In January, the European Data Protection Board adopted the first version of its guidelines on processing personal data in the context of connected vehicles and mobility-related applications. More than 60 formal comments were submitted during the public consultation period from the likes of member state ministries, major mobile carriers and associations, Tesla and Volvo, rental car groups and national automobile associations, industrials like Gilbarco Veeder-Root, Teletrac Navman and Global Traffic Technologies that are building the smart cities of today and tomorrow, and even one of the world’s largest tire manufacturers. The EDPB is now reviewing the feedback and is expected to adopt the final version by the end of this year, as part of its activities for 2019–20. 

In this article, we will outline the proposed scope of the guidelines and use examples to illustrate how, in their current form, the guidelines may create the unintended effects of frustrating consumers and discouraging investment, perhaps even without a clear gain for the protection of personal data. We will point out areas of overreach, including where the guidelines bring within their scope mobile applications used inside a vehicle even when no data is being exchanged between the vehicle and the app, and explain why so many of the formal comments contain an appeal to the EDPB for clarification on critical topics like whether the guidelines are meant to apply to the employment context.

The scope of the guidelines entangle processing activities that have nothing to do with connected driving

The guidelines are broad in scope. Any data processing in relation to drivers, passengers, vehicle owners and renters is covered, as is personal data processed inside the vehicle, exchanged between the vehicle and personal devices connected to it (e.g., the user’s smartphone), or collected within the vehicle and exported to external entities (e.g., vehicle manufacturers, infrastructure managers, insurance companies, car repairers) for further processing.

The guidelines also self-stipulate their applicability to “vehicle manufacturers, equipment manufacturers and automotive suppliers, car repairers, automobile dealerships, vehicle service providers, rental and car sharing companies, fleet managers, motor insurance companies, entertainment providers, telecommunication operators, road infrastructure managers and public authorities as well as drivers, owners, renters and passengers,” a non-exhaustive list that nevertheless also manages to exhaust.

We acknowledge, of course, that there is nothing problematic per se with a broad declaration of scope. Indeed, there would be no issue to take with today’s scope if the guidelines had gone on to establish run rules that preserved innovation and advanced the fundamental first principles of individual privacy. But the current scope could potentially lead to results that are the opposite of the ones intended. Consumers and industry may even disregard the guidelines as too burdensome or user unfriendly. We believe the guidelines can avoid this fate by endorsing a case-by-case — not blanket — approach of determining whether a given device or vehicle is terminal equipment, and by revising the interpretation of “strictly necessary” in a way that creates maneuverability within Article 5(3) of the ePrivacy Directive.

Mobile apps unrelated to the vehicle should be excluded from the scope of the guidelines

Processing activities within the context of mobile applications that may not be related to the vehicle or the driving environment in any way are nonetheless within the scope of the current version of the guidelines. Even the mere use of a mobile app from inside a vehicle or the mirroring of an app on a vehicle’s in-dash information and entertainment unit is covered. This would lead to the application of the guidelines, for example, to apps installed on a personal smartphone even when they bear no relation to driving whatsoever.

Consider the following use cases, which  involve the processing of personal data within the physical confines of a vehicle:

• A smartphone app enabling the user to pay for fuel tanked at a petrol station but incorporating no information about the vehicle’s operational status, such as whether it is close to empty, its consumption rate or even the type of fuel it requires.
• Route planning maps, voice calling and the display of phone address books of a smartphone visualized on the vehicle’s control display, permitting safer use of legal features.
• A passenger in a connected vehicle who uses a smartphone to tether a laptop to the internet to send work-related emails or complete an online purchase.

If the EDPB finds that these use cases objectively and as a matter of fact involve no meaningful exchange of personal data between the vehicle and the device being used by the individual within the vehicle, then it may decide to tighten the scope of the guidelines accordingly and with the understanding that all of these scenarios will still be regulated, as they always would have been, by the terms of the GDPR and ePD. Or it may be the case that such a broad scope for the guidelines was never intended by the EDPB in the first place. Whatever the case, by taking an opportunity to reexamine the scope of the guidelines, the EDPB can create certainty for developers and users who, respectively, may not need to design or may not expect to experience potentially numerous consent journeys and possibly consent fatigue.

