TÜV as data trustee

Modern vehicles have become like connected mobile devices in the way they share data. New challenges have emerged from this, especially regarding cyber and data security. How can data privacy and data usage be reconciled in a meaningful way?

TÜV as a data trustee

Who owns vehicle data? Who manages it? Data from connected vehicles enable a multitude of useful applications. This data requires trustworthy protection. For fleet operators to manage their businesses efficiently, they need users to provide them with information. Ideally, users should be able to do this with confidence. Let us take a closer look at the contentious area between data privacy and data usage.

Data privacy and data usage

The process to date has been relatively simple. In older vehicles, data can be accessed only via the “on-board diagnostics”(OBD) interface, either by the users themselves or by a specialist repair shop. Many of the newer vehicles, however, are generally always ‘online’ and therefore almost continuously connected to a server belonging to the respective manufacturer. When the vehicles come into a repair shop, mechanics are then able to access this data. But such data are not only of interest to workshops.

Legal aspects of data sharing in vehicles remains a gray area

Vehicles are increasingly becoming connected devices, and so the situation is also becoming increasingly complex. Connected vehicles transmit data, but how this data is handled is still a gray area at present. As an impartial organization focusing on issues of data privacy, we see it as our task to monitor data transparency and data purpose in the interests of vehicle drivers and owners. User consent (‘opt-ins’) for the use of personal data also requires managing. This obviously shouldn’t require users clicking ‘OK’ every three minutes for authorization as with website cookies. Intelligent concepts are needed that build bridges between the data privacy interests of drivers and the interests of industry, research, authorities, insurers and fleet operators. Efficient fleet management mainly depends on having valid data – ranging from mileage, fuel consumption and driving style through to vehicle comparisons between different classes, engines and makes. Future applications such as digital claims management, predictive maintenance, geofencing and analyzing the electric driving components of plug-in hybrids will increasingly require adequate and sufficient data. This is clearly a “legitimate interest” within the meaning of the General Data Protection Regulation (GDPR). But how do I communicate this to my vehicle user?

Study: Vehicle users are happy to share data under certain conditions

In collaboration with the University of St. Gallen, we conducted a large-scale series of studies to investigate the conditions under which drivers in Germany would be ready to share data from their connected vehicles.



The core finding:

When an independent third-party acts as a data trustee, consumer confidence and thus willingness to share data increases significantly. Furthermore, under such conditions, users are seemingly willing to provide more information than they would without the involvement of a third party.

For applications in fleet management and similar areas, involving a trustee in managing and, when required, processing vehicle data is therefore more efficient and makes sense for data privacy reasons. Utilizing a trustee is also worthwhile as it enables the creation of a broader and more valid database.

Trusted Data Services combine efficient fleet management with data privacy

What does this look like in practice? We have developed a solution – “Trusted Data Services” – that we already use as an independent “third party” for large fleet operators.

Trusted Data Services function as intermediate modules to create transparency and safeguard the interests of all parties involved. Rather than being retrofit solutions, they perform as direct interfaces, for example, to fleet management systems.

Via Trusted Data Services, we, as a neutral entity, obtain user opt-ins, secure and manage recorded data, and forward data pseudonymized to fleet management or similar systems. We therefore act as a rights administrator (who gets access?) and resource provider (which data and functions are
provided?).

All parties benefit from the system. Vehicle owners and drivers can be confident that data processing will comply to the most stringent of security requirements, and that their data privacy rights can be actively exercised. They can also be assured that data encryption by the data trustee means personalized evaluation of their data can take place only with their consent. Fleet managers and data users, such as claims management systems, also get comprehensive, processed data records according to individual vehicles. Trusted Data Services also enable fleet operators to instantly provide clear and verifiable information on compliance with data privacy, for example, when requested to do so by an official audit or a works council. The ability to do this is vital considering fleet managers and managing directors are often personally liable for ensuring that data is processed in accordance with GDPR.



To sum up:

We are not usually associated with data processing, but the fact is we have systematically acquired expertise on digital-era issues. We are therefore able to deliver what our brand stands for: trust. At the same time, mobility remains our core topic – and Trusted Data Services links these two areas of expertise. On fleet management, we know from experience that when users consent through us as an intermediary third party, they not only feel secure but are also much more willing to provide data.