Hostname: page-component-cd9895bd7-jkksz Total loading time: 0 Render date: 2024-12-26T07:53:18.189Z Has data issue: false hasContentIssue false
  • English
  • Français

Autonomous Intelligent Cars on the European Intersection of Liability and Privacy: Regulatory Challenges and the Road Ahead

Published online by Cambridge University Press:  20 January 2017

Roeland de Bruin
Get access Rights & Permissions [Opens in a new window]

Abstract

Cars will become more autonomous and intelligent in the near future. Eventually, Autonomous Intelligent Cars (AICs) will contribute to road safety, will enable the mobilisation of disabled citizens and a will lead to a decrease of CO2 emissions. The European Union aims to stimulate responsible innovation in the field of AICs, in a way that (ethical) acceptability, sustainability and societal desirability are taken into account. The current legal frameworks are not observed to optimally facilitate innovation or successful societal deployment of AICs. This article explores challenges for both innovation and acceptance that follow from the current legal regimes on product liability, liability for motor vehicles and information privacy of consumers of AICs, and discusses these challenges in view of a regulatory balance that is to be reached between stimulation of innovation and consumer protection in the European Union.

Type
Special Issue on Regulating New and Emerging Technologies
Information
European Journal of Risk Regulation , Volume 7 , Issue 3 , September 2016 , pp. 485 - 501
Copyright
Copyright © Cambridge University Press 2016

Access options

Get access to the full version of this content by using one of the access options below. (Log in options will check for institutional or personal access. Content may require purchase if you do not have access.)

References

1 See Madeleine de Cock Buning, Lucky Belder & Roeland W. de Bruin, Working paper: “Mapping the Legal Framework for the introduction into Society of Robots as Autonomous Intelligent Systems”, at p. 3-4, available on the Internet at <http://www.caaai.eu/wp-content/uploads/2012/08/Mapping-L_N-fw-for-AIS.pdf> (last accessed on 28 January 2016) and the references to Chopra, Samir and White, Laurence F., A Legal Theory for Autonomous Intelligent Agents (Ann Arbor: University of Michigan Press 2011) at p. 10 CrossRefGoogle Scholar (autonomy) and Davies, Collin R., “An evolutionary step in intellectual property rights – Artificial intelligence and intellectual property”, 27 Computer Law & Security Review 2011, at p. 601–619 CrossRefGoogle Scholar (intelligence); and by the same authors the chapter “Mapping the Legal Framework for the Introduction into Society of Robots as Autonomous Intelligent Systems”, in Sam Muller et al (eds.), The Law of the Future and the Future of Law, series 2012 (De Cock Buning, Belder & De Bruin 2012), pp. 195-210.

2 Pollution, climate change, societal exclusion of ‘weaker parties’, and high accident risks on (European) roads can all be seen as the outcome of the modernization and individualisation processes that took place in the past century. These side effects must now in turn be dealt with. For the identification of and a study on the concept of risk society by Ulrich Beck, see his book Risk Society, Towards a New Modernity, London: Sage Publications 1992.

3 See Communication from the Commission Europe 2020, A strategy for smart, sustainable and inclusive growth, COM(2010) 2020 final.

4 See section 2 for further elaboration.

5 See for example Erica Palmerini, Federico Azzarri, Fiorella Battaglia et al, D 6.2, “Guidelines on Regulating Robotics”, 22 September 2014 (RoboLaw 2014); De Cock Buning, Belder & De Bruin 2012; and further elaboration in Section 2.

6 See section 2. For instance by means of the research output of the Robolaw-project and the RockEU Robotics Coordination Action for Europe, the first steps have been taken to map possible legal impediments to innovation and to set out guidelines for regulation of robotics in general.

7 This has also been identified in in Robolaw 2014, p. 18. See also Section 2. Furthermore: John Villasenor, “Products Liability & Driverless Cars: Issues and Guiding Principles for Legislation”, Brookings paper series The Robots Are Coming, The Project on Civilian Robotics, April 2012, available on the internet at <http://www.brookings.edu/research/papers/2014/04/products-liability-driverless-cars-villasenor>, last accessed on 19 February 2016, where it is acknowledged that “it is suggested that liability concerns will slow or even completely prevent consumer access to advanced autonomous vehicle technology”, and states that this suggestion would be a mistake according to US law (at p. 2).

