Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications

Paragraph 3.2.1  Legal basis

130. Regarding the application of the “ePrivacy” directive, two provisions have to be considered:

• − art. 9 regarding location data other than traffic data which only applies to electronic communication services. ;

• − art. 5 (3) for the gaining access to information stored in the generator installed inside the vehicle.

131. Despite the fact that, in principle, those provisions require the consent of the data subject, regulation EU 2015/758 of 29 April 2015 constitutes a legal obligation to which the data controller is subject (the data subject has no genuine or free choice and will be unable to refuse the processing of his/her data). Hence, regulation EU2015/758 overrides the need of the driver’s consent for the processing of location data and the MSD.

132. The legal basis of the processing of those data will be compliance with a legal obligation as provided for in art. 6 (1) (c) GDPR (i.e., regulation EU 2015/758).