The GDPR and Its Application in Connected Vehicles—Compliance and Good Practices

Abstract

Symbol of the 20th century economy, the automobile is one of the mass consumer products that has impacted society as a whole. Commonly associated with the notion of freedom, cars are often considered as more than just a mean of transportation. Indeed, they represent a private area in which people can enjoy a form of autonomy of decision, without encountering any external interferences. Today, as connected vehicles move into the mainstream, such a vision no longer corresponds to the reality. In-vehicle connectivity is rapidly expanding from luxury models and premium brands to high-volume midmarket models, and vehicles are now massive data hubs. Not only vehicles, but drivers and passengers are also becoming more and more connected. As a matter of fact, many models launched over the past few years on the market integrate sensors and connected on board equipment, which may collect and record, among other things, the engine performance, the driving habits, the locations visited, and potentially even the driver’s eye movements, or other biometric data for authentication purposes. Such data processing is taking place in a complex ecosystem, which is not limited to the traditional players of the automotive industry, but is also shaped by the emergence of new players belonging to the digital economy. Aware of the issues at stake for the protection of motorists’ privacy in this ecosystem, the Commission Nationale de l’Informatique et des Libertés (CNIL)—the French data protection authority—developed a reference framework enabling professionals to comply with the General Data Protection Regulation (GDPR), applicable as from 25 May 2018, thus making the compliance simpler and ensuring that users enjoy transparency and control in relation to their data.