Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications

Paragraph 3.4.1  Legal basis

158. When the data is collected through a publicly available electronic communication service, art. 5 (3) of the “ePrivacy” directive applies.

159. Because this is an information society service, art. 5 (3) of the “ePrivacy” directive does not require consentfor gaining access to information that is already stored in the vehicle when such a service is explicitly requested by the subscriber.

160. Regarding the processing of personal data the legal basis is the consent of the vehicle’s owner, or, if applicable, the performance of a contract (only for data necessary for the performance of the contract to which the vehicle’s owner is party).

161. Consent shall be an expression of the free, specific, and informed will of the person whose data are being processed (e.g., ticking a box that is not pre-ticked, or configuring the onboard computer to activate a function in the vehicle). Freedom to give consent involves the option of withdrawing consent at any time, of which the data subject shall be expressly informed. Withdrawal of consent shall lead to the processing being stopped. The data shall then be deleted from the active database, anonymised, or archived.