{"id":3222,"date":"2016-05-19T05:04:17","date_gmt":"2016-05-19T04:04:17","guid":{"rendered":"http:\/\/www.cr-online.de\/blog\/?p=3222"},"modified":"2016-05-19T08:53:59","modified_gmt":"2016-05-19T07:53:59","slug":"car-sharing-privacy-issues-under-current-european-law-and-under-the-gdpr","status":"publish","type":"post","link":"https:\/\/www.cr-online.de\/blog\/2016\/05\/19\/car-sharing-privacy-issues-under-current-european-law-and-under-the-gdpr\/","title":{"rendered":"Car Sharing: Privacy Issues under current European law and under the GDPR"},"content":{"rendered":"

(Speech, ITechLaw World Technology Conference, Miami, May 19th, 2016)<\/em><\/p>\n

    \n
  1. The rise of car sharing services<\/strong><\/li>\n<\/ol>\n

    Car sharing is becoming more and more popular since big auto maufacturers like BMW and Mercedes have entered the market offering brandnew cars and the opportunity to locate and book the cars via user-friendly smartphone apps.<\/p>\n

      \n
    1. Car sharing services rely on data<\/strong><\/li>\n<\/ol>\n

      Car sharing services like Car2Go (Mercedes\/Smart) and DriveNow (BMW\/Mini) heavily rely on data. The cars are located by GPS and every movement of the cars is tracked. Car2Go and DriveNow cars are truly smart.<\/p>\n

        \n
      1. Usage and location data\u00a0are constantly collected and stored<\/strong><\/li>\n<\/ol>\n

        On a continuous basis, car sharing services collect and store:<\/p>\n

          \n
        • usage data:<\/span> the start time and the end time of each use;<\/li>\n
        • location data:<\/span> the location is constantly monitored\u00a0via GPS.<\/li>\n<\/ul>\n

          The usage data is essential for payment as payment would normally be based on time rather than on distance. Because the customer usually pays by the minute, information about the time used needs to be collected and stored.<\/p>\n

          In general, the customers would only be allowed to use the cars within a designated area. In particular, customers would normally not be allowed to leave the city in which the car is located. Location data gives the service provider the opportunity of controlling the exact location of the cars and the compliance with the rules of their use.<\/p>\n

            \n
          1. Location data is widely regarded as highly sensitive PII<\/strong><\/li>\n<\/ol>\n

            Location data as well as usage data clearly constitute personal identifiable information (PII). Many privacy advocates would argue that data on the movements of a person are highly sensitive information requiring a high standard of protection.<\/p>\n

            According to the German Data Protection Act, the processing of such personal information requires<\/p>\n

              \n
            • either customer’s consent<\/span> or<\/li>\n
            • a statutory provision<\/span>\u00a0permitting such processing.<\/li>\n<\/ul>\n
                \n
              1. Consent is tricky now<\/strong><\/li>\n<\/ol>\n

                In an ideal world, the car sharing service providers would ask their customers for consent, and the customers\u2019 consent would be a sound and reliable basis for processing the data.<\/p>\n

                However, in the real world things are not quite that simple as consent needs to be both<\/p>\n

                  \n
                • voluntarily given<\/span> and<\/li>\n
                • informed<\/span>.<\/li>\n<\/ul>\n

                  Moreover, under the German Data Protection Act, consent would normally need to be<\/p>\n

                    \n
                  • in writing<\/span>.<\/li>\n<\/ul>\n

                    Therefore, the hurdles are high:<\/p>\n

                      \n
                    • Insufficient click of\u00a0a box:<\/strong>\u00a0 It would be too late<\/span> to let the customer give consent by clicking a box on the entertainment system. It would be debatable if this would be voluntary and informed, let alone written.<\/li>\n
                    • Initial contract requirements:<\/strong>\u00a0 Consent would need to be given when the first contract with the customer is signed. The consent would need to be in writing<\/span>, and the service provider would need to provide the customer with detailed information on the type of data<\/span> that is processed and on the purposes of the processing<\/span>.<\/li>\n<\/ul>\n
                        \n
                      1. Consent will not get any easier with the GDPR<\/strong><\/li>\n<\/ol>\n

                        Once the GDPR comes into effect, obtaining valid consent will not become any easier:<\/p>\n

