Commission Delegated Regulation (EU) 2017/79Show full title

ANNEX VIII Technical requirements and test procedures related to privacy and data protection

PART I Procedure for verifying the lack of traceability of an eCall in-vehicle system or STU

1. Purpose

1.1. This test procedure is to ensure that a 112-based eCall in-vehicle system or STU is not traceable and is not subject to any constant tracking in its normal operational status.

2. Requirements

2.1. The 112-based eCall in-vehicle system or STU is not available for communication with the PSAP if the PSAP test point initiates the communication.

2.2. Failure to establish the connection can be attributed to the 112-based eCall in-vehicle system not being registered on the network.

3. Test procedure

3.1. The following tests shall be performed on a representative arrangement of parts (without a vehicle body).

3.2. This test shall be performed after successful connection of the eCall IVS with the network and registration of the device so as to facilitate transmission of the MSD.

3.2.1. The initial emergency call must have been ‘cleared down’ and deregistered from the network prior to this test (e.g. hang up), otherwise the PSAP test point will be enabled to connect.

3.2.2. Before performing the test, ensure that:

(a)

one of the connection procedures defined in point 2.7 of Annex I to this Regulation, as agreed between the technical service and the manufacturer, will be applied for any test call;

(b)

the dedicated PSAP test point is available to receive an eCall emitted by the 112-based system;

(c)

the vehicle ignition or master control switch is activated;

(d)

any TPS or added-value service system is disabled.

3.2.3. Leave the 112-based eCall IVS powered.

3.2.4. Via the PSAP test point, attempt to connect to the 112-based eCall IVS.

4. Assessment

4.1. The requirement is determined to have been passed if the 112-based eCall in-vehicle system is not available for communication with the PSAP when the PSAP test point attempts to connect.

4.2. The establishment of connection with the 112-based eCall IVS when the PSAP test point initiates the communication constitutes a failure.

PART II Procedure for verifying the length of time an eCall log file is stored by the eCall in-vehicle system or STU

1. Purpose

1.1. This test procedure aims to ensure that personal data processed pursuant to Regulation (EU) 2015/758 is not retained by the eCall in-vehicle system longer than necessary for the purpose of handling the emergency situation and is fully deleted as soon as no longer necessary for that purpose.

1.2. This is to demonstrate the automatic deletion by proving that eCall log files are not kept beyond 13 hours from the point of initiating an eCall.

2. Requirements

2.1. When interrogated, the eCall in-vehicle system or STU shall not maintain any record of an eCall in its memory beyond 13 hours from the point of initiating an eCall.

3. Test conditions

3.1. The Technical Service shall be facilitated to have access to the part of the system where the eCall log files are stored in the IVS.

3.2. The following test shall be performed on a representative arrangement of parts.

4. Test Method

4.1. The tests as described in point 2.7 of Annex I shall be carried out. They require that a test call is placed in order for functionality checks to be made.

4.2. 13 hours after a test call has been placed, the Technical Service tester shall be facilitated with access to where the eCall log files are stored in the IVS. This will involve the potential to download from the IVS any log files so that they can be viewed by the tester.

5. Assessment

5.1. The requirement is determined to have been passed if no log files are present in the eCall in-vehicle system memory.

5.2. The presence of a log file pertaining to an eCall that has occurred more than 13 hours ago constitutes a failure.

PART III Procedure for verifying the automatic and continuous removal of data in the internal memory of an eCall in-vehicle system or STU

1. Purpose

1.1. This test procedure aims to ensure that personal data is only used for the purpose of handling the emergency situation and is automatically and continuously removed from the internal memory of the eCall in-vehicle system or STU.

1.2. This is to be proved by demonstrating that in the internal memory of the 112 based eCall in-vehicle system or STU, maximum of last three locations of the vehicle are retained.

2. Requirements

2.1. When interrogated, the eCall in-vehicle system or STU shall not maintain more than three recent locations of the vehicle.

3. Test conditions

3.1. The Technical Service shall be facilitated to have access to the part of the system where the vehicle location data are stored in the IVS internal memory.

3.2. The following test shall be performed on a representative arrangement of parts.

4. Test Method

4.1. The Technical Service tester shall be facilitated with access to where the vehicle location data are stored in the IVS internal memory. This will involve the potential to download from the IVS any stored locations so that they can be viewed by the tester.

5. Assessment

5.1. The requirement is determined to have been passed if maximum of last three locations are present in the eCall in-vehicle system memory.

5.2. The presence of more than three locations constitutes a failure.

PART IV Procedure for verifying the non- exchange of personal data between an eCall in-vehicle system or STU and third party services systems

1. Purpose

1.1. This test procedure shall ensure that the 112-based eCall in-vehicle system or STU and any additional system functionality providing TPS eCall or an added-value service are designed in such a way that no exchange of personal data between them is possible at any time.

2. Requirements

2.1. The following requirements apply to eCall in-vehicle systems or STUs that shall be used in conjunction with a TPS eCall in-vehicle system functionality.

2.2. Performance requirements

2.2.1. There is no exchange of personal data between the 112-based eCall in-vehicle system or STU and any additional system functionality providing TPS eCall or an added-value service.

2.2.2. Following an eCall made via the 112-based eCall in-vehicle system or STU, no log of this eCall shall be recorded in the memory of the TPS eCall or added-value service system.

3. Test procedure

3.1. The following tests shall be performed either on a vehicle with an eCall in-vehicle system installed or on a representative arrangement of parts.

3.2. The TPS system shall be disabled for the duration of the test call.

3.2.1. Before performing the test call, ensure that:

(a)

one of the connection procedures defined in point 2.7 of Annex I to this Regulation, as agreed between the technical service and the manufacturer, will be applied for any test call;

(b)

the dedicated PSAP test point is available to receive an eCall emitted by the 112-based system;

(c)

a false eCall to a genuine PSAP cannot be made over the live network; and

(d)

the vehicle ignition or master control switch is activated.

3.2.2. Perform a test call by applying a manual trigger of the system (push mode) with the TPS disabled.

3.2.3. Verify that a call was established with the PSAP test point by a record of the PSAP test point showing that it received a call initiation signal or by a successful voice connection to the PSAP test point.

3.2.4. Clear down the test call using the appropriate PSAP test point command (e.g. hang up).

3.2.5. If the call attempt of the 112-based system fails during the test, the test procedure may be repeated.

3.3. The lack of a log file in the TPS system shall be verified via access to the part of the system where eCall log files are stored.

3.3.1. The Technical Service tester shall be facilitated with access to where the eCall log files are stored in the IVS. This will involve the potential to download from the IVS any log files so that they can be viewed by the tester.

3.3.2. The requirement is determined to have been passed if no log files are present in the TPS system in-vehicle system memory.

3.3.3. The presence of a log file in the TPS system pertaining to an eCall that has occurred via the 112-based system constitutes a failure.

3.4. Connection procedures

The connection procedures defined in point 2.7 of Annex I to this Regulation shall apply.