On November 29, 2024, the Data Protection Inspectorate (DPI) published the results of a joint inspection carried out by the data protection authorities of the Baltic States on compliance with the General Data Protection Regulation (GDPR) in the short-term vehicle rental sector.

What was the focus of the inspection?

According to the DPI, the aim of the inspection was to identify and mitigate risks related to the processing of personal data in the short-term vehicle rental sector. The focus of the inspection was on companies whose main place of business is in one of the Baltic countries but offer services throughout the region.

What were the findings of the Baltic data protection authorities?

The Baltic data protection authorities discovered deficiencies in GDPR compliance among companies. Particularly, the authorities observed the following deficiencies:

• lack of transparency - inability to provide meaningful information to data subjects;
• providing inconsistent information in privacy policies about legal basis and scope of processing compared to information provided to data protection authorities;
• incorrect choice of legal bases, specifically:
  • not sufficiently justifying the use of personal data; and
  • using the same legal basis for all data processing operations, regardless of its suitability for the specific processing activity;
• wording data retention periods ambiguously;
• not deleting customer data; and
• companies not offering alternatives for customers who did not wish to consent to the use of biometric data.

Outcomes

Due to the above, the Baltic data protection authorities developed best practices for companies working in the short-term vehicle rental industry to promote responsible and transparent data processing.

You can read the press release here and a summary of the joint supervision here, both only available in Estonian.