Answer given by Ms Vălean on behalf of the European Commission
8.9.2022
Regulation (EU) 2016/679[1] (‘the regulation’) lays down that location data qualifies as personal data any time it relates to an individual. Insofar as the collection of location data of vehicles implies the collection of personal data of the drivers using that vehicle, the collection of location data of vehicles must comply with the regulation.
Directive (EU) 2019/520[2] (‘the directive’) refers in Recital 55 to the right to protection of personal data as recognised by the Charter of Fundamental Rights of the European Union.
Accordingly, Article 27 of the directive provides for the application of the regulation, limits the amount of personal data collected, and defines the purposes of data processing under the directive, and the rights of data subjects.
Moreover, Article 10 of the directive establishes that users shall be informed about the processing of their personal data and their rights. Finally, while the directive defines the possibilities for on-board equipment to facilitate services other than tolling[3], the collection and use of personal data must still comply with the regulation[4].
The Commission is strongly committed to the protection of personal data and EC law provides a strong legal framework to this effect.
Without prejudice to the competences of the Commission as Guardian of the Treaties, the monitoring and enforcement of the application of data protection rules fall within the competence of the national authorities and courts.
Data Protection Authorities in charge of the enforcement of data protection rules of individual Member States could take action, based either on complaints or on their own initiative if such services were not to comply with the regulation.
- [1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119/1, 4.5.2016
- [2] Directive (EU) 2019/520 of the European Parliament and of the Council of 19 March 2019 on the interoperability of electronic road toll systems and facilitating cross-border exchange of information on the failure to pay road fees in the Union, OJ L 91/45, 29.3.2019
- [3] Article 3(5), second subparagraph
- [4] This means among others that any processing of such data must be able to rely on one of the grounds for lawfulness under Article 6 of the regulation and there would be legal ground to take action, if the processing of personal data in the context of services other than tolling breached the regulation.