8 Bryant Walker Smith, “Human error as a cause for vehicle crashes”, 18 November 2013, available on the Internet at <http://cyberlaw.stanford.edu/blog/2013/12/human-error-cause-vehicle-crashes> (last accessed on 28 January 2016).

9 OECD, “OECD Factbook 2013: Economic, Environmental and Social Statistics”, 2013, available on the Internet at <http://www.oecd-ilibrary.org/sites/factbook-2013-en/06/02/03/index.html?contentType=&itemId=/content/chapter/factbook-2013-50-en&containerItemId=/content/serial/18147364&accessItemIds=&mimeType=text/html> (last accessed on 28 January 2016), also cited in Gillian Yeomans, “Autonomous Vehicles – handing over control: opportunities and risks for insurance”, , available on the Internet at <https://www.lloyds.com/∼/media/lloyds/reports/emerging%20risk%20reports/autonomous%20vehicles%20final.pdf> (last accessed on 28 January 2016) (Yeomans 2014) at p. 5.

10 See for example Yeomans 2014, at p. 5. Also Anne Pawsey, “Autonomous Road Vehicles”, September 2013 at p. 1. Available on the Internet at <http://www.parliament.uk/briefing-papers/post-pn-443.pdf>, (POSTnote 2013); Robolaw 2014, at p. 42.

11 See for example Scott Le Vine & John Polak, “Automated Cars: A smooth ride ahead?”, February 2014, at p. 14. available on the Internet via <http://www.theitc.org.uk/docs/114.pdf> (last accessed on 28 January 2016).

12 See Wayne Cunningham and Antuan Goodwin, “Six reasons to love, or loathe, autonomous cars”, 8 may 2013, available on the Internet at <http://www.cnet.com/news/six-reasons-to-love-or-loathe-autonomous-cars/> (last accessed on 28 January 2016).

13 Wikipedia, “Google driverless car”, available on the Internet at <http://en.wikipedia.org/wiki/Google_driverless_car> (last accessed on 17 March 2015), referring to Matt O’Brian, “Google's 'goofy’ new self-driving car a sign of things to come”, 22-12-2014, available on the Internet at <http://www.mercurynews.com/business/ci_27190285/googles-goofy-new-self-driving-car-sign-things< (last accessed on 28 January 2016).

14 See for instance <https://www.media.volvocars.com/us/en-us/media/pressreleases/145619/volvo-car-groups-first-self-driving-autopilot-cars-test-on-public-roads-around-> (Volvo), <http://www.pcmag.com/article2/0,2817,2387524,00.asp>, (Volkswagen) <http://www.bbc.com/news/technology-25653253> (BMW) (last accessed on 28 January 2016).

15 See <http://www.scania.nl/about-scania/media/platooning/> (accessed 20 March 2015).

16 Alecander Stoklosa, “Volvo Has a “Production-Viable” Autonomous Car, Will Put It on the Road by 2017”, available on the Internet at <http://blog.caranddriver.com/volvo-has-a-production-viable-autonomous-car-will-put-it-on-the-road-by-2017/> (last accessed 20 March 2015).

17 Stephen Edelstein, “Germany plans autonomous car test program on high speed autobahn”, 28 January 2015, available on the Internet at <http://www.motorauthority.com/news/1096521_germany-plans-autonomous-car-test-program-on-high-speed-autobahn> (last accessed 20 March 2015).

18 These phases and their descriptions are cited/minimally adapted from POST note 2013, p. 2. These are also used, for example, in Yeomans 2014, p. 7. The US-based SAE (Society of Automotive Engineers) has also developed a “Taxonomy and Definition for Terms Related to On-Road Motor Vehicle Automated Driving Systems”, in their document J3016, available on the Internet at <http://standards.sae.org/j3016_201401/> (last accessed 27 December 2015). SAE distinguishes six levels of automation: 0 – No automation; 1 – Driver assistance; 2 – Partial automation; 3 – Conditional automation; 4 – High automation; and 5 – Full automation.

