The European Data Protection Board ("EDPB"), an EU body of national supervisory authorities and the EU Commission, released today the text of draft guidelines on processing personal data in the context of connected vehicles and mobility-related applications (the "Draft Guidelines"), which it had adopted at its January 28–29 meeting. The Draft Guidelines provide examples of data processing activities and related compliance steps, including in relation to legal basis, retention, security and information requirements. Given the Draft Guidelines' interplay with the ePrivacy Directive, the EDPB emphasizes consent as a relevant legal basis for processing. The level of granularity of the Draft Guidelines and actual relevance for privacy professionals might fall short compared to the cybersecurity best practices developed for smart cars by the European Agency for Cybersecurity ("ENISA"). (See ENISA's latest report, "Good Practices for Security of Smart Cars," released in November 2019.)

The Draft Guidelines are open to public consultation until March 20 and can be found on the EDPB website.

Visit us at mayerbrown.com

Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.

© Copyright 2019. The Mayer Brown Practices. All rights reserved.

This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.