Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications

Paragraph 3.2.4  Information and rights of data subjects

135. Art. 6 of the EU regulation 2015/758 of 29 April 2015 stipulates that manufacturers shall provide clear and complete information on data processing done using the eCall system. This information shall be provided in the owner’s manual separately for the 112-based eCall in-vehicle system and any third party service supported eCall systems prior to the use of the system. It includes:

• − the reference to the legal basis for the processing;

• − the fact that the 112-based eCall in-vehicle system is activated by default;

• − the arrangements for data processing that the 112-based eCall in-vehicle system performs;

• − the specific purpose of the eCall processing, which shall be limited to the emergency situations referred to in the first subparagraph of Art. 5 (2);

• − the types of data collected and processed and the recipients of that data;

• − the time limit for the retention of data in the 112-based eCall in-vehicle system;

• − the fact that there is no constant tracking of the vehicle;

• − the arrangements for exercising data subjects’ rights as well as the contact service responsible for handling access requests;

• − any necessary additional information regarding traceability, tracking and processing of personal data in relation to the provision of a TPS eCall and/or other added value services, which shall be subject to explicit consent by the owner and in compliance with the GDPR. Particular account shall be taken of the fact that differences may exist between the dataprocessing carried out through the 112-based eCall in-vehicle system and the TPS eCall in-vehicle systems or other added value services.

136. Furthermore, the service provider shall also provide the data subjects with information in accordance with art.13 GDPR in a transparent and understandable way. In particular, he or she must be informed of the purposes of the processing for which the personal data are intended as well as the fact that the processing of personal data is based on a legal obligation to which the controller is subject.

137. In addition, taking into account the nature of the processing, the information about the recipients or categories of recipients of the personal data must be clear and the data subjects should be informed that the data are not be available outside the 112-based eCall in-vehicle system to any entities before the eCall is triggered.

138. Regarding rights of data subjects, it has to be noted that since the processing is based on a legal obligation, the right to object and the right to portability will not apply.