered the rental agreements to include a statement saying the customer agrees to being tracked in certain countries.