Car dealers need to have clear processes in place for resolving any breaches, and they must notify the Data Protection Commission within 72 hours of identifying the breach. “It is unclear how exactly this data is used by manufacturers or precisely with whom this data is shared. “Regarding guidance on processing personal data, organisations must respect the obligations conferred on them by the GDPR, in particular by carrying out their activities in accordance with the principles of data protection found in article five. Organisations must show that any processing of personal data is lawful and fair; that it is transparent; that they record the minimum amount of personal data necessary for a stated purpose; that the personal data is stored securely and retained only for the minimum amount of time required; and they respond appropriately to data subject requests,” the DPC explained. This is because consent cannot override these two central pillars of data protection.

Source: The Irish Times March 24, 2021 07:05 UTC