Cybersecurity Policy Report, Warning Issued in Denmark About Connected Vehicle Data Collection, (Mar 31, 2025)
By Tony Foley
The Danish data protection authority, Datatilsynet, has issued guidance on the increased prevalence of information collected through the use of connected car technologies, providing information for consumers on their rights under the European Union’s General Data Protection Regulation (GDPR) and offering advice to car owners.
In a news release today, Datatilsynet noted that connected cars had the capability to collect information on everything from a consumer’s daily routines to their biometric data. Specifically, Datatilsynet cited unclear consent, data abuse, and targeted marketing as common practices that could lead to negative consequences, such as less favorable insurance terms and, in some cases, shut down of services.
The guidance specifies that a driver’s consent to collection of data via a connected vehicle under the GDPR must be voluntary and transparent, allowing an opt-out from data collection without losing access to a car’s basic functions. Consumers have the right to know what data is collected and how it is shared, as well as the right to object to processing and to demand data deletion when it is no longer necessary to retain. The agency cited examples of instances where car owners were required to share data to access their car’s functions—a practice that likely is in breach of the GDPR and guidelines of the European Data Protection Board.
Datatilsynet offers several suggestions to car owners, including knowing and understanding their rights so they can take control of how their data is used.
“Many cars collect far more information than you might expect,” Datatilsynet said. “This data can reveal details about where you live, your work routine, how you drive and where you go, and in some cases even your communication habits. Connected cars can be both smart and practical, and features like navigation assistance and personal profiles make sense for many. But you should be critical about which services you enable and make sure your rights are respected.”
News: InternationalLegislation DataPrivacy DataSecurity GDPR