WIREDGOV

The European Data Protection Supervisor (EDPS) adopted an opinion yesterday on the European Commission proposal to revise the EU legislation on tachographs - the device used in road transport to monitor driving times and rest periods of professional drivers - as a means of checking compliance with social legislation in the field*. The revision is meant to make use of new technological developments to improve the effectiveness of digital tachographs against manual ones, notably through the use of geo-location equipment and remote communication facilities. The initiative therefore invades the privacy of professional drivers in a very visible way, as it allows the constant monitoring of their whereabouts as well as remote surveillance by control authorities that will have direct access to the drivers' personal data stored in the system.

The EDPS welcomes the inclusion of a specific provision on data protection that promotes the Privacy by Design principle and underlines the responsibility of owners of vehicles and/or transport undertakings to comply with data protection law. He, however, emphasises that this provision alone does not tackle all the data protection concerns linked to the use of tachographs. Additional data protection safeguards are needed to guarantee a satisfactory level of data protection in the system. The EDPS also urges the Commission to update the technical specifications and security measures relevant to the many technologies associated with the new devices to avoid discrepancies in their implementation by industry.

Giovanni Buttarelli, Assistant Supervisor, warns: “The introduction of a new digital tachograph could turn out to be extremely privacy-invasive if its use is not adequately safeguarded. There is a risk that privacy-unfriendly measures could be developed by industry in the absence of clear modalities governing the use and storage of drivers' data so long as the update of technical specifications is pending."

The EDPS recommendations also include that:

• the installation and use of devices for the direct and principal purpose of allowing employers to remotely monitor in real time the actions or whereabouts of their employees should be excluded;

• the general modalities of the processing of personal data in tachographs should be set out clearly in the Proposal, such as the types of data recorded in tachographs and in geo-location equipments, the recipients and the time limits for data retention;

• the security requirements for the digital tachograph laid down in the Proposal need to be further developed, in particular to preserve the confidentiality of the data, to ensure data integrity and to prevent fraud and unlawful manipulation;

• the introduction of any technological update (e.g. remote communication, Intelligent Transport Systems) in tachographs should be duly supported by privacy impact assessments to assess the privacy risks raised by the use of these technologies. Given the potential quantity of information recorded about drivers' activities, such assessments should also be carried out as regards the proposal to merge the functionalities of driver cards with the driving licence.

*Proposal of 19 July 2011 for a Regulation amending Council Regulation (EEC) No 3821/85 on recording equipment in road transport and amending Regulation (EC) No 561/2006 (COM(2011) 451 final) and Commission Communication on "Digital Tachograph: Roadmap for future activities" (COM(2011) 454 final)

The opinion (pdf) is available on the EDPS website. For more information: press@edps.europa.eu

EDPS - The European guardian of data protection

www.edps.europa.eu