Source: https://www.taylorwessing.com/en/insights-and-events/insights/2020/07/car-data-protection-in-the-extended-vehicle
Timestamp: 2020-08-07 18:20:01
Document Index: 311584611

Matched Legal Cases: ['Art. 102', 'Art. 61', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 32']

Car Data Protection …
Year after year, more and more vehicles on the market are equipped with Connected Car technologies to exchange information wirelessly with mobile apps, the vehicle manufacturer, service providers, other users, infrastructure operators and last but not least other vehicles. It is estimated that 70% of the vehicle population will be connected by 2025. The technologies used enable OEMs in particular to offer new service fields such as a digital “vehicle health monitor” and remote maintenance services: a predictive system that detects malfunctions and sends recommendations and reminders for a visit to the workshop before a component breaks down.
The “extended vehicle” discussion is primarily concerned with the question of whether and to what extent vehi­cle manufacturers must make available to independent service providers and other market participants (outside the OEMs‘ own network) the data arising in connection with the operation of vehicles; e.g. to enable other market participants to develop and offer comparable products and services.
Manufacturers are obliged to make certain vehicle data available to other market participants to a certain extent, which in principle follows both from general provisions of competition law (cf. inter alia Art. 102 TFEU and Sections 18 to 20 of the Act against Restraints of Competition [GWB]) and from EU legislation specifically enacted for this purpose. Article 6 of Regulation (EC) No 715/2007 con­tains specific legal provisions requiring manufacturers to give independent operators access to vehicle repair and maintenance information. Art. 61 et seq. of Regulation (EU) 2018/858, which applies from 1 September 2020, clarifies these obligations.
Nowadays, vehicle data is mainly collected from the vehi­cle via the so-called Onboard-Diagnosis Interface (OBD), e.g. during a visit to the workshop. As an interface for vehi­cle diagnostics in the workshop, it is, however, not suitable for access to vehicle data by “new” market participants.
In the future, data will increasingly be transmitted from the vehicle to external locations via over-the-air technologies (OtA). They thus offer better technical possibilities for im­plementing data transmission to the manufacturer – and where necessary to the “aftermarket”.
Regulation 2018/858, which will apply from 1 September 2020, already contains specific requirements as to which data should be made available and how. For example, Article 61(1) states that “manufacturers shall provide to independent operators unrestricted, standardised and non-discriminatory access to vehicle OBD information, diagnostic and other equipment, tools including the complete references, and available downloads, of the applicable software and vehicle repair and maintenance information. Information shall be presented in an easi­ly accessible manner in the form of machine-readable and electronically processable datasets. Independent operators shall have access to the remote diagnosis services used by manufacturers and authorised dealers and repairers.”
Thus, Regulation 2018/858 will certainly bring more clarity compared to the previously existing provisions, but many details will remain unclear and controversial. In practice, for example, the question will continue to arise as to what information must now be passed on in what way, in what form and to which third parties. A comprehensive detailed analysis of the planned concepts will therefore be essen­tial for every OEM.
However, the discussion on third-party access to vehicle data raises not only competition law issues, but also a number of data protection questions. While competition law deals with the scope of the obligation to provide ve­hicle data, data protection law to a certain extent takes the opposite perspective: To what extent is the manda­tory provision of vehicle data, which regularly includes personal data (e.g. FIN), permissible under data protection law?
The first, albeit rather unproductive, indications for re­solving the tension between competition law and data protection requirements are provided by Regulation (EU) No 2018/858, where recital 62 clarifies that data transfers under this Regulation may only be made in compliance with applicable data protection law, in particular the provisions of the GDPR.
This depends largely on the specific processing situation. Various scenarios are conceivable here. At first glance, Regulation (EU) No. 2018/858 aims to enable third parties to provide corresponding services in the vehicle ecosys­tem. Typically, the customer concerned would be likely to request corresponding services specifically from the exter­nal service provider or another third party, who would then need access to corresponding data from the customer’s vehicle and receive it via a corresponding “extended vehi­cle” platform of a manufacturer.
If a user expressly requests a corresponding data transfer from the manufacturer, the associated data processing is likely to be carried out regularly in fulfilment of the cus­tomer’s request, i.e. on the basis of Art. 6 (1) (b) GDPR), but also, depending on the scope of the duties requiring ac­tion, possibly based on a legitimate interest of the parties involved (Art. 6 (1) (f) GDPR).
The consent of the person concerned in accordance with Art. 6 (1) (a) GDPR also appears possible, but from a prag­matic point of view it is likely to be only the second choice alongside the alternatives mentioned.
However, it remains clear that the transfer of data from a user’s vehicle “on his behalf” requires appropriate verifi­cation to ensure that the data reaches the “right” place. To this end, manufacturers will (have to) develop suitable concepts, taking into account the specifications on tech­nical and organisational measures in accordance with Art. 32, 25 GDPR, which will enable the transfer of correspond­ing data to third parties in conformity with the law but also most conveniently from the user’s point of view.
To what extent must an OEM pass on personal data of a vehicle user in order to fulfil its (contractual) obliga­tions towards the respective data subject or its stat­utory obligations under Regulation (EU) No 2018/858? What is actually “required” in this context, what is not?
After a first analysis of the wording of the relevant stand­ards of Regulation (EU) No 2018/858, there is a strong case for exercising restraint in the disclosure of personal data of the vehicle user in any case, if they are not necessary for the specific service requested by the user from a third party.
As to what is “required” under the Regulation (and may thus form a basis for a necessity test under GDPR) ex­isting standards for extended vehicle concepts such as ISO20077, 20078 and 20080 may help to interpret the relevant provisions. The disclosure of “excessive” data, in particular data which allows conclusions to be drawn about (possibly even illegal) user behaviour or other sen­sitive data, should always be checked thoroughly and, in case of doubt, handled with restraint. Data minimization and privacy-by-default play a central role here in order to develop a viable data protection concept for extended vehicles.
Extended Vehicle only one of many exciting data protection topics for automotives in 2020
However, the draft of the European Data Protection Board’s Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility relat­ed applications published in February 2020 is currently providing plenty of food for thought in the industry and has one or two other exciting data protection topics for automotives 2020 in store.
PDF- Version: Car Data Protection in the “Extended Vehicle”
For further comprehensive information in this sector, please refer to our Automotive & Mobility page.
Sectors Automotive & mobility Software Connectivity autonomous driving & data services