European Data protection Authorities consider eCall admissible

Creation date: 07 December 2006

The independent European advisory body on data protection and privacy, the “Article 29 Working Party”, adopted a “Working document on data protection and privacy implications in eCall initiatives” on 26th September 2006.

In the paper, the Article 29 Working Party recognises the socio-economic benefit and public safety value that the wide introduction of the harmonised pan-European eCall service might bring to citizens and addresses the associated privacy and data protection implications.

Two implementation options for of eCall are analysed in the document:

1) eCall chosen on a voluntary basis
2) eCall as a mandatory service

In the case of a “voluntary basis” implementation of the service, a user-friendly solution with a free of charge possibility to activate/de-activate the eCall service on a case-by-case basis should be introduced. Any pressure from third-parties to keep the eCall tool activated is considered illegal. For the “mandatory” option, rules have to be embodied in a dedicated law, taking into account data protection principles. Privacy enhancing technologies should be embedded in the system in order to provide eCall users with the desired level of privacy protection.

The Working Party also analysed the privacy and data protection implications resulting from the inclusion, into the eCall value chain, of Service Providers providing value added services. Here, the rules on data security must be strictly complied with, in particular as some of these data to be processed are of a sensitive nature. Finally, the Working Party has addressed other issues around eCall, namely the concerns related to the creation of databases by telecommunication operators, storage periods of collected data and issues related to the security of the data stored.

In its conclusions, the Article 29 Working Party recommends a voluntary approach to the pan-European introduction of eCall. It recognises that, from a data protection point of view, an emergency call released automatically or triggered manually and resulting in geo-localisation of the emergency event is in principle admissible, provided that a legal basis exists and that sufficient data protection safeguards are provided.