Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications

Section 2.4  Data protection by design and by default

68. Taking into account the volume and diversity of personal data produced by connected vehicles, the EDPB notes that data controllers are required to ensure that technologies deployed in the context of connected vehicles are configured to respect the privacy of individuals by applying the obligations of data protection by design and by default as required by art.25 GDPR. Technologies should bedesigned to minimize the collection of personal data, provide privacy-protective default settings and ensure that data subjects are well informed and have the option to easily modify configurations associated with their personal data. Specific guidance onhow manufacturers and service providers can comply with data protection by design and by default could be beneficial for the industry.

69. Certain general practices, described below, can also help mitigate the risks to the rights and freedoms of natural personsassociated with connected vehicles.