Guidelines 1/2020 on processing personal data in the context of connected vehicles and mobility related applications
Paragraph 3.5.4 Security
177. Rental companies shall ensure that the permissions setting on the rental car’s dashboard is compliant with the principle of privacy by design and by default (having settings that prevents third parties from processing data generated by the car’s dashboard unless they have the user’s consent to enable third party access to that data for a specified purpose).