19 See supra note 4.

20 EU, “Why do we need an Innovation Union?”, 2015, available on the Internet via <http://ec.europa.eu/research/innovation-union/index_en.cfm?pg=why> (last accessed on 17 March 2015).

21 Communication Horizon 2020 – The Framework Programme for Research and Innovation” SEC(2011 1427 & 1428 final, COM(2012) 808 final (Horizon 2020). See also http://ec.europa.eu/digital-agenda/en/robotics.

22 EC “Towards Responsible Research and Innovation in the Information and Communication Technologies and Security Technologies Fields” 2011, available on the Internet via <http://ec.europa.eu/research/science-society/document_library/pdf_06/mep-rapport-2011_en.pdf>, edited by René von Schomberg, (EC RRI ICTs; last accessed on 12 February 2016). See also EC “Options for Strengthening Responsible Research and Innovation, 2013, available on the Internet via <https://ec.europa.eu/research/science-society/document_library/pdf_06/options-for-strengthening_en.pdf> (EC RRI; last accessed on 12 February 2016).

23 See for example EC RRI ICTs, at p. 9.

24 See for example Knut Blind, “The Impact of Regulation on Innovation”, Nesta Working Paper No. 12/02, January 2012, available on the Internet at <https://www.nesta.org.uk/sites/default/files/the_impact_of_regulation_on_innovation.pdf> (last accessed 12 February 2016; Blind 2012), at p. 1-2. Also Wiener, Jonathan B., “The regulation of technology, and the technology of regulation”, Technology in society 2004, no. 26 (Wiener 2004), pp. 483 – 500Google Scholar; and Pelkmans, Jacques & Renda, Andrea, “Does EU regulation hinder or stimulate innovation”, CEPS Special Report No. 96/2014 (Pelkmans & Renda 2014), at p. 8 Google Scholar.

25 See Robolaw 2014 at p. 57-59.

26 See Robolaw 2014, at p. 10.

27 See for example Pelkmans & Renda 2014, at p. 8. Also RoboLaw 2014, at pp. 10-11.

28 See Horsey, Kirsty & Rackley, Erika, Tort Law (Oxford: Oxford University Press 2013), at p. 363 CrossRefGoogle Scholar. Furthermore Robolaw 2014 at p. 57.

29 See Blind 2012, at p. 24.

30 See also EC RRI ICTs, at p. 8-9.

31 Robolaw, at p. 62-63.

32 See Blind 2012, at p. 19.

33 See Robolaw 2014, at p. 11.

34 Christophe Leroux, Roberto Labruto, Chiara Boscarato and others, “Suggestion for a Green Paper on legal issues in robotics”), December 2012, available on the Internet at <http://www.eu-robotics.net/cms/upload/PDF/euRobotics_Deliverable_D.3.2.1_Annex_Suggestion_GreenPaper_ELS_IssuesInRobotics.pdf> (last accessed 28 January 2016).

35 See http://www.robolaw.eu for the results of that project.

36 See the press release of the European Commission from 15 December 2015, “Agreement on Commission's EU data protection reform will boost Digital Single Market”, available via the Internet at <http://europa.eu/rapid/press-release_IP-15-6321_en.htm>, last accessed on 11 March 2016, and furthermore inter alia the preambles to the GDPR: “Rapid technological developments have brought new challenges for the protection of personal data. The scale of data sharing and collecting has increased dramatically. Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities. Individuals increasingly make personal information available publicly and globally. Technology has transformed both the economy and social life. […] Building trust in the online environment is key to economic development. Lack of trust makes consumers hesitate to buy online and adopt new services. This risks slowing down the development of innovative uses of new technologies. Personal data protection therefore plays a central role in the Digital Agenda for Europe, and more generally in the Europe 2020 Strategy”.

37 Commission Staff Working Document Progress Report and review of the Its action plan Accompanying the document Report from the Commission to the European Parliament and to the Council Implementation of Directive 2010/40/EU of the European Parliament and of the Council of 7 July 2010 on the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other modes of transport , available on the Internet at <http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52014SC0320>.

