Customer Expectations Are Changing
*Carlton, J.; Malik, H. A data privacy survey on personal identifiable information (PII) left on rental vehicle infotainment systems. J. Surveill. Secur. Saf. 2024, 5, 198-212. http://dx.doi.org/10.20517/jsss.2024.07
**RunSafe Security. Auto Connected Car, August 2025
Build Trust with Easy-to-Read Vehicle Privacy Report Summaries
Vehicle Privacy Report™ uses standardized icons to show what data manufacturers collect, share, or sell. It discloses manufacturer and service provider data practices, notes mobile app and Wi-Fi compatibility, and credits businesses for protecting privacy, including deleting previous drivers’ data.
In-Vehicle Personal Data Deletions
Delete personal data after every rental
Delete renter’s navigation history, phone pairings revealing full or partial names, contact lists, call logs, text messages, Android Auto and Apple CarPlay account information, and more after the rental concludes.
In many jurisdictions, rental companies are required by law to delete renters’ personal data after each rental period concludes.
Disconnect Renter’s Remote Access at Return
Previous renters may still have remote access to track, unlock, and start the car.
A factory reset is not enough.
Introducing a first-of-its-kind connected vehicle safety solution for rental businesses.
Connected cars come with a problem most rental business leaders overlook. When a previous renter pairs the vehicle with the manufacturer’s smartphone app, they can keep full remote access to it even after the rental ends—in effect, a “spare digital key.” That former renter can still locate, unlock, and start the car remotely, set it in motion, and even spy through its cameras and microphones.
Meet GDPR Compliance with Privacy4Cars
Car rental companies are Controllers under GDPR of all personal data stored in vehicles they own and cannot transfer their GDPR obligations to Data Subjects to delete their own data.
“Upon return of the vehicle, it seems to me, the hiring company will become the Controller of any personal data stored on the vehicle’s systems, and the only thing that it can lawfully do with those data is delete them. If it re-lets the vehicle without doing so, such that the next hirer can see the previous hirer’s personal data, then there will be a strongly arguable case that the hirer has processed the data in contravention of the Art 5(1) principles.”
Further takeaways from the analysis includes:
“A Controller who relies only on the subjective experience and knowledge of individual employees may struggle to meet the requirement in (UK) GDPR Art 5(2) to demonstrate compliance. A Controller who uses a documented procedure for cleansing an on-board computer system and/or a software product designed to remove problematic data will be much better placed.”
Benefits of Vehicle Privacy Services
Award-winning, multi-patented technology — trusted by companies managing 20+ million vehicles annually.
