Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications

Paragraph 1.5.2  Quality of the user’s consent

46. The EDPB underlines that, when the data processing is based on consent, all elements of valid consent have to be met which means that consent shall be free, specific and informed and constitutes an unambiguous indication of the data subject’s wishes as interpreted in EDPB guidelines on consent. Data controllers need to pay careful attention to the modalities of obtaining valid consent from different participants, such as car owners or car users. Such consent must be provided separately, for specific purposes and may not be bundled with the contract to buy or lease a new car. Consent must be as easily withdrawn as it is given.

47. The same has to be applied when consent is required to comply with the “ePrivacy” directive, for example if there is a storing of information or the gaining of access to information already stored in the vehicle as required in certain cases by art.5 (3) of the “ePrivacy” directive. Indeed, as outlined above, consent in this context has to be interpreted in light of the GDPR.

48. In many cases, the user may not be aware of the data processing carried out in his/her vehicle. Such lack of information constitutes a significant barrier to demonstrating valid consent under the GDPR, as the consent must be informed. In such circumstances, consent cannot be relied upon as a legal basis for the corresponding data processing under the GDPR.

49. Classic mechanisms used to obtain individuals’ consent may be difficult to apply in the context of connected vehicles, resulting in a “low-quality” consent based on a lack of information or in the factual impossibility to provide fine-tuned consent in line with the preferences expressed by individuals. In practice, consent might also be difficult to obtain for drivers and passengers who are not related to the vehicle’s owner in the case of second-hand, leased, rented or borrowed vehicles.