PROVISION OF MOTOR VEHICLE DATA

Description

[0001] The present invention relates to a method for providing data from a motor vehicle, wherein a first data set is generated by the motor vehicle, the first data set is anonymized by a vehicle computing unit of the motor vehicle, and the anonymized first data set is transmitted to a server system by the vehicle computing unit. The invention further relates to a corresponding server system for providing data from a motor vehicle and a communication system.

[0002] In the context of connected vehicles, vehicle systems are used that send data from a vehicle to a server backend. User-related and non-user-related data are collected and transmitted. However, for many applications, only non-user-related data is required, or user-related data is required only to a limited extent, or in a restricted or anonymized form. Examples of uses of non-personal data can include the creation of a weather map using measurement data from a vehicle fleet, the creation of a traffic flow map from vehicle fleet movement data, centralized warnings about identified hazards such as black ice or accidents, and the like.

[0003] For example, communication data, vehicle location data, corresponding timestamps, or vehicle identification data may be collected and transmitted as user-related data. This data may be irrelevant or only partially required for the non-user-related uses described above. However, the user-related data is collected for the purposes of secure communication or is partially required, such as in the case of location data, to compare the collected data set with a map.

[0004] In known approaches, all user-related and non-user-related data is transmitted to the server backend and anonymized as early as possible in the server backend. However, this has the disadvantage that the data transmission itself is not anonymous, or user-related data must be transmitted via the corresponding air interface. This is disadvantageous from a data security perspective and, potentially, from a data protection perspective.

[0005] Document DE 10 2014 005 589 A1 proposes a method for the anonymized transmission of vehicle-related data. The vehicle-related data has an identifier that is generated independently. To anonymize the data, no assignment of the identifier to the individual vehicle is created on a central computer.

[0006] However, this procedure is vulnerable to misuse because both the identifier and the vehicle-related data are stored on the central computer.

[0007] Document US 2003 / 0130893 A1 describes a method for protecting personal data generated or received by a vehicle. At least one data element containing personal identification information is acquired from a mobile system, such as the vehicle. The personal identification information is removed from the data element, and the data element is transmitted wirelessly to a receiver.

[0008] However, this only achieves formal anonymisation, since even after the personal identification information has been removed, information can be extracted from the data element which can at least allow an approximate assignment of the data to a user or the vehicle.

[0009] Document DE 10 2018 220307 B3 discloses the transmission of anonymized data in a vehicle to a server system.

[0010] Against this background, it is an object of the present invention to provide an improved concept for providing data of a motor vehicle, by means of which user-related data can be protected with greater reliability.

[0011] This object is achieved by the respective subject matter of the independent claims. Advantageous embodiments and preferred embodiments are the subject matter of the dependent and subordinate claims.

[0012] The improved concept is based on the idea of ​​determining a degree of anonymization based on an anonymized data set transmitted from the motor vehicle to a server system and, depending on this, adapting a set of parameters for anonymization and transmitting it to the motor vehicle.

[0013] According to the improved concept, a method for providing data from a motor vehicle is specified, wherein a first data set is generated by means of the motor vehicle, the first data set is anonymized by means of a vehicle computing unit of the motor vehicle, and the anonymized first data set is transmitted to a server system by means of the vehicle computing unit, in particular wirelessly. The anonymization is carried out by means of the vehicle computing unit based on a predetermined parameter set. The server system determines a degree of anonymization achieved by the anonymization based on the transmitted anonymized data set. The server system generates an adapted parameter set based on the degree of anonymization, and in particular based on the parameter set, and transmits it to the vehicle computing unit, in particular wirelessly.

[0014] The first data set generated by the motor vehicle can, for example, be generated by one or more sensor systems of the motor vehicle and / or by the computing unit. The data set can, in particular, contain user-related or user-related data, as well as data without user reference. User-related data can, for example, be understood as data that allows or can allow conclusions to be drawn about the identity of the motor vehicle or a user, for example, an owner of the motor vehicle. The user-related data can therefore, in particular, contain vehicle-related data and / or personal data.The user-related data may include, for example, an IP address of the vehicle computing unit or a communication interface of the vehicle computing unit, a network card identification number of the vehicle computing unit, other device identification numbers of components of the vehicle computing unit or the motor vehicle, a vehicle identification number (VIN), a user identification number, a customer number of the user, and so on. The user-related data may also include data relating to one or more positions of the motor vehicle, for example, a route traveled or planned by the motor vehicle, and / or timestamps relating to sensor data or position data.

[0015] The data without user reference may include, for example, measurement data, raw data or pre-processed measurement or raw data of the sensor system, weather data of the surroundings of the motor vehicle or operating data of the motor vehicle, for example a motor vehicle speed or activity information relating to components of the motor vehicle, such as a heating device, an air conditioning system, windscreen wipers or a lighting device of the motor vehicle.

[0016] Anonymizing the first data set can, for example, involve completely or partially removing or deleting user-related data, modifying user-related data, and / or obfuscating user-related data, for example, position data and times or time periods. If the first data set contains, for example, position histories or routes, the vehicle computing unit can remove parts of the route, such as a start area and / or destination area of ​​the route, for anonymization. The parameter set specifically specifies which parts of the first data set are to be removed, modified, or obfuscated, how the modification or obfuscation is to be carried out, and how strong the obfuscation or modification is to be.

