Answers to chamber questions on the article 'Automotive sector does not meet strict privacy standard'

I hereby answer the written questions of members Schonis and Verhoeven (both D66) on the article "Automotive sector does not meet strict privacy standard.

I am also sending you, also on behalf of the State Secretary for Economic Affairs and as promised in the AO Digitalization of Wednesday, March 11, 2020, the report on vehicle data sharing and interfaces delivered on January 27, 2020.

The report concludes that the automotive sector is changing rapidly due to trends such as automation, connectivity, electrification, and the change from ownership to use through the emergence of (sharing) platforms. The report has not been able to answer all the questions raised by these trends, but it does provide insight that these trends will continue in the coming years and in the process will drastically change the industry. Access to vehicle data and interfaces is an important and complex issue, with major interests for both automakers, suppliers and aftermarket companies such as service providers, maintenance companies, insurers and leasing companies. In addition, consumer interests increasingly demand attention.

The report has five lines of advice:

• The consumer must be at the center of buying, leasing, using vehicles, including through transparency around the use of vehicle data.

• Exploit opportunities provided by revisions to existing EU legislation (i.e. the MV-TAR and MV-BER) to ensure access to vehicle data for maintenance and repair, among other purposes.

• Optimize the implementation of existing regulations, including by providing insight and assessing bottlenecks from practice.

• Encourage cooperation between and by market participants, as, for example, is now being done in Europe as part of the Data Task Force.

• Investigate options for additional regulation, e.g., third party access to data for new mobility services.

Together with the State Secretary for Economic Affairs, I will elaborate on these recommendations in the coming period and take them up with the sector and relevant regulators. I believe it is important that actions are based on practical obstacles. To this end, I will open a hotline where the sector can report concrete bottlenecks so that supervisors can also investigate these in more detail.

Question 1

Are you familiar with the article 'Auto sector does not meet strict privacy standard'

Answer 1

Yes.

Question 2

Is it true that in many cases the automotive sector is not complying with the General Data Protection Regulation (AVG)? What is the reason for this?

Answer 2

The differences among car manufacturers are great. There are manufacturers who have been collecting data for several years and some where this is not (yet) happening or hardly happening at all. It is important that the privacy of users is properly safeguarded when using these new techniques. The Autoriteit Persoonsgegevens AP), Autoriteit Consument & Markt (ACM) and the sector are therefore committed to this. See also answers to questions three, six and eight.

Several studies, from the ANWB and its German counterpart ADAC, among others, express concerns about privacy at various car brands.1 As you were previously notified, the Ministry raised these developments with the Autoriteit Persoonsgegevens (AP) in June 2018. At the time, the European Data Protection Board (EDPB) was still in formation and this issue was later added to its priorities.

The AP has indicated that it is receiving limited signals about 'connected vehicles' at this time. They have opted for a package of targeted measures consisting of informing owners/drivers of 'connected vehicles' on the one hand and addressing manufacturers and dealers on the other.

In order to inform owners/drivers of connected vehicles of their rights, the AP has prepared a manual that provides guidance on how to exercise these rights.2 Under the AVG, it is possible in the first instance to address the data controller, i.e. the manufacturer, also with respect to the transparency required under the AVG with respect to processing operations. If rights of owners/managers are insufficiently fulfilled by manufacturers/dealers, complaints can be reported to the AP.

In addition, the AP also addresses manufacturers and dealers who sell cars. Because many manufacturers are based outside the Netherlands, where the AP is not a lead regulator, it is necessary to coordinate on this at the European level as well. From the EDPB, this has resulted in guidelines that make the AVG concrete with respect to connected vehicles3. In February 2020, the AP notified manufacturers based in the Netherlands of these guidelines, and asked for their processing register: the mandatory overview of data processing, containing information on, among other things, the types of data the manufacturer processes, the purposes of such processing and the retention periods of that data.

Question 3

How do you assess the effectiveness of AVG enforcement for automakers?

Answer 3

The AP is the regulator that promotes and monitors the protection of personal data. That means, on the one hand, that the AP has a task in informing manufacturers and consumers. In terms of that education, the AP has taken important steps with the aforementioned EDPB Directive and the aforementioned manual. In addition, the AP is responsible for enforcement of the AVG. The survey started by the AP among vehicle manufacturers and the expected increase in privacy awareness among consumers may lead to targeted signals about violations of the AVG, on which the AP can take action.

In addition, the AP indicates that to date it has received limited signals and complaints from practice. Here, the international component is very important: most vehicle manufacturers are not based in the Netherlands, but have their European headquarters in another EU country. This means that in investigations into manufacturers, the AP itself will often not be the lead regulator, but another European regulator will take the lead. This requires good cooperation between the responsible regulators regarding the transmission of signals and complaints.