                          \n
                        • Validity:<\/strong>\u00a0 According to the GDPR, consent needs to be \u201cunambiguous\u201d<\/span> but not in writing. It will, therefore, be easier to argue that click-box consent is valid.<\/li>\n
                        • Market power:<\/strong>\u00a0 However, the GDPR regards consent \u2013 as a rule – as invalid when there is a \u201cclear imbalance\u201d<\/span> between the controller and the data subject. And it is hard to argue that the obvious imbalance between a customer and BMW or Mercedes is not \u201cclear\u201d.<\/li>\n
                        • Necessity for performance:<\/strong>\u00a0 Moreover, the GDPR regards consent \u2013 as a rule \u2013 as invalid when it is obtained in connection with a contract but not limited to data \u201cnecessary\u201d for the performance of the contract<\/span>. In connection with contracts, consent will, therefore, not be a realistic option any more.<\/li>\n
                        • Right of Withdrawal:<\/strong>\u00a0 Last but not least: Under the GDPR, the customer may withdraw consent at any time<\/span> with immediate effect. Consent will, therefore, not be a reliable basis for the processing of data any more.<\/li>\n<\/ul>\n
                            \n
                          1. Contract data processing<\/strong><\/li>\n<\/ol>\n

                            Both under existing European data protection laws and under the GDPR, data may be processed if the processing is necessary for the performance<\/strong> of the contract.<\/p>\n

                            The usage data needs to be collected in order to work out the price of the journey. Without information on the time the journey has taken, it would be impossible to calculate the per-minute-price. Therefore, the usage data may be processed<\/strong>, see\u00a0Art. 6 (1) lit. b GDPR.<\/p>\n

                            However, usage data needs to be deleted<\/strong> as soon as the customer has \u2013 irrevocably – paid the bill.<\/p>\n

                              \n
                            1. Legitimate interests<\/strong><\/li>\n<\/ol>\n

                              Both under existing European data protection laws and under the GDPR, the collection and processing of location data can be justified by \u201clegitimate interests\u201d of the service provider<\/strong>:<\/p>\n

                                \n
                              • Locating:<\/strong>\u00a0 There clearly is a \u201clegitimate interest\u201d to be able to monitor \u2013 by GPS \u2013 the exact location of a car.<\/li>\n
                              • Monitoring:<\/strong>\u00a0 As the cars may only be used in a \u201cdesignated area\u201d (e.g. city of Berlin), the service Provider has a \u201clegitimate interest\u201d to be informed immediately when a cars is moved outside that area.<\/li>\n
                              • Storing location data:<\/strong>\u00a0 There is also a \u201clegitimate interest\u201d to store location data for a short period of time in case there was an accident or the car was damaged. Location data may help the service provider to etablish legal claims or defend himself against such claims,<\/li>\n
                              • Deleting Location data:<\/strong>\u00a0 Once it is clear that there was neither an accident nor damage, the location data must be deleted (advice in Germany: deletion within 7 days as this is the period held to be reasonable in similar cases).<\/li>\n<\/ul>\n
                                  \n
                                1. GDPR: The \u201cright to object\u201d may make life harder<\/strong><\/li>\n<\/ol>\n

                                  When data is processed on the basis of \u201clegitimate interests\u201d (Art. 6 (1) lit. f GDPR), the data subject has the right to object (Art. 21 GDPR). After the right to object is exerted, data may only continue to be processed when<\/p>\n

                                    \n
                                  • Nature of controller’s interest:<\/strong>\u00a0 the \u201clegitimate interest\u201d of the controller is \u201ccompelling\u201d<\/span> or<\/li>\n
                                  • Procedural necessity:<\/strong>\u00a0 processing is necessary for the establishment, exercise or defence of legal claims<\/span>.<\/li>\n<\/ul>\n

                                    While the \u201cright to object\u201d will generally not make the life of controllers easier under the GDPR, car sharing service providers will be able to argue that they have to have location data in connection with possible \u201clegal claims\u201d.<\/p>\n","protected":false},"excerpt":{"rendered":"

                                    (Speech, ITechLaw World Technology Conference, Miami, May 19th, 2016) The rise of car sharing services Car sharing is becoming more and more popular since big auto maufacturers like BMW and Mercedes have entered the market offering brandnew cars and the opportunity to locate and book the cars via user-friendly smartphone apps. Car sharing services rely […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1,34,9,51],"tags":[569,570,504,515,158,568,21],"_links":{"self":[{"href":"https:\/\/www.cr-online.de\/blog\/wp-json\/wp\/v2\/posts\/3222"}],"collection":[{"href":"https:\/\/www.cr-online.de\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cr-online.de\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cr-online.de\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cr-online.de\/blog\/wp-json\/wp\/v2\/comments?post=3222"}],"version-history":[{"count":3,"href":"https:\/\/www.cr-online.de\/blog\/wp-json\/wp\/v2\/posts\/3222\/revisions"}],"predecessor-version":[{"id":3225,"href":"https:\/\/www.cr-online.de\/blog\/wp-json\/wp\/v2\/posts\/3222\/revisions\/3225"}],"wp:attachment":[{"href":"https:\/\/www.cr-online.de\/blog\/wp-json\/wp\/v2\/media?parent=3222"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cr-online.de\/blog\/wp-json\/wp\/v2\/categories?post=3222"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cr-online.de\/blog\/wp-json\/wp\/v2\/tags?post=3222"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}