Automated vehicles: Are we ready for the privacy journey?

Introduction

AVs are moving steadily from concept to reality in the UK. Recent news that robotaxi operators have been granted London private hire licences, albeit with a human driver still present, is a useful reminder that this technology is edging closer to everyday use. While much of the legal debate rightly focuses on safety and liability, the privacy questions are becoming harder to ignore: what personal data is collected, who controls it, and how do existing privacy frameworks keep pace with these technologies?

“Privacy needs to be considered with the same seriousness as safety, cybersecurity and liability.”

Key data protection challenges

Where AV data amounts to personal data, organisations involved in its collection and use will need to comply with the UK GDPR and Data Protection Act 2018.

In practice, a number of key compliance challenges arise, including:  

• Transparency: Data controllers will need to explain complex processing activities to data subjects in a way that is clear and accessible. This may be relatively straightforward where a manufacturer provides a privacy notice to a driver or account holder, but more difficult where the data relates to passengers, pedestrians, cyclists or other road users who have no direct relationship with the organisation. This reflects the ICO's focus on transparency, fairness and accountability in the AV context. Layered privacy notices, in-vehicle settings or other real-time prompts may be needed to make transparency meaningful in practice.  

• Data minimisation: There is an inherent tension between collecting enough data to operate the vehicle safely, improve system performance and support maintenance, and limiting collection to what is necessary for those purposes. The EDPB Guidance flags precise location data as particularly intrusive, because it can reveal habits, places of work and residence, and other sensitive patterns. Organisations will need to be able to justify why particular categories of data are required, particularly where the data is continuously collected, granular or relates to individuals outside the vehicle. For example, if mileage or general vehicle movement is sufficient, precise location history should not be collected by default.

“Data that appears anonymous in isolation may become identifiable when combined with other information.”

• Purpose limitation: Personal data collected through AVs may be useful for a range of secondary purposes, including insurance pricing, product development, marketing, fraud prevention and responding to law enforcement requests. However, organisations will need to consider whether these uses are compatible with the original purposes for which the data was collected, and whether individuals have been given sufficiently clear information.

• Data security: AVs operate both as data platforms and as physical systems. A security incident could have consequences beyond the loss or unauthorised disclosure of personal data, potentially affecting vehicle functionality, passenger safety or other road users. Those principles sit alongside UK GDPR security obligations.

• Automated decision-making: Where systems make real-time decisions on how the vehicle responds to its surroundings, organisations will need to consider whether automated decision-making rules are engaged, what information can meaningfully be provided to individuals, and what level of human oversight is realistic in practice.

Conclusion

As AVs move closer to everyday use, the organisations developing and deploying them will need to demonstrate to the public that privacy has been considered with the same seriousness as safety, cybersecurity and liability. From a privacy perspective, that means understanding what personal data is collected, being clear about who controls it, testing claims of anonymisation carefully, and building transparency, minimisation and security into the design of AV systems. If AVs are to earn public trust, organisations will need to be transparent not only about how the technology works, but also about how the data behind it is collected, used and controlled.

“If AVs are to earn public trust, transparency around data will be fundamental.”

Processing of personal data

AVs necessarily rely on large amounts of data – including personal data – to operate: data is used to train the underlying systems; collected during operation through cameras, sensors, GPS, telematics and connected devices; and analysed after deployment for maintenance, software updates and system improvement. The processing of data is therefore integral to every stage of the AV lifecycle.

Data protection laws will only operate to the extent that the data processed is personal data. As a reminder, personal data is defined under Article 4(1) UK GDPR as "any information relating to an identified or identifiable natural person". AVs may collect information not only relating to vehicle owners and passengers, but also pedestrians, cyclists, nearby drivers and members of the public. In some cases, the analysis will be straightforward: a driver’s name, contact details, connected vehicle account, payment information or in-vehicle footage will clearly be personal data. In other cases the position may be more nuanced as highlighted by EDPB guidance on connected and AVs (the "EDPB Guidance"): location data, vehicle usage patterns, sensor readings or external camera footage may not identify an individual in isolation, but may do so when linked to a particular driver, passenger, pedestrian or other road user, or when combined with other available data such as the vehicle identification number.

Organisations may seek to rely on anonymisation to take vehicle-derived datasets outside the scope of data protection laws. However, anonymity is context-specific and must be assessed by reference to the means reasonably likely to be used to identify an individual. In the context of AVs, that assessment is unlikely to be straightforward. Journey patterns, precise locations, sensor outputs and in-vehicle or external camera footage may appear anonymised when viewed in isolation, but become identifiable when combined with other information available, such as customer account details, vehicle identification numbers, service records or telematics history. If an individual can still be singled out, linked across datasets or inferred from the data, the data is unlikely to be truly anonymous; at most, it may be pseudonymised and still remain subject to data protection laws.

Who is the data controller?

The obvious starting point is that the manufacturer is the controller, particularly where it determines what data the vehicle collects, how that data is used, and how long it is retained for. However, the controller analysis is unlikely to stop there. In practice, software developers, navigation and mapping providers, fleet operators, vehicle owners, insurers, telecoms providers and connected service providers may each influence the purposes and means of processing at different points in the vehicle lifecycle. Each may act as an independent controller, joint controller or processor, depending on the factual arrangements. Consequently, organisations should map data flows carefully and document who is responsible for obligations such as providing transparency information, responding to data subject rights requests and managing data sharing arrangements.

“Data is integral to every stage of the automated vehicle lifecycle.”

“An automated vehicle isn't simply a mode of transport. It is also a data platform.”

Regulation under PECR

Data processed as part of the operation of an AV will also be governed by the Privacy and Electronic Communications Regulations 2003. Access to "terminal equipment" or location data will require consent (subject to certain exemptions).

“The privacy question is not simply what data is collected, but who controls it.”