Question 4

Is it true that this also involves special personal data? In what way does the Dutch government oversee careful handling of the car driver's privacy data by the car manufacturer?

Answer 4

There are conceivable examples where special personal data would be involved. For example, if location data shows how often someone drives to a hospital, that is special personal data. Special personal data enjoy extra protection, to the extent that the starting point is that processing of special personal data is prohibited. The AP monitors this under the AVG and responds, for example, to complaints and signals.

Question 5

When can the House of Representatives expect the results of the additional research on this issue that you announced in your response to previous written questions from the questioners?

Answer 5

I hereby send you the results of the survey.

Question 6

Do you share the opinion that data should only be shared after explicit consent of the user and not, as in the case of Tesla, by means of an opt-out afterwards? If not, why not?

Answer 6

Despite the potential that vehicle data has in terms of, for example, making our traffic safer and better flowing, it is paramount that the data used is in accordance with applicable legislation for processing personal data. The AVG sets out conditions for this. Explicit prior consent is one of them. So this involves so-called opt-in, not opt-out, as in the example described above. In the EDPB guidelines released on January 28, 2020, this explicit consent is stipulated as a condition. It is up to manufacturers and dealers themselves to figure out how that consent will be specifically regulated.

It is known from previous investigations (see question 2) that not only the manufacturer you cited, but also other manufacturers process personal data, but that it may not yet be clear to every owner/driver that this is happening. Thus, manufacturers may have work to do with regard to providing transparency before consent can be given at all in a manner required by the AVG. For example, owners and directors must at least be able to make an informed choice, and that choice must also be free.

Question 7

Do you agree that car owners should be able to decide at any time whether or not to share data? Are you willing to enter into discussions with car manufacturers about this?

Answer 7

Privacy is an important public value, and there is ongoing conversation with industry about connected vehicles and the safe use of these technologies. The AVG stipulates that citizens have the right to withdraw previously given consent for processing personal data. The AVG and the EDPB's guidelines provide clear frameworks for car manufacturers in this regard. Supervision of compliance with the AVG lies with the aforementioned bodies.

Question 8

What do you advise car drivers when buying a car? Do you understand that the Consumers Union is now warning its members about the consequences of sharing data to automakers?

Answer 8

The duty of care to properly inform car drivers lies with the car manufacturers and dealers. For consumers, this information must be available and understandable. The aforementioned guide can help increase consumer awareness of this. It will be made available digitally and disseminated through news releases.

Question 9

Do you agree with the questioners that it is an undesirable situation for consumer organizations to have to warn consumers about automakers' data hunger? If not, why not?

Answer 9

There should be no need to warn consumers in this way. Privacy and the protection omrent personal data is extremely important. The first move is for manufacturers and dealers to fulfill the requirement of transparency regarding the processing they do. This should lead to a clear and transparent story. Should there be complaints and signals from practice that this does not happen to a sufficient extent, the approach of the relevant supervisory authorities will follow. The complexity of vehicles both on data services but also on driver assistance systems is increasing. In addition to the formal process, the Ministry will soon start an exploration to achieve better consumer information on these functions when buying a new or used car. This will involve cooperation with the industry, which has a major responsibility in this regard.

Question 10

Is it true that (some) dealers receive bonuses to persuade customers to share data? To what extent is this practice consistent with the guideline

'Protecting online consumers' by the Autoriteit Consument & Markt (ACM)? If not, what steps are you taking to stop this practice?

Answer 10

Inquiries with the industry reveal that brand organizations use so-called "dealer standards," or a set of agreements as part of the dealer contract that dealers have to abide by as representatives of the brand.

Usually, a bonus structure is also part of the agreements, which, incidentally, can vary from brand to brand. Important components in the bonus structure are the number of vehicles sold in a period of time, customer satisfaction and the way the dealer fulfills the so-called "dealer standards.

Concrete evidence that dealers, or employees, receive bonuses specifically to persuade customers to share their data is unknown to both the industry and the AP. Based on the guideline "Protecting Online Consumers," companies must clearly indicate online whether and if so in what way collected data leads to a particular offer for the customer, especially if that offer is personalized. Failure to do so could constitute a deceptive trade practice. Whether it does depends on the circumstances of the case. It is not clear a priori that such a commercial practice exists in this example.

The AP argues that both a manufacturer and dealer guilty of this are in violation of the AVG. In that regard, the AP points out that "data trading" is a spearhead of the AP's strategy. Should the AP receive signals, these will have special attention and may lead to enforcement action.

Sincerely,

THE MINISTER OF INFRASTRUCTURE AND WATER MANAGEMENT,

drs. C. van Nieuwenhuizen Wijbenga

This policy can also be found in the AVG file