1. Types of Privacy Risks in Autonomous Transportation

Autonomous transport systems (self-driving cars, smart public transport, ride-sharing AI fleets, and connected vehicle systems) generate:

(A) Location Tracking Data

• Continuous GPS monitoring of passengers and drivers
• Travel history profiling

(B) Biometric & In-Cabin Monitoring

• Driver attention tracking (eye movement, fatigue detection)
• Passenger recognition systems

(C) Behavioural Data

• Driving style analysis
• Passenger habits and route preferences

(D) External Environmental Data

• CCTV-style recordings of public spaces
• Pedestrian and vehicle recognition feeds

(E) Data Sharing with Third Parties

• Insurance companies
• Law enforcement
• Navigation service providers

These raise issues of surveillance, profiling, and secondary use of data beyond transportation purposes.

2. Legal Framework in the UK

Autonomous transport privacy is governed by:

• UK GDPR Article 5: data minimisation, purpose limitation, fairness, transparency
• Article 6: lawful basis for processing (public task, legitimate interest, etc.)
• Article 9: special category data (biometrics in some cases)
• Article 22: protection against fully automated decision-making
• Data Protection Act 2018
• Human Rights Act 1998 (Article 8 ECHR): right to private life

3. Case Law Relevant to Autonomous Transportation Privacy

There are no UK cases exclusively about self-driving cars yet, but several landmark decisions on surveillance, location data, and digital profiling apply directly.

1. R (Bridges) v South Wales Police (2020 EWCA Civ 1058)

Principle:
The Court of Appeal ruled that automated facial recognition technology must comply with strict proportionality, legality, and data protection standards.

Relevance to autonomous transport:

• Autonomous vehicles often use facial recognition for passenger identification or safety monitoring.
• Continuous scanning of pedestrians or passengers in transport hubs may be unlawful if not proportionate.
• Sets limits on real-time biometric surveillance in public transport systems.

2. Big Brother Watch v United Kingdom (2021 ECHR Grand Chamber)

Principle:
Bulk surveillance of communications must have strong safeguards, independent oversight, and necessity justification.

Relevance:

• Autonomous transport systems generate bulk data streams (video, sensor, GPS).
• If governments or companies access large-scale transport surveillance data, it must be strictly controlled.
• Reinforces limits on indiscriminate collection of passenger movement data.

3. R (Catt) v Association of Chief Police Officers (2015 UKSC 9)

Principle:
Retention of personal data (even from public activities) must be justified and proportionate.

Relevance to autonomous vehicles:

• Vehicle tracking systems storing long-term travel history must justify retention periods.
• Even public movement data (e.g., commuting routes) becomes sensitive when aggregated.
• Supports data minimisation for transport logs.

4. S and Marper v United Kingdom (2008 ECHR)

Principle:
Retention of biometric data (DNA and fingerprints) of non-convicted individuals violates Article 8.

Relevance:

• Autonomous vehicles may collect biometric identifiers (face scans, iris data for access control).
• Retaining such biometric transport data without necessity may breach privacy rights.
• Strong precedent against indefinite storage of biometric transport data.

5. Vidal-Hall v Google Inc (2015 EWCA Civ 311)

Principle:
Misuse of private information is actionable without proof of financial loss; distress alone is sufficient.

Relevance:

• If autonomous systems leak or misuse travel history or behavioural profiling, users can claim even without financial harm.
• Protects passengers from psychological harm caused by surveillance awareness or data misuse.

6. Google LLC v Lloyd (2021 UKSC 50)

Principle:
Individuals must show specific harm or distress to claim compensation for data breaches.

Relevance:

• Mass claims against autonomous vehicle operators (e.g., fleet data breaches) require proof of individual harm.
• Limits class actions unless actual damage from transport data misuse is shown.

7. NT1 & NT2 v Google LLC (2018 EWHC 799)

Principle:
Established balancing test for data retention and “right to be forgotten.”

Relevance:

• Passengers may request deletion of long-term travel histories stored by autonomous transport systems.
• Supports limiting predictive profiling based on outdated travel behaviour.

4. Key Privacy Issues in Autonomous Transportation (from Case Law Principles)

(A) Continuous Surveillance Must Be Proportionate

From Bridges and Big Brother Watch

• Real-time monitoring of passengers and pedestrians must be strictly necessary.
• Over-collection of video or biometric data is unlawful if excessive.

(B) Location Data is Highly Sensitive

From Catt

• Travel patterns reveal lifestyle, religion, work habits, and political activity.
• Long-term storage must be justified and time-limited.

(C) Biometric Data Requires Strong Protection

From S and Marper

• Facial recognition in transport systems is high-risk.
• Retention without necessity breaches Article 8 rights.

(D) Automated Decision Systems Must Be Fair

From Vidal-Hall

• AI deciding insurance premiums based on driving behaviour must be transparent.
• Hidden profiling of passengers or drivers is legally risky.

(E) Data Breaches Cause Legal Harm Even Without Financial Loss

From Vidal-Hall

• Leakage of travel history or ride patterns can support claims based on distress.

(F) Compensation Requires Proven Harm

From Lloyd v Google

• Systemic transport data misuse claims require proof of individual damage.

5. Practical Legal Implications for UK Autonomous Transport Systems

To comply with UK law, autonomous transport providers must:

1. Data Minimisation

• Only collect data strictly needed for navigation and safety

2. Transparent Passenger Notice

• Inform users about tracking, AI decision-making, and data sharing

3. Strict Retention Limits

• Delete location history unless legally required

4. Human Oversight

• Ensure AI decisions (e.g., safety scoring, insurance pricing) are reviewable

5. Biometric Safeguards

• Avoid or strictly regulate facial recognition in vehicles

6. Strong Security Controls

• Encrypt all vehicle sensor and passenger data

Conclusion

Privacy in autonomous transportation in the UK is shaped less by vehicle-specific law and more by established principles from surveillance, data protection, and human rights case law. Cases like R (Bridges), S and Marper, and Big Brother Watch collectively establish a strict framework: continuous monitoring technologies are only lawful when they are necessary, proportionate, and transparently governed.

As autonomous transport becomes widespread, UK courts are likely to extend these principles further, especially around real-time tracking, biometric identification, and predictive mobility profiling.