Urgh, come now. This is currently happening and yes it is likely a breach of EU laws, but it is happening now. Multiple auto companies have been caught doing it, its not a theoretical what if. Like many things if the government does not enforce (but instead gives a fine) then it does not matter what the law says.

You sound like those people saying murder can't happen since it is illegal, but they are just taking the piss.

has anyone gone to jail through gdpr?

also, really cool stuff collecting all this info thank you.

but yeah, i don't see this conversation going any further, laws state one thing, reality is a-whole-nother. especially when the rich are involved.

i hope to God you are right about all this, i really do, I've just seen it enough times to know...

I'm not here to argue, but after a certain point it becomes a game of "hide the data stream". You'd be amazed at how clever you can be with this, and inspecting the logic of embedded firmware is difficult.

It often looks something like this (in algorithm or nowadays A.I. functionality):

"When an accident occurs, keep a copy of the video file. After a random delay after the accident, during normal driving, when you don't feel like you're being observed, upload the video recording to one of these 40 IP addresses in 20–400 byte encrypted chunks over 7 days."

This isn't theoretical, I've seen it before, software being sneaky like this. Resistant to observation because it can detect an artificial testing environment or network snooping tools. Difficult to prove misbehavior because the data is routed through multiple hops before being stored, and you can't easily inspect encrypted traffic. It might not even be the car manufacturer, it could be whoever is making the cameras. Basically, if it has a data connection and a recording feature, it's not secure.

What the other person is trying to convey is the common operating rule of most businesses nowadays. Breaking the law is worth it to them if the profits outweigh the consequences. For example if they only just increase profit by 4% per year, a low chance of a 4% fine after say 5 years is absolutely worth it. The only way to curb this is with completely ruinous fines, like "we will fine you 50% of each year this happened, dissolve your regional organisation, or ban you from doing business in the entire regulatory area (in this case the EU)" kind of consequences. Anything else can be optimised away.