Deleuze replied: Yeah for sure a Data Protection Impact Assessment should be completed before deployment. IRIS uses new technology, real-time monitoring, possible biometric or health data, and safety-related automated assessment. GDPR Article 35 requires a DPIA where processing is likely to result in high risk to individuals’ rights and freedoms, particularly where new technologies or systematic monitoring are involved. The DPIA should evaluate privacy risks, discrimination risks, false positives and false negatives, risks to drivers’ autonomy, risks of employer or insurer misuse, and risks to passengers if deployed in taxis, buses, or shared vehicles.

Deleuze replied: For data storage, IRIS must apply security measures proportionate to the sensitivity of the data. At minimum, this means encryption in transit and at rest, pseudonymisation where identification is not needed, strict role-based access controls, audit logs, secure deletion, tamper-resistant storage, secure software updates, and separation of driver identifiers from model-training data. GDPR Article 32 requires controllers and processors to implement security appropriate to the risk, including measures such as pseudonymisation and encryption where appropriate. IRIS should also prefer local and transient processing wherever possible. The safest design is one where raw facial images and heart-rate signals are processed inside the vehicle or device in real time and are not stored by default. If storage is needed for safety validation, bias testing, incident investigation, or model improvement, the retention period must be short, justified, documented, and linked to a defined purpose. Long-term retention of raw images or physiological data should be exceptional, not routine.