Why vehicle networking affects data protection

According to various studies, sectors such as logistics and transportation benefit in particular from vehicle connectivity: "One sector that has been an early adopter of vehicle connectivity for economic reasons is the logistics industry. By tracking fleets in real time, routes can be optimized and payloads can be planned at short notice; connectivity can also support a more efficient driving style for each individual driver in order to minimize wear and tear and fuel costs," according to the BVDW (Bundesverband Digitale Wirtschaft) discussion paper "Connected Cars", for example.

Vehicle tracking becomes people tracking

When it comes to studies on connected cars and vehicle networking, security and data protection are always discussed. In fact, both vehicle users and companies have certain concerns that security could suffer as a result of vehicle connectivity. The concern is that conceivable disruptions to IT systems could also lead to vehicle malfunctions due to integration with vehicle technology. But what does the networking of vehicles have to do with the protection of personal data, with data protection?

Data protection comes into play because the vehicles are linked to information about their users. The dispatcher has information about who is driving a particular vehicle. If the moving vehicles are tracked, the current locations of the drivers are also known. Vehicle tracking thus becomes personal tracking.

As the data protection supervisory authorities clarify, freight forwarders are generally allowed to locate their vehicle fleet in order to track goods. Such tracking purposes, which are obviously in the legitimate interest of the company, are generally permitted. However, companies must comply with various data protection requirements if they also store driver data.

Inform employees, prevent secret tracking

As a rule, the location of employees does not require consent, but employees must be informed. Secret tracking of employees is prohibited, as is the collection of location data outside of working hours. However, the increasing networking of vehicles goes beyond GPS tracking of vehicles. Logistics and transport companies should therefore scrutinize all processes that collect and evaluate vehicle data that can be linked to drivers.

Data protection requirements for connected vehicles

The federal and state data protection authorities and the German Association of the Automotive Industry (VDA) have jointly drawn up a declaration on "Data protection aspects in the use of connected and non-connected vehicles". It sets out clear requirements that affect not only the automotive industry, but also companies that operate a vehicle fleet and provide employees with vehicles for use. The requirements include

• Data processing in and around the vehicle must be based on the principle of data avoidance and data minimization.
• Drivers must be guaranteed complete transparency. Those affected must also be able to inform other users (e.g. passengers).
• Drivers must be technically and legally capable of recognizing, controlling and, if necessary, preventing data transfers.
• Finally, suitable technical and organizational measures must ensure data security and data integrity. This applies in particular to data communication from the vehicles.

Companies must therefore closely network data protection with scheduling - just as vehicles are increasingly networked with IT and the Internet.