Type-approval requirements for the deployment of the eCall in-vehicle system based on the 112 service

Opinion of the EDPS on the Proposal for a Regulation of the European Parliament and of the Council concerning type-approval requirements for the deployment of the eCall system and amending Directive 2007/46/EC.

The EDPS emphasises that the processing of personal data is one of the core obligations created by the Proposal and welcomes that many recommendations he made in relation to 112 eCall's data protection implications were taken into account.

112 eCall system: the EDPS makes the following recommendations:

·        an explicit reference to applicable EU data protection law should be inserted in the Proposal in a substantive and dedicated provision;

·        concrete data protection safeguards applying to 112 eCall should be developed in the Proposal rather than in delegated acts;

·        designate the controller and the authority responsible for handling access requests;

·        specify the list of data referred to as a minimum set of data and as a full set of data (possibly to be elaborated in a delegated or implementing act);

·        include the possibility for data subjects to deactivate private eCall and added value services;

·        specify retention periods for the data processed;

·        specify the modalities of the exercise of data subjects’ rights;

·        ensure that the information it refers to is part of the technical

·        documentation handed over together with the vehicle and it should be specified in the Proposal that the availability of the information has to be pointed out to the car owner at the time of the purchase of the car, in a separate document.

Private eCall and added value services: the EDPS’s recommendations are as follows:

·        clarify in the Proposal that constant tracking is prohibited for added value services;

·        specify, in a substantive provision of the proposal, the categories of data processed under the 112 eCall and private eCall and added value services, and define the concept of ‘FSD’ in the proposal;

·        only the data necessary to private eCall and added value services should be processed in compliance with the data minimisation principle;

·        a specific provision should recall that the processing of sensitive data under private eCall and added value services is prohibited;

·the retention period of data processed under 112 eCall, private eCall and added value services should be determined and specified in a substantive provision of the Proposal;

·        security of the data processed under 112 eCall, private eCall and added value services should be guaranteed by some specifications in the text.