# The Interface of Privacy and Data Security in Automated City Shuttles: The GDPR Analysis
## 2 Related Work
### Data Privacy-Preserving Methods  
Motivated by the potential of privacy-preserving schemes, as recommended by the GDPR, multiple literature reviews outlined clarification about the implementation of pseudonymization and anonymization. [PERSON] and [PERSON] [25] studied the feasibility of insuring the integrity of automated vehicles while preserving the individuals' privacy. Two particular concepts are brought forth by the GDPR, namely, privacy by design (PbD) and privacy by default (PbDf). Although these concepts are not necessarily new [26], as part of the GDPR their impact can be significant. PbD starts with the implementation of security measures from the outset of data processing and extends to the implementation of technical and organizational measures during the whole lifecycle of the data involved, whereas PbDf calls for personal data, which is necessary and proportionate for each specific purpose of the processing to be accomplished. This relates to the amount of personal data collected, the extent of the processing, the retention period, and who has access to it. The authors focused on the deployment of PbD principles and technical mitigation techniques based on encryption and anonymization in the scope of CAVs. Similarly, [PERSON] and [PERSON] [27] highlighted the difference between pseudonymization and anonymization as the key privacy-preserving techniques required by the GDPR and applied to vehicular environment. In a broader scope, [PERSON] and [PERSON] [28] compared pseudonymization and anonymization techniques and how they can protect personal data within IoT systems. Unfortunately, most of these works neither provided a comprehensive categorization of the applied pseudonymization and anonymization techniques to the ACS environment, nor flagged the re-identification risks related to such techniques. The most detailed analysis attempting to raise re-identification risks were proposed in [29; 30; 31]. [PERSON] [29] discussed the limitation of anonymization and encouraged its conjunction with pseudonymization to reduce the re-identification risks. [PERSON] et al. discussed the inference and de-anonymization risks within the driverless environment [30]. [PERSON] al. [31] evaluated the re-identification risks and impact within the vehicular context through a real test bed scenario, though the efforts remain limited to some of the privacy-preserving techniques without reviewing them thoroughly. Not limited to researchers, EU institutions initiatives assessed the re-identification risks in multiple publications. The opinion 05/2014 of the WP29 [9] represents one of the first guides approaching the effectiveness of anonymization techniques. European Union Agency for Cybersecurity (ENISA) provided deeper analysis on pseudonymization and anonymization implementation, differences and limitations [32; 33]. Nevertheless, such publications' scope remain very wide, yet applicable to driverless environment. Following this presentation on the related research and the analysis from Table 1, we differentiate from the other efforts by:  
* Presenting an interdisciplinary approach regarding data protection requirements in the ACS ecosystem by assessing and addressing simultaneously both regulatory and technical challenges. * Providing an in-depth analysis of the GDPR provisions and limitations that are relevant to the ACS. * Having a closer examination on how the legal requirements are compatible with the technologies deployed in the ACS. * Analyzing the inconsistencies between the legal definitions on pseudonymization and anonymization in the GDPR and their technical implementation through a comprehensive categorization of the most relevant applicable techniques into the ACS landscape. * Developing a significant reference point for academic research on ACS, public transportation operators, automobile manufacturers (OEMs), policymakers, and service providers, acquiring or looking forward to deploying ACSs within their systems.