Saatja: Urmo Parm - AKI </O=EXCHANGELABS/OU=EXCHANGE ADMINISTRATIVE GROUP (FYDIBOHF23SPDLT)/CN=RECIPIENTS/CN=779E9AE4817E42E082A46CCC12968F80-03C8F4EF-94>
Saaja: 'Privacy Rights', 'Andrea Amico', 'Merry Marwig', 'Abhishek Bansiwal', 'Priya Mishra'
Teema: Answer to request
Dear Sir/ Madam,
Thank you for your message and for bringing this matter to our attention.
The Estonian Data Protection Inspectorate (AKI) would like to clarify that all organizations acting as data controllers are required to comply with the General Data Protection Regulation (GDPR) when processing personal data—irrespective of whether AKI has issued sector‑specific guidance on a particular topic. The obligations stemming from GDPR apply directly and uniformly, including in situations where personal data is collected, stored, or otherwise processed through vehicle systems.
Accordingly, data controllers whose business processes involve vehicles (such as leasing companies, rental providers, fleet operators, insurers, lenders, or car dealerships) must ensure that personal data stored in a vehicle is handled in accordance with GDPR principles, including lawfulness, data minimization, security of processing, and accountability. This includes the obligation to delete personal data of previous users when a vehicle returns to the controller’s possession and before it is provided to another user. These obligations exist regardless of the availability of national guidance.
We also note your reference to the recent ICO position. AKI agrees that the responsibility to ensure an objective, repeatable, and verifiable deletion process follows directly from GDPR requirements. Relying solely on the subjective judgment or discretion of individual employees does not meet the standards of Article 5(2) or Article 32 GDPR.
If you are aware of Estonian organizations that may not be complying with GDPR requirements in this area, we would welcome this information. It could help us to prioritize entities for inclusion in our supervision.
Thank you once again for your enquiry and for your commitment to supporting high standards of data protection. Should further clarification be needed, we remain at your disposal.
Yours faithfully,
Urmo Parm
Head of Technology
[email protected] <mailto:
[email protected]>
+372 58117232
FOR DATA PRIVACY AND FREEDOM OF INFORMATION
Tatari 39 | 10134 Tallinn | Eesti
LinkedIn <https://www.linkedin.com/company/estonian-data-protection-inspectorate/> I Youtube <https://www.youtube.com/@andmekaitse>
<https://www.aki.ee/en>
From: Privacy Rights <
[email protected]>
Sent: Thursday, March 5, 2026 11:07 PM
To: info - AKI <
[email protected]>
Cc: Andrea Amico <
[email protected]>; Merry Marwig <
[email protected]>; Abhishek Bansiwal <
[email protected]>; Priya Mishra <
[email protected]>
Subject: AKI selgitus ICO juhiste kohta sõidukite isikuandmete kustutamise kohta enne edasimüüki
Tähelepanu! Tegemist on välisvõrgust saabunud kirjaga.
Tundmatu saatja korral palume linke ja faile mitte avada.
Teie mugavuse huvides automaatselt tõlgitud versioon. Originaaltekst inglise keeles on lõpus.
AustatudAndmekaitse Inspektsioon,
Hiljuti avaldas Andmekaitseamet (ICO) juhised selle kohta, kuidas GDPR kehtib isikuandmete suhtes, mis on salvestatud sõidukites, mis vahetavad omanikku (nt müük, tagasivõtmine, jagamine, täielik kahju), märkides, et:
1. Vastutavad töötlejad (st sõiduki seaduslikud omanikud) peavad sõidukis salvestatud andmesubjektide isikuandmed kustutama, kui nad saavad vara tagasi oma valdusse. Selle tegemata jätmine on teatamiskohustuslik isikuandmete rikkumine.
2. Tuleb rakendada asjakohaseid tehnilisi ja organisatsioonilisi meetmeid. Vaja on objektiivset, korratavat ja kontrollitavat andmete kustutamise protsessi. Isikuandmete kustutamine üksikute töötajate subjektiivse otsuse alusel ei ole GDPR-iga kooskõlas.
Nende teade (välja arvatud isikuandmed) on täielikult esitatud käesoleva e-kirja lõpus.
ICO rõhutas, et sõidukites salvestatud isikuandmed kuuluvad selgelt GDPR-i reguleerimisalasse ja et sõidukitel ei ole erandit artiklites 5 ja 32 sätestatud andmete turvalisuse põhireeglite (sh andmete hävitamine) järgimisest, mis on tavapärased kasutatud/remonditud elektroonikaseadmete hulgimüüjate ja jaemüüjate seas. Vähem kui kaks kuud pärast ICO juhiste avaldamist on mitmed tööstusliidud koostöös õigus-, tehnika- ja tööstusekspertidega hakanud välja andma juhiseid ja standardeid, mis tõstavad andmekaitse nõudeid märkimisväärselt.
