BULLETIN Your monthly news round-up of the Scottish Motor Industry
JANUARY 2022
GDPR APPLICATION IN THE CONTEXT OF CAR CONNECTIVITY This report “GDPR application in the context of car connectivity” compiles the findings of an expert study commissioned by the Fédération Internationale de l'Automobile (“FIA”) and conducted by Ernst & Young Abogados, S.L.P. from July 2021 to November 2021. What is the objective of the Study? The objective of this Study is (i) to provide an extensive analysis of the EU data protection and privacy legal framework applicable to the processing of data in the context of car connectivity; (ii) to assess whether this framework is accomplishing its purposes from a consumer point of view; (iii) to identify challenges and opportunities; and (iv) to provide policy recommendations, where necessary. Why is data relevant to the automotive sector? Connected vehicles collect information from the vehicle and its surroundings and communicate with the outside world through a wireless connection to the internet. Connected vehicles rely heavily on data. Through different input sources they can produce significant amounts of data of different nature. The number of connected vehicles is expected to increase exponentially, positioning the automotive sector as one of the largest data generators. This is fostering the development of innovative data-enabled solutions and business models which are already disrupting the
traditional interaction between car users and service providers. However, despite the undeniable benefits and opportunities brought about by connected vehicles, they raise significant privacy risks and concerns. Analysis of the information that consumers receive at point of sales (Mystery Shopping). For the purpose of complementing the research on the degree of consumer awareness with regard to vehicle data, four ‘Mystery shopping’ (“MS”) exercises were conducted at different vehicles’ point of sales. The ultimate goal of the MS exercises was to evaluate the level and transparency of information provided to consumers at the vehicle points of sales. Overall, the MS exercises revealed a significant lack of information about vehicle data collection and processing at the point of sales visited. While some information about vehicle connectivity is provided at the point of sale, this information exclusively concerns the connectivity functionalities available and the related user’s experience. However, it does not cover the implications of such functionalities, i.e., the underlying vehicle
The approved insurance broker to the Scottish Motor Trade Association
data processing. In the best-case scenario, limited information about vehicle data processing aspects was provided but only after inquiring by the person conducting the exercises (“Mystery Shopper”). Even in these cases, the sales representatives were reluctant, unwilling or unprepared to provide general information about vehicle data processing or elaborate on any of the questions raised.
Expert study on : ‘GDPR applica in the context tion of car connec tivity’
Final Report November 2021
Read the full GDPR study