Stricter data protection rules have been adopted by the European Parliament to protect the privacy of drivers.

There will be a much higher standard for consent, the definition of what constitutes personal data will change and there will be tougher sanctions for anybody breaking the rules, reports AM’s sister title Fleet News. 

Businesses have been given two years to comply with the new regime, which has been designed to deal with issues arising from connected products and services, including vehicles.

“Individuals must be empowered; they must know what their rights are and know how to defend their rights if they feel they are not respected,” said Frans Timmermans, first vice-president of the European Commission.

“The new rules will ensure that the fundamental right to personal data protection is guaranteed for all.”

Connectivity in cars and vans is becoming more common-place and the majority of drivers already use apps like Google Maps and sat-navs to plan journeys.

But with experts predicting 90% of new cars will be connected by 2020, sharing real-time information on a massive scale will soon become the norm.

Vehicle manufacturers say it has the potential to offer huge economic, environmental and societal benefits.

However, with technology developing at a rapid pace, Erik Jonnaert, secretary general of the European Automobile Manufacturers’ Association (ACEA), warned: “There are many challenges on the road ahead.”

The new rules now enshrined under the General Data Protection Regulation (GDPR) only apply to personal data.

But with the definition of personal data also changing, legal expert Stephan Appt says much of what will be produced will fall under the new regulation.

GDPR makes it clear that information is treated as personal data whenever individuals can be identified by online identifiers, including GPS information.

Appt, a partner at Pinsent Masons, said: “Data that identifies drivers indirectly would be considered personal data.”

And if the UK votes to leave the European Union following the referendum on June 23, it is not expected that the rules will be watered down.

Appt said: “This legal framework will not only apply to data in the EU, it will apply to everybody supplying goods and services to the EU.”

Driver consent for data-sharing services will therefore be crucial, with the new rules making it clear that it must be “unambiguous” and communicated by “a statement or clear affirmative action”, he said.

“Pre-ticked boxes will not constitute consent,” said Appt.

“It must be freely given and informed.”

The ACEA said in a strategy paper on connected vehicles released last week that manufacturers aim to design their vehicles and services so that “where possible” drivers can choose whether to share personal data.

Furthermore, it said: “Customers will be able to deactivate the geolocation functionality of their connected vehicles and in the connected services that are offered except where geolocation data must be processed to comply with contractual or legal obligations, for example emergency call.”