Navigating Data Protection in Autonomous Vehicle Design
The rapid evolution of automated and autonomous driving technologies is reshaping the automotive landscape. Manufacturers are transitioning from traditional vehicle production toward integrated mobility services, embedding advanced tech and media offerings into the driving experience. This shift is accelerated by intense competition from emerging market players, notably in China, where development cycles are fast and disruptive concepts quickly reach scale. Yet, alongside this innovation, a growing wave of European Union digital regulation is adding complexity to the sector.
The EU’s Digital Strategy 2023/2024 introduces measures with significant implications for automotive engineering, including the Data Act and the AI Act. While these headline regulations demand attention, data protection remains a core challenge for autonomous vehicle projects. The technologies underpinning self-driving systems depend on processing vast amounts of data—often personal—both within the vehicle and in external systems. Sensors capture information for safety-critical functions, comfort controls, and entertainment features. This data may be transmitted to manufacturer backends for tasks such as over-the-air updates or predictive maintenance, triggering a range of legal obligations.
Determining when vehicle data qualifies as personal data is not always straightforward. The European Data Protection Board (EDPB) has stated that Vehicle Identification Numbers (VINs) are personal data. However, the European Court of Justice ruled that a VIN is only personal data when the holder can link it to an individual through additional information. Despite this nuance, regulators in Germany and some Member States still treat VINs as inherently personal under laws such as § 63f (1) No. 6 StVG.
The distinction between in-vehicle and external data processing is critical. Under the GDPR, data that remains inaccessible to manufacturers or third parties—common in certain autonomous driving configurations—has limited regulatory exposure. Once a manufacturer accesses sensor outputs or other operational data, the question of personal data status arises, particularly if linked to customer records from sales or connectivity services. Pseudonymisation and strict access controls can mitigate obligations, but other legislation, including the Data Act, may still apply.
Even for data confined to the vehicle, principles such as privacy by design and transparency remain binding. OEMs must inform users early about what is collected, how it is stored, and how it can be deleted, for example when a vehicle changes ownership. Engineering solutions should minimise data retention, using less intrusive sensors or circular storage systems that overwrite unneeded information.
When data leaves the vehicle—for connected services, aftersales, or third-party use—the GDPR and other frameworks, such as the ePrivacy Directive and its national implementations, come into play. Article 5(3) of the Directive, interpreted broadly by the EDPB, complicates secondary uses like product development or marketing without explicit consent. This blurs the line between compliance obligations and permissible data exploitation.
Additional layers of regulation stem from UNECE standards R155 and R156, which address vehicle cybersecurity management and software updates. These intersect with EU Regulation 2019/2144, specifying IT and data security for driver assistance systems and setting rules for biometric data use. National laws, such as Germany’s 2021 Autonomous Driving legislation, add further requirements.
Data protection extends into the development phase. Test drives involving personal data must comply with GDPR, requiring transparency measures like marked vehicles and dedicated notices. Authorities expect anonymisation or pseudonymisation early in the process and enforce limited storage periods. Missteps can lead to penalties, as demonstrated by enforcement actions against Volkswagen.
Because autonomous driving systems often rely on AI, the newly approved AI Act will be pivotal. High-risk classifications under the Act demand rigorous compliance, without diminishing GDPR applicability. If AI systems make automated decisions with significant effects on individuals, Article 22 GDPR mandates consent unless narrowly exempted. The DSK’s guidance offers practical support for implementation.
With the combined weight of the Data Act, AI Act, GDPR, and sector-specific regulations, early legal engagement and thorough Data Protection Impact Assessments are essential. For engineers and designers, integrating privacy and compliance into the architecture of autonomous systems is no longer optional—it is a foundational element of responsible innovation.
