# The Interface of Privacy and Data Security in Automated City Shuttles: The GDPR Analysis
## 3 GDPR Implications
### Data Subjects Rights  
To ensure transparency and fairness of data processing, the GDPR grants the data subjects specific control rights [20]. It should be mentioned that, at every stage of data processing, data subjects remain the owners of their personal data as verified by the right of access to personal data by virtue of Article 15 of the GDPR. By providing individuals access rights, the GDPR imposes a number of obligations to the entities that collect and process data, as well as allows the data protection authorities (DPAs) to ask for demonstrations of accountability or impose fines if data subjects' rights are not secured. Data controllers provide specific practices and technologies to the data subjects to control and exercise their rights during the entire data processing. For instance, the information about the exercise of rights is available in the privacy policy at the controller's website. Controllers can facilitate, specifically, the access, the deletion, the transfer, or the removal of personal data by providing modification settings [37]. One of the most crucial rights is the _right to be informed_ (Articles 12-14). Prior to the processing of personal data by the controllers, the data subjects shall be informed, in a transparent way, of the identity of the data controller, the purpose of processing, the data recipients, the data retention period, and the data subjects' rights. In relation to the right to be informed, it is noted that data subjects should be informed in clear and plain language about any data breaches where their personal information is leaked and this leakage is likely to result in a high risk to their rights and freedoms as per Article 34 of the GDPR. For exercise of the right to be informed when the collection and use of data is intended for the vehicular automated decision-making and profiling purposes, the data subjects should receive \"meaningful information about the logic involved\" as well as the significance and the envisaged consequences of such processing for the data subject as per Article 13 Section 2.f [7]. The WP29 in its revised guidelines [38] clarified that the complexity of the technologies should not justify the lack of information. In the light of this clarification, the OEMs, other equipment manufacturers, and service providers, qualifying as data  
Figure 2: Data processing principles summary. controllers, should explain clearly to the ACS' data subjects the automated processing methods and their objectives. Other rights include the _right to rectification_ (Article 16). This right allows the data subjects to correct their personal data when it is inaccurate. _The right to erasure_ (or right to be forgotten) allows the individuals to ask for their personal data to be deleted (Article 17). For instance, if an ACS operator (i.e., data subject) has consented to test the efficiency of a newly deployed system, he or she can withdraw such consent at any time and require the controller to erase all the information that was processed for the validation of this system. However, in following our example, if the OEM (i.e., data controller) demonstrates that he or she collects and processes personal data to detect shortages in the ACS with a view to improve safety of the vehicles and, subsequently, the safety of the public (overriding legitimate interests), the right to be forgotten may not be invoked pursuant to Article 17 Section 1.c of the GDPR. Further, the _right to restriction of processing_ gives the data subjects the power to limit the processing of their personal data with several rules and exceptions (Article 18) [7]. Article 20 of the GDPR foresees the _right to portability_, permitting the data subjects to receive a copy of their personal data in a structured, commonly used, and machine-readable format and to transmit those data to another controller without impediment from the initial controller.