Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications

Section 2.6  Rights of the data subject

87. Vehicle and equipment manufacturers, service providers and other data controllers should facilitate data subjects’ control over their data during the entire processing period, through the implementation of specific tools providing an effective way to exercise their rights, in particular their right of access, rectification, erasure, their right to restrict the processing and, depending on the legal basis of the processing, their right to data portability and their right to object.

88. To facilitate settings modifications, a profile management system should be implemented inside the vehicle in order to store the preferences of known drivers and help them to change easily their privacy settings anytime. The profile management system in a vehicle should centralize every data settings for each data processing, especially to facilitate the access, deletion and removal of personal data from vehicle systems at the request of the data subject. Drivers should be enabled to stop the collection of certain types of data, temporarily or permanently, at any moment, except if a specific legislation provides otherwise or if the data are essential to the critical functions of the vehicle.

89. The sale of a connected vehicle and the ensuing change of ownership should also trigger the deletion of any personal data, which is no longer needed for the previous specified purposes.