Seevastu mitmed organisatsioonid, kes tegelevad teie jurisdiktsioonis suure hulga sõidukitega (nt autopargid, autopargi liisinguettevõtjad, laenuandjad, kindlustusandjad, rendiettevõtjad, autode müüjad jne), väidavad, et kui teie asutus ei avalda konkreetseid juhiseid, nagu tegi ICO, ei näe nad kohustust järgida GDPR-i eeskirju ja jätkavad seega teie riigis miljonite sõidukikasutajate krüpteerimata andmete rikkumist ja avalikustamist.
Palume teil lugeda läbi Ühendkuningriigi ICO avaldus (lisatud allpool) ja jagada oma asutuse seisukoht selles küsimuses. Täpsemalt: kas olete nõus, et vastutavad töötlejad on kohustatud kustutama sõidukites salvestatud eelmiste kasutajate isikuandmed objektiivsete, korratavate ja kontrollitavate meetoditega, kui nad saavad sõiduki tagasi oma valdusse ja enne selle edasimüüki?
Arvestades sõidukite kiiret digitaliseerimist ja nende kogutavate ja salvestatavate isikuandmete mahu suurenemist, kui neid ei kustutata, on vaja teie asutuse selget seisukohta, et tagada nõuete täitmine ja andmesubjektide õiguste kaitse.
Täname teid tähelepanu eest ja ootame teie juhiseid.
PS: allpool on toodud ICO e-kiri, mille teie asutus saab üksikasjalikult läbi vaadata.
________________________________
From: icocasework <
[email protected] <mailto:
[email protected]> >
Date: Mon, Dec 22, 2025 at 9:49 AM
Subject: Your email to the ICO - Case Reference IC-XXXXXXXXXXX
22 December 2025
Our reference: IC-XXXXXXXXXXX
Dear XXXXXXXX
Thank you for your enquiry of 16 December 2025.
Does the ICO agree that data controllers must delete personal data from vehicles upon return?
Under UK GDPR, any organisation that determines the purposes and means of processing personal data becomes a data controller. <https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-does-it-mean-if-you-are-a-controller/> When a rental, leasing, or fleet company regains possession of a vehicle, it assumes control over any personal data stored in that vehicle’s systems.
Continuing to store or disclose that data without identifying a lawful basis would breach:
Article 5(1)(a) (lawfulness, fairness, transparency)
<https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/lawfulness-fairness-and-transparency/> Article 5(1)(c) (data minimisation <https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/> )
Article 5(1)(f) and Article 32 (security of processing <https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/integrity-and-confidentiality-security/> )
We indicated in our previous response that the entity owning or lawfully repossessing the vehicle is the data controller and must ensure deletion before onward use. Passing the vehicle to another user without erasure of the personal data held on its systems could amount to unlawful processing and a personal data breach <https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/> .
Does the ICO agree that relying on staff knowledge alone is insufficient for compliance?
UK GDPR requires data controllers to demonstrate compliance Article 5(2) (accountability <https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/accountability-principle/> ).
Our guidance stresses that ‘appropriate technical and organisational measures’ must be in place. Relying solely on employees’ subjective judgment or ‘best endeavours’ is unlikely to meet this standard because:
It is not objective, repeatable, or auditable.
It cannot reliably prevent unauthorised disclosure.
It fails to provide evidence of compliance if challenged.
Documented procedures and/or automated tools that deliver consistent, verifiable results are strongly recommended to meet accountability and security obligations.
If you would like to discuss this further, please contact me on my direct number 0330 XXX XXXX. If you need advice on a new issue you can contact us <https://ico.org.uk/global/contact-us/> via our Helpline on 0303 123 1113 or through our live chat service. In addition, more information about the Information Commissioner’s Office and the legislation we oversee is available on our website at www.ico.org.uk <http://www.ico.org.uk/> .
Yours sincerely
XXXXXXXXXXXXX
Case Officer
Information Commissioner’s Office
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
T. 0330 414 6016 ico.org.uk <https://ico.org.uk/> twitter.com/iconews
<https://twitter.com/iconews> Please consider the environment before printing this email
Respectfully,
<https://ci3.googleusercontent.com/mail-sig/AIorK4zs-OttPK8KAXmeccoJsjQ1XmnqZWOdZvA9yS9a93vxol7o-IXNpMOkIDnUsDe6t5h1dburN6CTnnZX>
Privacy4Cars Privacy Team
[email protected] <mailto:
[email protected]>