Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications

Paragraph 3.5.1  Data collected

171. A variety of data can be processed in rental cars’ dashboard. Those data could be processed:

•  − when a data subject’s smartphone is paired with the rental car’s dashboard, for instance using Bluetooth or USB connections (phone identifiers, voice and data communications, etc.) ;

• − when the driver or the passenger use the rental cars’ dashboard (GPS navigation history, web browsing, and a growing range of applications).

172. Hence, the data generated can reveal personal information (web browsing data, personal contacts and schedules, choice of music, radio and other streamed audio or video content, etc.) and help to draw a precise profile of the data subject.

173. Since rental companies have effective control over the processing, they should be regarded as the data controller of the information, which resides on the car’s dashboard they rent. As such, they have the responsibility to ensure the confidentiality of the data and compliance with data protection requirements.