Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications

Paragraph 3.4.4  Information of the data subjects

164. Prior to the processing of personal data, the data subject shall be informed according to art.13 GDPR, in a transparent and understandable way. More specifically, the EDPB recommends that the data controller emphasizes that there is no constant tracking of the vehicle and that location data can only be collected and transmitted as of the declaration of theft. Moreover, the controller must provide the data subject with information relating to the fact thatonly approved officers of the remote-surveillance platform and legally approved authorities have access to the data.

165. Regarding the rights of the data subjects, when the data processing is based on consent, the data subject must be specifically informed of the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Besides, when the data collected in this context are provided by them (through specific forms or through his or her activity) and processed on the basis of art. 6 (1) (a) (consent) or art. 6. 1. (b) GDPR (performance of a contract), the data subject is entitled to exercise his or her right to data portability. As emphasized in the guidelines on the right to data portability, the EDPB strongly recommends, “that data controllers clearly explain the difference between the types of data that a data subject can receive through the rights of subject access and data portability”.

166. Consequently, the data controller must provide an easy way to withdraw his consent (only when consent is the legal basis), freely and at any time, as well as develop tools to be able to answer data portability requests.

167. The information can be provided when the contract is signed.