38 Beleidsregel Ontheffingverlening exceptionele transporten RDW 2015. Available on the Internet at <http://wetten.overheid.nl/BWBR0035903/geldigheidsdatum_16-10-2015>.

39 Kate Connolly, “Germany creates laws for driverless cars”, 11 February 2015, Available on the Internet at <http://www.theguardian.com/technology/2015/feb/01/germany-laws-driverless-cars-autobahns-google-industry> (last accessed 28 January 2016).

40 See for example Alex Davies, “The UK is now the best place on earth to develop self-driving cars”, available on the Internet at <http://www.slate.com/blogs/future_tense/2015/02/13/u_k_self_driving_cars_the_european_country_deregulated_testing_protocols.html> (last accessed 28 January 2016).

41 See <http://www.iso.org/iso/home/store/catalogue_tc/catalogue_tc_browse.htm?commid=54706&published=on&includesc=true>.

42 <https://www.sae.org/servlets/works/documentHome.do?comtID=TEVAVS&docID=J3016_201401&inputPage=dOcDeTaIlS>.

43 <https://www.sae.org/servlets/works/documentHome.do?comtID=TEVAVS&docID=J3018_201503&inputPage=dOcDeTaIlS>.

44 See also Stapleton, Jane, Product Liability (London: Butterworths 1994) at p. 61 (Stapleton 1994)Google Scholar.

45 The PLD does not provide a strict liability regime, since it leaves room for producers to exonerate themselves based on defences as to the non-discoverability of defects, and the possibility to reduce liability based on fault (contributory negligence) by consumers of defective products. See also Stapleton 1994, at p. 236-237.

46 Article 12 PLD.

47 See the considerations of the Product Liability Directive.

48 Article 6(1) PLD. These circumstances include “(a) the presentation of the product, (b) the use to which it would reasonably be expected that the product would be put”, and “(c) the time when the product was put into circulation”.

49 Article 4 PLD.

50 Defined in the considerations as “contributory negligence.”

51 Article 7(b) PLD.

52 This is a minimum-harmonization provision, allowing states to take regulatory measures allowing the establishment of liability for producers even when it can be proved that a defect could not have been discovered based on the state of the scientific and technological knowledge at the time a product was put into circulation, see Article 15(1)(b) PLD.

53 Article 7(e) PLD. See also Case C-300/95, Commission/United Kingdom [1997], in which the ECJ ruled that a producer relying on this “state of the art” defence must prove that the objective, most advanced state of the art, while not being limited to the industrial sector concerned, was not “such as to enable the existence of the defect to be discovered as long as that knowledge had been accessible at the time when the defective product was put into circulation.”

54 See also Yeomans 2014, at p. 18.

55 See van Dam, C., European Tort Law, Oxford: Oxford University Press 2006 (Van Dam 2006), at p. 266–268 Google Scholar.

56 See supra note 27.

57 The questions to be addressed include: Could it have been foreseen that automatic updates can lead to a decrease in the safety of AICs in general? Has this specific error or related errors surfaced anywhere before? And how did the producer respond to the error(s) when he was informed of the existence thereof?

58 EC COM(2006) 496 final, Third report on the application of Council Directive on the approximation of laws, regulations and administrative provisions of the Member States concerning liability for defective products (85/374/EEC of 25 July 1985, amended by Directive 1999/34/EC of the European Parliament and of the Council of 10 May 1999).

59 See Robolaw 2014, p. 60.

60 Its attempt was to harmonize rules on liability for damage caused by motor vehicles to (non-motorized) cyclists and pedestrians, see Van Dam 2006, at p. 369.

