# The Interface of Privacy and Data Security in Automated City Shuttles: The GDPR Analysis
## 1 Introduction  
The emergence of novel technologies based on artificial intelligence (AI) and Internet of Things (IoT) in the transport sector presents substantial regulatory challenges. Since the early stages of the Internet of Vehicles (IoV) deployment through connected automated vehicles (CAVs), multifaceted problems of compliance to the European personal data protection regulation have been raised [1]. To a greater extent, with the envisioned deployment of CAVs into the public transportation through the automated city shuttles (ACSs), there are novel and daunting regulatory hurdles to overcome [2]. The ACS, such as the one deployed in a pilot-site within the Avenue project [3] and depicted in Figure 1, compiles multiple sensors and AI units' inputs to achieve a high automation driving, as per the Society of Automotive Engineering (SAE) levels 4 and 5 [4]. A highly connected ACS would use intrinsic communications and endless exchange of information through vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), vehicle-to-cloud (V2C), and vehicle-to-pedestrian (V2P) to broadcast traffic conditions and share the predictions within the vehicular network. Such a complex system makes the ACS able to navigate autonomously while using real-time and fine-grained data. With the rise of registered information by the in-vehicle components and the vehicular external communications, data protection needs to become more significant and applicable to the different types of data generated by the ACS. The ACS's sophisticated cameras can record both eventual obstacles disrupting the autonomous driving mode and any visual personal data, including facial identities. In addition, within the vehicular network, the nodes, which can be an ACS or a road side unit (RSU), exchange beacon messages combining identity, location, and temporal properties. Such messages embed timestamps, vehicular information, authorization certificates, and location data [5; 6], which is qualified as personal data. In other words, those messages' content is linked to identified or identifiable natural persons (hereinafter, referred as \"data subjects\") under Article 4 of the General Data Protection Regulation (GDPR) [7]. Sometimes personal location data, such as travel itineraries, can reveal sensitive information about data subjects' health condition, sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership [1]. In these cases, stricter privacy protection rules are required to be applied. An idiosyncratic element to consider when exploring the ACS ecosystem is the provision of customized services to the passengers through the integration of location-based services (LBS) such as the mobility as a service (MaaS). MaaS is a mobility platform which bridges public transport to mobility services by providing, for example, door-to-door services based on the passengers information, including their location [8]. Hence, the more LBS services are deployed, the more personal data are transferred through external digital platforms, leading to higher risk of privacy violation. Based on such assumptions, the Article 29 Working Party (WP29), the predecessor of the European Data Protection Board (EDPB) \"whose purpose is to ensure consistent application of the GDPR\", assessed the necessity of transparency and proportionality controls due to high risk of personal data leakage and unlawful processing of mobility data [9]. The mere identification of the collection and further processing of personal data is of vital importance to ensure protection from privacy risks, which is attempted to be provided by regulatory frameworks such as the GDPR in the European Union (EU). Any failure to comply with the GDPR requirements could potentially result in physical, material, or non-material damage to natural persons, such as loss of control over their personal data or limitation of their rights (Recital 85) [7].