Guidelines for personal data related to connected vehicles are welcome. However, the guidelines proposed by the European Data Protection Board (EDPB) are too broad, says industry association ACEA. The organisation advocates refining the guidelines further before publication.
Many modern cars are internet-connected and collect all kinds of data. The guidelines proposed by the EDPB aim to improve the protection of this data and thus customer privacy. An e-privacy regulation should prevent car manufacturers from being given too much leeway in the use of data collected by connected vehicles.
'Too broad'
ACEA argues that such guidelines are welcome. However, the rules now proposed by the EPDB are too broad in their scope, the industry association argues. ACEA points out that the term connectivity is typically used to describe vehicle communications with the outside world, where data is transmitted between devices, mobile applications or infrastructure. However, the new rules also apply to communications within the vehicle.
The industry association does not think this is correct and points out that this is not in line with national guidelines several EU member states, including France and Germany. ACEA also argues that the guidelines should make it clear that vehicle manufacturers only become data controllers or processors once data leaves the vehicle.
'Cars are not smartphones'
Eric-Mark Huitema, managing director of ACEA, also points out that cars are not smartphones. "Motor vehicles differ from products like smartphones in that they have multiple users and therefore potentially have multiple 'data subjects'. Whether vehicle data can be seen as personal data needs to be addressed in the context of data processing, with the impact on the data subject considered in each case."
For example, cameras and sensors in vehicles also collect data on passengers and pedestrians. ACEA points out that these individuals cannot be identified by the car manufacturer. In addition, connected vehicles also collect data not related to a data subject, such as the average speed of the vehicle. Such technical data therefore have no impact on the data, according to ACEA.
'Not all data should be allowed to be deleted'
The EPDB wants data subjects to have the right to delete (or have deleted) all vehicle data. ACEA denounces this provision and argues that this should not be the case. For instance, the organisation points out that some data is needed to demonstrate compliance with legislation, perform maintenance and enable technical inspections. Think of data related to components such as software version or fault codes. Therefore, not all data should be removed.
Finally, ACEA points out that the proposed guidelines are based on the European ePrivacy Directive, while this will soon be replaced by a new ePrivacy Regulation. Therefore, if the directives are published in their current form, there is a risk that they will become obsolete after a short period of time. ACEA therefore calls on the EPDB to postpone the publication of the guidelines until there is more certainty about the content of the ePrivacy Regulation.
'Quality more important than speed'
"We think the quality and accuracy of the guidelines are more important than the speed with which they are embraced," said Huitema. "Our industry is ready to work with the EPDB to create pragmatic and workable guidelines that increase customer confidence in new connectivity technologies."
"The automotive industry is committed to delivering a high level of protection for its customers' personal data," said Huitema. "That is why it is so crucial that these guidelines are made more robust. They provide authorities in the EU with a sound and overarching understanding of how data protection rules should be applied to connected vehicles."
Author: Wouter Hoeffnagel
