Frankly I feel that for this kind of investication (car crashes and accidents) the manufacturer should be required to hand over all data relevant to the investigation. On device logs are probably the most relevant data you could get in these cases. That this lab decided to try to decipher the data, and found troves of it that wasn't known to exist before, speaks to how the relationship must be. They didn't trust Tesl…
Isn't this against the principle behind the right to not produce evidence against oneself?
I’d go further, and say that the data should be exportable in a predefined format (ideally an open standard), so that investigators can use 3rd party tools to investigate any make of ‘smart car’.
I feel like the owner should get access rather than institutes or the manufacturers. Anyone else should figure it out with said owner.
What if the owner caused the accident and has an interest to deny access to the data?
I feel like the owner should get access rather than institutes or the manufacturers. Anyone else should figure it out with said owner.
What if the owner caused the accident and has an interest to deny access to the data?
Then you obtain a warrant for that data, as intended by due process of law. If the owner still refuses to hand it over, you have them on obstruction of justice.
If they are making a Subject Access Request under the GDPR (which they should be), then yes, Tesla should be providing: * what personal information the organisation holds about them; * how they are using it; * who they are sharing it with; and * where they got their data from. https://ico.org.uk/your-data-matters/your-right-to-get-copie...
It's not a person requesting data about themselves under GDPR, it's the dutch prosecutors and courts requesting data from Tesla for a criminal investigation. "they" is not the driver but the dutch authorities; GDPR simply is not relevant at all for this case (e.g. GDPR article 2.d explicitly states that GDPR does not apply to activities like these), general rules of criminal process and court orders apply.
Yes, that’s true. I was more thinking about the general research they were doing into establishing what data various Tesla models record. i.e. purchase a vehicle, drive it around (perhaps crash it if the research grant can stretch to that), submit a SAR. Any discrepancy between what personal data Tesla provide and what they found when they decrypted it themselves feels like the main story here to me.
If they are making a Subject Access Request under the GDPR (which they should be), then yes, Tesla should be providing: * what personal information the organisation holds about them; * how they are using it; * who they are sharing it with; and * where they got their data from. https://ico.org.uk/your-data-matters/your-right-to-get-copie...
would driving data/telemetry be categorised as personal data under GDPR? I assume cars could have multiple drivers so unless there's a clear way of deriving the person from the data itself it might be classed as anonymous and therefore not in scope
Yes it likely would be, if it’s timestamped log data. Even if there are multiple drivers, the data recorded still relates “to an identified or identifiable individual”. Simply knowing who was driving the car when, which shouldn’t be difficult if it’s your car, makes the specific individual identifiable.