The guidelines should be clarified to state that they do not apply in the employment context

The guidelines indicate that employers providing company cars to members of their staff might want to monitor their employee’s actions, for example, to ensure the safety of the employee, goods or vehicles, allocate resources, track and bill a service, or check working time. The guidelines point out that data processing carried out by employers in this context raises specific considerations in the employment context, which might be regulated by national employment law that the guidelines cannot address. Similarly, as we note above, employers are not mentioned among the categories of intended recipients of the guidelines. Excluding data processing in the employment context from these guidelines makes sense.

But the guidelines need to be made clearer still, because the current language casts doubt over whether processing carried out directly by employers and by third party processors on their behalf is excluded from their scope.

Data processing in the employment context raises important issues that have already been addressed by other sources, including the separate opinion on data processing at work issued in 2017 by the Article 29 Working Party. The concerns relating to the employer-employee relationship are unique, peripheral to the main purpose of the guidelines, and addressed in detail by other mandatory and persuasive regulatory sources.

One industry use case illustrates the need for clearly excluding data processing in the employment context from the scope of the guidelines, which otherwise risk creating more confusion than they would resolve for employers acting as data controllers and for the data processors they engage for fleet management support. Employers that own or lease cars, vehicles, trucks and other vehicles used by employees for different business objectives may use GPS tracking to manage their fleets and reduce operating costs. This often occurs through route optimization that helps to manage fuel costs and reduces employee driving time and therefore potential fatigue. Sometimes employers outsource the management of these functions to specialized fleet management companies acting as their data processors.

This type of processing raises important data protection issues, including ones related to the legal grounds available to employers. The opinion on data processing at work stresses that for the majority of data processing at work, the legal basis should not be the consent of employees, and validates the use of certain vehicle telematics as necessary to ensure compliance with the employee safety requirements, thus permitting employers to rely on “legal obligation” as the legal basis for processing. Employers can also rely on their legitimate interests to know the location of their fleet vehicles. In addition, when addressing employer processing of information from vehicle tracking devices, the Article 29 Working Party opinion on geolocation services on smart mobile devices states that rather than seeking consent, employers are to consider whether they can rely on their legitimate interests under the Data Protection Directive (i.e., the GDPR’s predecessor).

Contrast these regulatory clarifications about legal bases available in the employment context with the reliance that the guidelines place on Article 5(3) ePD, which, in the absence of an exception, always requires the prior consent of the individuals where there is storage of information or the gaining of access to information that is already stored in the terminal equipment. Neither of the opinions cited above nor the WP29 opinion on legitimate interests of the data controller under Article 7 of the Data Protection Directive apply Article 5(3) ePD in the way the guidelines do and for good reason. 

Through public consultation, the EDPB is seeking to make the great open road a more  dynamic place for all

Industry and consumers, or even anyone passionate about driving or privacy, should follow with interest the journey these guidelines will take as the EDPB considers the views offered during its public consultation period. Many of the comments submitted raise a few common themes that the EDPB may wish to reexamine: whether the breadth of the scope of the guidelines should be narrowed, whether the physical location of personal data processing is always relevant, and whether matters arising in the employment context are best dealt with by other sources of guidance.

This is an important space to watch because, in 2020, the EDPB aims to intensify its work in the context of advanced technologies like connected vehicles. That makes this year one of great promise for practical and actionable guidance involving that most unmistakable “symbol of the 20th century economy,” one so “commonly associated with the notion of freedom” and representative of “a private area in which people can enjoy ... autonomy of decision, without encountering any external interferences” the automobile.

The views expressed here are those of the authors and not their respective employers or clients.

Photo by Joey Kyber on Unsplash