Privacy & Data Protection in Smart Cars - EU & Italy

Privacy and Data Protection in Smart Cars From EU and Italy Perspectives UCL ALUMNI JOINT CHAPTER WEBINAR The Present and Future of Smart Cars - Law and Policy Date: 6th December 2023 Presented by: MS Valentina Torelli, CIPP/E, (Technology, Media and Telecommunications Law LLM, CCLS-QMUL and LLM, Universitas Degli Studi di Modena e Reggio Emilia, ML (IT, IP, Law, Universität d' Alicante), Lawyer in IP, IT and Data Protection Law. Smart Cars: Definition And Attributes Under EU And Italy Law  No definition of Smart Vehicles (Smart Cars)  IoT: The Directorate-General for Mobility & Transport (DG MOVE) and DG CONNECT are developing synergies between the European Data Strategy and the Sustainable and Smart Mobility Strategy, with a particular focus on the deployment of a common European mobility data space and connected and automated mobility.  C-ITS: Cooperative intelligent transport systems = connected systems in which information and communication technologies are applied in the field of road transport  Terminal equipment (Directive 2008/63/EC): Equipment directly or indirectly connected to the interface of a public telecommunications network to send, process or receive information; in either case (direct or indirect) the connection may be made by wire, optical fiber or electromagnetically; a connection is indirect if an equipment is placed between the terminal and the interface of the network.  ITALY: Smart Road Decree: definitions of Self-driving vehicle, smart road, cooperative systems V21 and V2V, connected driving.  Connected Vehicles are equipped with devices to communicate with other vehicles or infrastructure via the internet.  Autonomous Vehicles is fully automated vehicles equipped with the technologies capable to perform all driving functions without any human intervention. It uses digital technologies to assist the driver so that some or all driving functions can be transferred to a computer system Long-Range Radar 1. Emergency Braking 2. Adaptive Cruise Control LIDAR (Laser Scan) 1. Collision avoidance 2. Pedestrian detection Cameras 1. Surround view 2. Park assists 3. Traffic sign recognition 4. Lane departure warning Short/Medium-Range Radar 1. Cross traffic warning 2. Rear collision warning 3. Blind spot detection Ultrasound 1. Park assists Secure Communications 1. Protect data 2. Vehicle's functionality High Resolution Maps 1. Environmental info 2. Localization functionality 3. Interaction with sensors Algorithms / Al 1. Recognition 2. Reaction Legal framework for Data Protection in Smart Cars 1. Data Protection  GDPR (Regulation (EU) 2016/679)  E-PRIVACY Directive (2002/58/EC - revised)  National data protection laws (e.g. Code in matter of personal data protection Italy) 2. Data Security  NIS Directive ((EU) 2016/1148)  NIS 2 Directive ((EU) 2022/2555)  Cybersecurity Act (Regulation (EU) 2019/881)  National laws in matter of cyber security (e.g. NIS Legislative Decree no. 65/2018) 3. Soft Law  EDPB's guidelines and opinions  NSA's guidelines and opinions  ENISA's guidelines and recommendations 4. Employment Law 5. Sector Specific Law  Cooperative Intelligent Transport Systems (C-ITS) (Directive 2010/40/EU (consolidated)/Commission's Delegated Regulation)  Vehicle General Safety Regulation  E-Call in-vehicle system Regulation  art. 34 bis Vienna Convention on Road Traffic (1968) [14 July 2022] 6. Al Act (Proposal For A Regulation) EU Data Strategy (February 2020) Establishes a single market for data and relies on a set of 5 complementary actions: 1. Setting clear and fair rules on data access, use and governance across sectors; 2. Investing in next-generation tools and infrastructures to store and process data; 3. Joining forces to build a European federated cloud capacity; 4. Deploying common and interoperable data spaces in key sectors to help pool, share and re-use data 5. Developing competences by investing in digital skills, data literacy and capacity building in SMEs. Personal Data And Smart Cars: Data Collection And Processing Personal Data 1. Biography data, contact data 2. Biometric data 3. Location data 4. Special categories and judicial data 5. Preferences and habits related to driving 6. VIN -> CJEU: C-319/22 Data Subjects 1. Driver 2. Owner 3. Passengers 4. Other drivers, pedestrians, etc. Privacy Roles 1. Data controller 2. Joint controllers 3. Data processors 4. Manufacturer 5. Infotainment service providers 6. Electronic communication service providers 7. Insurances 8. Law enforcement authorities Legal Basis 1. Consent 2. Contract 3. Legitimate interest 4. Legal obligation Smart Cars: Data Protection And Security Concerns Data Protection Concerns  Identification of privacy roles  Third party relationship management  Identification of specified explicit and legitimate purposes of processing  Identification of the lawful bases  Information obligation  Consent collection & management  Data categories surveillance (location data); sensitive; judicial data  Data control and information asymmetry  Excessive data collection Data Security Concerns  Loss of data confidentiality, integrity, availability  Hacking and unauthorized access to data stored locally and/or in cloud  Data loss and/or destruction  Bugs for vulnerability exploitability  Reidentification of pseudonymize data  Compromise of encryption keys  Man-in the middle attacks  Identity theft Main Data Protection Compliance Aspects In Smart Cars 1. Privacy Principles 2. Grounds For Processing 3. Information Obligation 4. Appointments And Instructions 5. Data Processing & Transfer Agreements (DPAS/DTAS) 6. Data Subjects' Rights 7. Data Protection Impact Assessment (DPIA) 8. DPO Appointment 9. Adequate Organizational & Technical Security Measures Take Home Message Technological Complexity Necessary balance between data protection & smart mobility Proliferation of sectoral legislation Clear attribution of responsibilities and liabilities Evolving domain Accountable management of CAV's value chain (Personal) Data centrality Collaborative and standard practices for data protection purposes