# The Interface of Privacy and Data Security in Automated City Shuttles: The GDPR Analysis
## 4 The Interface of Privacy and Data Security in ACSs
### Privacy-Preserving Techniques Overview
#### 4.1.1 Pseudonymization  
The pseudonymization technique is introduced in Article 4(5) of the GDPR [7] as a privacy-preserving measure and a safeguard that supports data processors and controllers to meet the data protection obligations. Pseudonymization does not remove all identifying information from the personal data but merely reduces the linkability by hiding the identity of the data subjects from third parties [32; 33; 35]. Technically, by using pseudonymization, the data subjects identifiers are substituted by a code, hiding the sensitive data, which can be re-identified using a key [46].  
_Encryption_ illustrates perfectly the pseudonymization technique as it uses secret keys that can reversely be decrypted and hence make personal data readable. Within the automated driving context, multiple researchers [47; 48] introduced several privacy-preserving encryption schemes such as conditional privacy-preserving authentication (CPPA) and group signature and identity-based signature (GSIS) where only predefined and trusted authorities are legitimated to decrypt the keys within the vehicular communication system. To that end, encryption increases the confidentiality and lowers the risk of misusing personal data. However, such protection depends on the strength of the algorithm that can be built either using public/private keys or hash functions which guarantee different levels of security [28].  
_Tokenization_ is another pseudonymization scheme that can be considered within the vehicular environment. It is the process of replacing sensitive characters by other random non-sensitive values that cannot be mathematically computed from the data source length [49]. Although, when applied to location data, even if the identities are replaced by pseudonyms, individuals can still be singled out and tracked, as demonstrated by [PERSON] et al. [50].  
_Zero-knowledge proof (ZKP)_ is a promising cryptographic protocol that is based on an exchange of messages between a prover and a verifier where the prover has a secret but does not reveal information about the secret, per se. However, the prover should provide more information about their secret to establish the trust with the verifier [51]. [PERSON] et al. [52] demonstrated how ZKP can be used for electric vehicle authentication within the vehicle-to-everything (V2X) communication. ENISA [32; 33] presented the ZKP as a pseudonymization technique implementing authentication and which increases confidentiality and data minimization required by the GDPR, although, the additional collected information by the verifier presents a risk for a future data leakage and again impacts the individual's privacy.  
Consequently, not all pseudonymization techniques are suitable to any sensitive data type within the ACS environment. In addition, data controllers and data processors have to keep track of such techniques to make the processing part of the GDPR scope. Furthermore, the combination of pseudonymization with further anonymization-based schemes is much recommended and would definitely strengthen the privacy within the ACS ecosystem [33; 35; 45].