61 For an overview see: http://ec.europa.eu/finance/insurance/legislation/index_en.htm.

62 Directive of the EU Parliament and the Council 2009/103/EC Relating to insurance against civil liability in respect of the use of motor vehicles, and the enforcement of the obligation to insure against such liability

63 Loi “tendant à l’amélioration de la situation des victimes d’accidents de la circulation et à l’accélération des procédures d’indemnisation.“

64 See A. Tunc, “The ‘Loi Badinter’ – Ten Years of Experience”, 3 Maastricht Journal of European and Comparative Law, 1996 (Tunc 1996), p. 330. Article 3 reads: “Les victimes hormis les conducteurs […] sont indemnisees des dommages resultant des atteintes a leur personne qu’elles ont subis, sans que puisse leur etre opposee leur propre faute”.

65 “à l ‘exception de leur faute inexcusable si elle a été la cause exclusive de l’accident”.

66 One of the major rationales for the French legislator to implement this strict liability system for motorists is that it is often difficult, if not impossible, to establish the exact cause of an accident, and the level to which a conduct or negligence of the victim had contributed to the accident. See Tunc 1996, p. 333: “… it is often difficult, practically, to judge it [the victim's behaviour, RWdB] and decide whether it was impeccable, erroneous or faulty. Most of the time, the circumstances of the accident are not clear enough to permit a judgment.”

67 See also Tunc 1997, at p. 335.

68 See Jef De Mot & Louis Visscher, “Custodians’ liability in the Netherlands and Belgium: a legal and economic analysis”, available on the internet via <https://www.genevaassociation.org/media/623339/ga_15th_eale_seminar_de-mot_visscher.pdf>, last accessed on 21 February 2016, at p. 1, interpreting article 1384 of the French Code Civil. See also Tomlinson, Edward A., “Tort Liability in France for the Act of Things: A Study of Judicial Law-making”, Louisiana Law Review, vol. 48, no. 6, July 1988, at p. 1337 (footnote 145)Google Scholar.

69 Compensation for damage suffered by victims inside a motor vehicle is governed by the general rules on liability laid down in Article 6:162 of the Dutch Civil Code.

70 See for instance Hartlief, Ton, “Hoofdstuk 5 Aansprakelijkheid voor motorrijtuigen”, in: Spier, Jaap, Hartlief, Ton, Keirse, Anne, et al., Verbintenissen uit de wet en Schadevergoeding (Deventer: Kluwer 2012), (Hartlief 2012), at p. 165-166Google Scholar. However, a bus driver who had hit a cyclist did not reasonably need to expect that the cyclist would ignore a red traffic light when he drove his bus slowly (30-35 km/h) while passing through a green traffic light (Supreme Court of the Netherlands 22 May 1992 (ABP/Winterthur), NJ 1992/527).

71 Marbeth van Uitregt, judgment of the Supreme Court of the Netherlands 31 May 1991, NJ 1991/721. See also Ingrid Kolkman, judgment, Supreme Court of the Netherlands 1 June 1990, NJ 1991/720, furthermore Hartlief 2012, at p. 163-164.

72 Dangers involved in and inherent to the operation of a motor vehicle on the public road.

73 Marloes de Vos e.a, Supreme Court of the Netherlands 2 June 1995, NJ 1997/700-702, and Saïd Hyati et al, 5 December 1997 NJ 1998/400-402. The notion of ‘Betriebsgefahr’ is borrowed from the German Straβenverkehrsgesetz.

74 Or presumed liability as it is called in Scottish law.

75 Roberts v. Ramsbottom [1980] 1 WLR 823, also cited in Van Dam 2006, at p. 364, footnote 52.

76 Henderson v. HE Jenkins & Sons and Evans [1970] AC 282, cited in Van Dam 2006, at p. 364, footnote 53. Van Dam further takes note of Worsley v Hollins [1991] RTR 252 (CA), in which the judges held that the victim's claim for negligence failed because the defendant could prove that although his braking systems had failed, thereby causing damage, his minibus had recently been serviced and passed its MOT.

77 There is one rule of a statutory duty that – to some degree – establishes strict liability for drivers of motor vehicles approaching a crossing in the road: “The driver of every vehicle approaching a crossing shall, unless he can see that there is no pedestrian crossing, proceed at such speed as to be able, if necessary, to stop before reaching such crossing”, as cited in Van Dam 2006, at p. 365, footnote 57, referring to Reg. 3 of the Pedestrian Crossing Places (Traffic) Regulations 1941, replaced by the Zebra Pedestrian Crossing Regulations 1971, SI 1971, No. 1524. A defence that a driver has in this respect is force majeure.

