In a recent study, the tech company Mozilla concluded that modern cars have become a "privacy nightmare. This is due to the aggressive collection of personal data through those smart cars without regard for security and privacy. Menno Weij, partner tech & privacy law at BDO Tax & Legal, explains to the editors of PONT | Data & Privacy some points of interest around this issue.
"The short answer is that cars have now become software on wheels. That means they process data, and that happens in all sorts of ways. Consider, for example, the cameras that scan hazards in front and behind the car, or how the software intervenes the moment it thinks the driver is not paying attention. And, of course, personal data is also processed."
"Driving behavior, camera footage and audio recordings, both inside and outside the car, are all data that are linked to me. So directly or indirectly traceable. Therefore, these are simply personal data for which processing basis is required under the AVG."
When phone apps process personal data, a privacy policy explains to you what happens to the data collected so that you can decide whether you want to continue using the app or not. Is there similar transparency in the smart car purchase process?
"Suppose I buy a car from a local dealer in the Netherlands. A good example, besides American tech giants, are Chinese electric cars that are full of software. The moment I buy that car and sign the contract, there should be a warning like 'beware, there is something about privacy.' The local dealer should make sure that if the car manufacturer wants to process certain data about me, I am aware of it and can give voluntary consent if this is the legal basis. This is similar to the 'MediaMarkt model'."
"If you buy an Apple phone from MediaMarkt, MediaMarkt has to make sure you agree to the manufacturer Apple's warranties and terms. This becomes even more complex when buying a car. When I first sit in the car, the dealer explains how your radio works, how to pair your phone, and so on. At that point, as a consumer, I really shouldn't have to pay attention to privacy questions myself, but the dealer should make sure this happens. When another link comes in between, as with leased cars that my company provides to employees, it gets even more complicated. Who exactly is responsible for what then? That's why I do see a challenge here."
"You see car manufacturers still tend to invoke their legitimate interest to justify most data processing. For example, they argue that the processing is necessary to ensure the safety of the car. The question is what processing they can hang under that. Information about someone's sexual orientation, for example, has nothing to do with product safety. But even when it comes to more basic categories of personal data, such as gender and age, this remains a concern. Moreover, we must also take into account the fact that it is not just about the driver's data, but also that of passengers and people who may borrow the car. To what extent then can they stretch the importance of security?"
"First of all, I hope European regulators and the European Data Protection Board have seen this research. In any case, parties without an EU establishment but doing business in the EU are obliged to comply with the AVG because they process data of Europeans. Under Article 27 of the AVG, they also have an obligation to appoint a representative based in one of the EU member states. There is some discussion about the possible liability of these representatives in case of violations of the AVG by the represented (read: the car manufacturers), but in principle this construction should solve the problem of oversight."
"If, as a car owner, you have concerns about the data being processed about you, you can always submit a request for access and possibly raise it further with the Personal Data Authority (AP) if you can't work it out. Furthermore, I would not be surprised if privacy organizations or the Consumers' Association make future calls for car owners to join a mass claim against these companies."
"I can assure you one thing. If I tell him that the manufacturer of our car is collecting data on him, he is going to laugh very hard. The new generations don't seem to care so much about privacy..."
