Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications

Paragraph 3.3.4  Information and rights of data subjects

153. Prior to the processing of personal data, the data subject shall be informed according to art.13 GDPR, in a transparent and understandable way. In particular, in the case of collecting instantaneous speed, the data subjects shall be specifically informed of the data collection. Since the data processing is based on consent, the data subject must be specifically informed of the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Moreover, because the data collected in this context are provided by the data subject (through specific forms or through his or her activity) and processed on the basis of art. 6 (1) (a) GDPR (consent), the data subject is entitled to exercise his or her right to data portability. As emphasized in the guidelines on the right to data portability, the EDPB strongly recommends,“that data controllers clearly explain the difference between the types of data that a data subject can receive through the rights of subject access and data portability”.Consequently, the data controller must provide an easy way to withdraw his consent, freely and at any time, as well as develop tools to be able to answer data portability requests.

154. That information can be given on signing the form to agree to take part in the accidentology study.