78 Van Dam 2006, p. 375 notes that “it is hard to establish contributory negligence of young children under the age of 7.”

79 See Hartlief, Ton & Tjites, Riemert P.J.L., Verzekering & aansprakelijkheid, Kluwer: Deventer 1999, p. 3–4 Google Scholar; Giesen, Ivo, “Attributie, juridische causaliteit en preventieve werking”, in Verheij, Albert J., van Boom, Willem H. & Giesen, Ivo (eds.), Capita Civilologie: Handboek Empirie en Privaatrecht, Den Haag: Boom Juridische Uitgevers 2013, p. 493–494; also Robolaw 2014, p. 55Google Scholar.

80 In cooperation with the General Product Safety Directive, 2001/95/EC.

81 See section 2; furthermore for example Pelkmans & Renda 2014, at p. 8. Also RoboLaw 2014, at p. 10-11.

82 See EC COM(2006) 496 final, at section 4.

83 See Kirsten Korosec, “Volvo CEO: We will accept all liability when our cars are in autonomous mode”, Fortune.com, 7 October 2015, available on the internet at <http://fortune.com/2015/10/07/volvo-liability-self-driving-cars/>, last accessed on 19 February 2016.

84 See supra note 13.

85 See van Dam 2006, p. 359.

86 Yeomans 2014, at p. 18.

87 Yeomans 2014, at p. 18. See furthermore Anderson, James M., Kalra, Nidhi, Stanley, Karlyn D. et al., Autonomous Vehicle Technology – A Guide for Policymakers, RAND Transportation, Space and Technology Program 2014, (RAND report), at p. 94–95 Google Scholar.

88 Idem.

89 RAND report, at p. 81.

90 Warren, Samuel & Brandeis, Louis, “The Right to Privacy”, 4 Harvard Law Review (1890)CrossRefGoogle Scholar.

91 Comprising communicative, physical, medical and spatial privacy.

92 For a different view see for instance Finn, Rachel & Wright, David, “Seven Types of Privacy”, Selected works of Michael Friedewald 2013 (Finn & Wright 2013), available on the Internet at <http://works.bepress.com/cgi/viewcontent.cgi?article=1070&context=michael_friedewald> (last accessed on 11 March 2015)Google Scholar. Here a distinction is made between the privacy of the following: the person; behaviour and action; communication; data and image; thought and feelings; location and space; and association. See also Solove, Daniel, Understanding Privacy (Cambridge (Mass.): Harvard University Press 2008)Google Scholar.

93 In the European Union, a regulatory framework is in place harmonizing the (information) privacy of citizens, of which the fundaments are laid down in article 7 and 8 of the Charter of Fundamental Rights of the European Union (Charter).

94 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. For an overview of the applicable EU regulatory framework on data protection, see <http://ec.europa.eu/justice/data-protection/law/index_en.htm>.

95 See for instance preambles 1-11 to the DPD; COD 15039/15, p. 2, and the preambles of the GDPR.

96 See also the Position Paper by Ecommerce Europe, “Privacy and Data Protection, Safety and Transparency for Trust and Consumer Centrality, 2014] (Position Paper 2014), at p. 3.

97 Art. 3(1) DPD; art. 4(3) GDPR.

98 These natural persons are called “data subjects” in the DPD and GDPR.

99 Art. 2(a) DPD.

100 Art. 4(1) GDPR.

101 Art. 2(b) DPD; art. 4(3) GDPR.

102 Art. 2(d) and (e) DPD; art. 4(5) and 4(6) GDPR.

103 Art. 6(1)(a) DPD; art. 5(1)(a) adds “in a transparent manner in relation to the data subject”.

104 Art. 6(1)(b) DPD; art. 5(1)(b) GDPR.

105 Art. 7 DPD; art. 6(1) GDPR.

106 Art. 8 DPD; art. 9 GDPR.

107 Art. 23 DPD; art 77 GDPR adds that compensation can be sought for both material and immaterial damage as a result of infringement of the GDPR. That both processors and controllers can be held liable follows from art. 77(2) GDPR.

