<\/p>\n
Paris-based Anne-Sophie Mouren<\/a> of Pinsent Masons, who specialises in data protection law, was commenting after Commission nationale de l’informatique et des libert\u00e9s (CNIL) set out final recommendations<\/a> (60-page \/ 1.56MB PDF, in French) on how businesses can use location data from connected vehicles. The guidance focuses on the use of connected vehicles by private individuals, whether as owners or hirers. The CNIL made clear that it does not cover the use of company cars or service vehicles made available to employees by their employers.<\/p>\n Location data is information that records the geographic position of connected devices. Because those devices \u2013 including vehicles \u2013 are commonly associated with individuals, it can reveal where a person is or where they have been, and in turn provide an insight into a person\u2019s habits, interests and activities. As a result, location data can constitute personal data, the processing of which in the EU is subject to the rules in the General Data Protection Regulation (GDPR).<\/p>\n Under the GDPR, \u2018controllers\u2019 are mainly responsible for the processing of personal data, but businesses that process the data on a controller\u2019s behalf \u2013 \u2018processors\u2019 \u2013 also face specific legal obligations under the regulation, on top of contractual requirements imposed by controllers.<\/p>\n Mouren said: \u201cIn the context of a connected vehicle, many different businesses may have a role to play in the processing of location data. Those businesses might include the car manufacturer, the fleet manager, maintenance or assistance providers, data aggregators and integrators, telematic solutions suppliers and insurers. The CNIL goes into specific details and provides practical examples to clarify who qualifies as a controller or processor and when.\u201d<\/p>\n \u201cThe guidance also addresses the legal basis on which location data can be processed and the conditions under which data subjects\u2019 rights should be handled. It also states that the purpose of the processing should determine whether vehicle location tracking is activated, and to what extent it is activated, and addresses how long location data should be retained for,\u201d she said.<\/p>\n \u201cAlthough the document is not exhaustive, it will help the industry understand the CNIL\u2019s rationale and apply its reasoning to their specific situation,\u201d Mouren added.<\/p>\n Personal data can only be processed on specific grounds, each of which the GDPR refers to as a \u2018lawful basis\u2019. Consent is one possible lawful basis, but there are others too. The CNIL said it may be possible to process location data on the basis that it is necessary for the performance of a contractual service provided to the data subject. It gave examples in its guidance.<\/p>\n For example, it said that the contractual basis could apply to the processing of location data for the purpose of combating theft if the vehicle user has entered into a contract or an optional contractual clause specifically for this purpose \u2013 such as if the contract provides for vehicle tracking to enable it to be located in the event of theft. The CNIL said, though, that the processing of location data cannot be based solely on the contract of sale for the vehicle, as this processing is not objectively necessary for the supply of the goods.<\/p>\n The CNIL also advised that, in general, the processing of location data should take place locally, within the vehicle or the device connected to the vehicle, where feasible, with only certain events \u2013 like a breakdown \u2013 triggering its transmission to a controller\u2019s servers.<\/p>\n Automotive companies should also provide for the segregation of location data uploaded to their systems, so that if there is a breach of the confidentiality of data in one part of the system it does not directly result in the loss of confidentiality of data in another part.<\/p>\n The CNIL recommended the use of separate databases, permissions, views or controls in respect of location data from connected vehicles, such as differentiated authorisation profiles and access rights per client and processing purpose. It also said consideration should be given to segregation according to the risks associated with the location data and by purpose of processing, with the latter aimed at ensuring compliance with the \u2018data minimisation principle\u2019 that applies under the GDPR. This requires organisations to ensure that their processing is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.<\/p>\n","protected":false},"excerpt":{"rendered":"
Paris-based Anne-Sophie Mouren of Pinsent Masons, who specialises in data protection law, was commenting after Commission nationale…\n","protected":false},"author":2,"featured_media":542609,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[114,85,46],"class_list":["post-542608","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-business","tag-il","tag-israel"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/542608","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/comments?post=542608"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/posts\/542608\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media\/542609"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/media?parent=542608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/categories?post=542608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/il\/wp-json\/wp\/v2\/tags?post=542608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}