Norway: New standard document on connected cars and privacy
Working together with the association of Norwegian car distributors, the Norwegian Data Processing Authority has recently developed an agreed standard document which is to be filled out by the car distributor together with the customer in connection with the sale of a car. The purpose of the form is to make the customer aware of the types of personal data that is being collected, the purpose of such collection and on whether the information is transferred to any third parties. The document further states that personal data may only be processed where there are legal grounds for processing. The document does not, however, seek to obtain customer consent for the processing.
The types of personal data described in the document, are GPS data, i.e. location data collected through the GPS system, GSM data, i.e. location data collected through the mobile telephone network, data collected through emergency calling systems, i.e. systems making automatic calls in the case of traffic accidents, systems on driving behaviour, i.e. on accelerations, breaking, selection of driving mode and the use of seat belt, and finally data collected by other emergency systems, such as automatic emergency breaking, lane control, automated driving etc.
The types of data usage described in the document are as follows: Product development, diagnosis, and notification of a need for repairs or warranty claims.
Finally, the document should include a statement on whether the data is transferred to any third party, including the car manufacturer.
The main objective of the document is clearly to inform the car buyer about the extent of the personal data processing which is automatically carried out by the car. However, the document does not solve all issues related to the personal data processing carried out by modern, connected cars.
First of all, the document does not take into account the fact that data transfers are frequently done through the mobile telephone network directly to the car manufacturer, usually located outside of Norway. High-end cars will often be connected to the mobile telephone network through a dedicated SIM card, hardwired into the car. The standard document seems to be based on the assumption that all data is transferred to the car distributor, who will then as the controller decide on which data can legally be transferred to the manufacturer. In my experience, this type of data flow is no longer in line with what car manufacturers are doing, at least within the high-end segment.
Secondly, the document does not give the customer the option of giving his or her consent to the data processing, and, more importantly, to refuse to give or to withdraw such consent. Although many of the data uses are vital for the operation of the car, such as data pertaining to mechanical status or needed repairs, connected cars will frequently offer services which, although beneficial to the owner's use of the car, are not vital services and the owner should be given a free choice on whether to employ each service. Examples of such services are car locating services, where the manufacturer stores the location of the car to assist the driver in finding the car, tracking services in cases where the car is used by family members or other drivers other than the owner, or if the car has been stolen. Under Norwegian law, many such services would require the consent of the user.
Thirdly, the document seems to be based on the assumption that the reseller is the controller for all processing of personal data relating to the car. For many add-on services as described above, the controller will rather be the car manufacturer, delivering the services directly to the customers, however no information on this is given in the document. It is unclear how information on such add-on services is to be given to the customer, and on how any necessary consent is intended to be obtained.
Finally, the document does not take into account that car repairs (and read-out of data from the car) is not necessarily done by the original car reseller, as the owner will be free to select another service provider for any necessary services or repairs. This means that any information given on the reseller's intended processing of the data may not be accurate for the service provider selected by the car owner. Also, cars are frequently sold privately from one individual to another, and any buyer of a second-hand connected car would not necessarily receive the information as intended.
Article published by: Øystein Flagstad, Grette, Norway
Discover more about the Cloud Privacy Check(CPC) / Data Privacy Compliance(DPC) project
CPC project office: Dr. Tobias Höllwarth, tobias.hoellwarth@eurocloud.at