108 Art. 28 DPD.

109 See art. 79(3new) and 3(4) GDPR.

110 Art. 33 GDPR.

111 See also Case, C-131/12, Google Spain/Maria Costeja González [2014]; and Stefan Kulk & Frederik Zuiderveen Borgesius “Freedom of expression and ‘right to be forgotten’ cases in the Netherlands after Google Spain”, 2 European Data Protection Law Review (2015), at p. 113-125.

112 Art. 17(1) DPD; see also art 5(1)(eb) and section 2 (art. 30 and onwards) on data security in the GDPR.

113 Art. 23 GDPR.

114 See art. 30 GDPR, which inter alia lists as appropriate: a) the pseudonimisation and encryption of personal data; b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of systems and services processing personal data; c) the ability to restore the availability of and access to data in a timely manner in the event of a physical or technical incident; and d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

115 Art. 25 DPD.

116 See articles 40-43 GDPR. Export of personal data may only take place when the minimum level of protection stipulated in the GDPR is not undermined. Therefore, this is essentially stricter than the DPD regime, since the GDPR rules themselves are more stringent than those formulated in the DPD.

117 See 2000/520/EC: Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce, available on the Internet at <http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32000D0520:EN:HTML>.

118 Case C-362/14, Maximilian Schrems/Facebook [2015].

119 See the press release of the European Commission of 29 February 2016, “Restoring trust in transatlantic data flows through strong safeguards: European Commission presents EU-U.S. Privacy Shield”, available on the Internet via <http://europa.eu/rapid/press-release_IP-16-433_en.htm>, last accessed on 11 March 2016.,

120 See the press release/fact sheet of the European Commission of 8 September 2015, “Questions and Answers on the EU-US data protection “Umbrella agreement“”, available on the Internet via <http://europa.eu/rapid/press-release_MEMO-15-5612_en.htm>, last accessed on 11 March 2016.

121 On ‘location data’ as personal data see also the Working Party 29 Opinion on the use of location data with a view to providing value-added services, 2310/05/EN, November 2005, available on the Internet at <http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2005/wp115_en.pdf> (last accessed on 28 January 2016).

122 For instance through recording and storing (in a black box), and/or through real-time communication with other vehicles (V2V) or an infrastructure (V2I).

123 In Germany, car manufacturers (Verband der Automobilindustrie) are developing “Data Protection Principles for Connected Vehicles”, which may eventually form input to a specific legal basis for the processing of vehicle data. See https://www.vda.de/en/topics/innovation-and-technology/network/Data-Protection-Principles-for-Connected-Vehicles.html for a recent version of the Principles.

124 See Anish Acharya, “Are we ready for Driver-less Vehicles? Security vs. Privacy – A Social Perspective”, submitted to ArXiv. org, December 2014, p. 11; also Glancy, Dorothy, “Privacy in autonomous vehicles”, 52 Santa Clara Law Review, (2012) at p. 1172 Google Scholar (Glancy 2012),.

125 See Glancy 2012, at p. 1196-1197.

126 See Glancy 2012, at p. 1225.

127 See also Glancy 2012, at p. 1226-1238.

128 Such as, for instance, photography, the VCR and computer software. See Buning, Madeleine de Cock, “The History of copyright protection of computer software, the emancipation of a work of technology towards a work of authorship”, in: Leeuw, Karl de & Bergstra, Jan, Handbook The History of Information Security (Reed Elsevier International: August 2007), at p. 121–140.CrossRefGoogle Scholar

129 See Madeleine de Cock Buning, “Auteursrecht en informatietechnologie, over de beperkte houdbaarheid van technologiespecifieke regelgeving”, (dissertation), (Amsterdam: Otto Cramwinckel 1998), and Buning, Madeleine de Cock, “De mediamachine als zevenkoppig monster” (inaugural lecture Utrecht University), (Amsterdam: Otto Cramwinckel: 2006)Google Scholar.