In brief
- Regulation: GDPR.
- Manufacturers and providers of embedded services are concerned as controllers or joint controllers.
- Distribute roles.
- Ground every processing activity.
- Governing geolocation.
- Fines of up to €20M or 4% of global annual turnover.
Regulatory deadlines
The key dates of this regulation.
May 2018
Entry into application
In forceWhat does GDPR cover?
GDPR applies to all data that can be linked to the driver or owner: location, habits, and diagnostics tied to an individual. The multiplicity of stakeholders (manufacturers, connected service providers, insurers) makes it essential to clarify the roles of controller, joint controller, and processor.
Geolocation, due to its sensitivity, requires a solid legal basis and enhanced information provision.
Is the 'Automotive' sector affected?
Manufacturers and embedded service providers are concerned as controllers or joint controllers. Third parties accessing data (insurers, repairers via the Data Act) are concerned for their own processing activities.
The Data Act opens access to data; GDPR governs its use when that data is personal.
Detailed obligations
Distribute the roles
Clarifying, between the manufacturer, service providers and third parties, who is controller, joint controller or processor.
Ground every processing activity
Define a legal basis for each purpose (diagnostics, connected services, product improvement) and provide clear information to users.
Govern geolocation
Handle location data with particular vigilance: minimisation, transparency, and user control.
Control retention periods
Apply retention periods suited to the different categories of vehicle data.
Secure
Implement encryption, access control, and data flow security between the vehicle and servers.
Sanctions & risks
Fines of up to €20M or 4% of global turnover. Geolocation and driver profiling are subject to particular scrutiny by authorities.
Excessive collection of vehicle data, without a clear legal basis or clear information provided, is a major risk in the sector.
Common mistakes in the sector
- 1Excessive collection. Collecting more data than necessary from the vehicle.
- 2Unclarified roles. Leaving the allocation of responsibilities between actors unclear.
- 3Poorly governed geolocation. Processing location data without an adequate legal basis or proper information.
- 4Neglected flow security. Failing to secure communications between the vehicle and servers.
Practical case
A connected service was continuously collecting precise location data without clear information or any opt-out option. Following analysis, the manufacturer limits collection to what is strictly necessary, explicitly informs the driver, gives them control over geolocation, and clarifies the allocation of roles with the service provider.
Compliance roadmap
- 1
Map. Inventorying vehicle data and its personal-data status.
- 2
Clarify roles. Formalising the allocation of controller / joint controller / processor roles.
- 3
Govern geolocation. Define legal basis, information notices, and user control.
- 4
Define retention periods. Set retention periods by purpose.
- 5
Secure. Strengthen the security of data flows and servers.
Frequently asked questions
Yes when it can be linked to the driver or the owner; it is even one of the most sensitive categories.
Take action on GDPR
Free assessment or a chat with an expert dedicated to automotive.
They already trust us
See how organisations in the automotive sector secured their compliance with DCO.