[0017] The degree of anonymization can then be viewed as a measure of the effort, for example, the computational effort, required to assign the anonymized first data set, or parts thereof, to the motor vehicle or the user of the motor vehicle, i.e., to perform re-identification. The parameter set, in particular, has a direct influence on the achieved degree of anonymization. The specified parameter set is also available on the server system or, for example, is specified by the server system.

[0018] The server system is, in particular, a system arranged externally to the motor vehicle and independent of the motor vehicle, comprising one or more server processing units. In particular, the server system can include several server processing units that are independent of one another and connected to one another via a wireless communication link, possibly spatially distributed.

[0019] The method according to the improved concept thus implements quality control of the anonymization of the first data set performed in the motor vehicle by determining the degree of anonymization and, if necessary, adjusting the parameter set. Because the anonymization takes place in the motor vehicle or by the motor vehicle, less personal or vehicle-related data is transmitted over the air interface between the vehicle's processing unit and the server system, thus reducing the risk of misuse. However, the effort required for anonymization to achieve the desired degree of anonymization can vary depending on the situation.For example, if there are a large number of motor vehicles in a certain spatial and / or temporal area from which corresponding data is collected, even a relatively small amount of anonymization effort can result in the anonymized initial data set being able to be assigned to the actual vehicle that generated the data only with considerable effort. However, if there are only very few motor vehicles providing data in the spatial and / or temporal area, greater effort may be required to achieve the desired level of anonymization, for example, greater obfuscation or more comprehensive removal of user-related data elements.In particular, anonymization can achieve a certain degree of group or fleet anonymity, so that the anonymized initial data set can be assigned to a vehicle group of a certain size, but not to a specific vehicle within the group or fleet. The degree of anonymization can therefore vary depending on the size of the group, whereby the degree of anonymization can also be determined by the size of the group. The size of the group can be influenced using the parameter set.

[0020] The improved concept therefore makes it possible to adapt the anonymization effort to the specific situation at hand and thus achieve greater reliability in anonymization or in achieving the desired level of anonymization while keeping the anonymization effort as low as possible.

[0021] According to at least one embodiment of the method according to the improved concept, the first data set is generated by means of the vehicle computing unit and / or the sensor system of the motor vehicle, wherein the sensor system in particular includes one or more environmental sensor systems.

[0022] An environmental sensor system can be understood here and below as a sensor system capable of generating sensor data or sensor signals that map, display, or reproduce the environment of the motor vehicle. In particular, cameras, lidar systems, radar systems, and ultrasonic sensor systems can be considered environmental sensor systems.

[0023] The first data set may also include position data generated by a digital map system of the motor vehicle and / or by a receiver for a global navigation satellite system, GNSS, of the motor vehicle.

[0024] According to at least one embodiment, the anonymized first data set and / or data dependent thereon are made available for use by means of the server system. Use can be made by the server system itself or by another entity that has access to the anonymized first data set or the data dependent thereon, for example, another computing unit or another person.

[0025] According to at least one embodiment, the server system determines a group size based on the anonymized first data set, which corresponds to a number of motor vehicles to which the anonymized data set can be related. The degree of anonymization is determined depending on the group size or corresponds to the group size.

[0026] In particular, by concealing location and / or time information from the first data set for anonymization purposes, group anonymity can be created, since the corresponding anonymized first data can then be related to an entire group of motor vehicles, but it cannot be determined which motor vehicle in the group actually generated the first data set. The larger the group, the more secure the anonymized first data set is against misuse, since the effort required to assign the first data set to one of the vehicles increases with the number of motor vehicles in the group.

[0027] By adapting the parameter set depending on the group size, the group size achieved by anonymization can therefore be adjusted in order to achieve the desired degree of anonymization, whereby the desired degree of anonymization includes or corresponds to, for example, a predetermined limit for the group size or for the number of motor vehicles.

[0028] According to at least one embodiment, a second data set is generated by the motor vehicle, and the second data set is anonymized by the vehicle computing unit based on the adjusted parameter set. The anonymized second data set is transmitted to the server system by the vehicle computing unit.

[0029] The statements regarding the first data set and the parameter set apply analogously to the second data set and the adjusted parameter set. After the parameter set has been adjusted, it is expected that the degree of anonymization achieved by anonymizing the second data set based on the adjusted parameter set will be increased. This can improve data security for the second data set or other similarly generated and anonymized data sets.

[0030] According to at least one embodiment, the motor vehicle is part of a motor vehicle fleet that includes one or more other motor vehicles, and the adapted parameter set is transmitted by means of the server system to a respective further vehicle computing unit of each further motor vehicle in the motor vehicle fleet.

[0031] In particular, this allows all vehicles in the fleet to anonymize corresponding data sets based on the same customized parameter set. This allows the parameter set or the corresponding degree of anonymization to be proactively adjusted, thus increasing reliability and data security for the entire fleet.

[0032] According to at least one embodiment, a further data set is generated using each additional motor vehicle in the motor vehicle fleet, and the respective additional data set is anonymized by the respective additional vehicle computing unit based on the adapted parameter set. The respective anonymized additional data set is transmitted to the server system by the respective additional vehicle computing unit.

[0033] The additional anonymized data sets transmitted accordingly can be further processed or made available for use in the same way as the first anonymized data set transmitted.

[0034] According to at least one embodiment, further user-related data are transmitted to the server system together with the anonymized first data set by means of the vehicle computing unit, and the transmitted further user-related data are deleted by means of the server system.

[0035] The additional user-related data may, in particular, include data that must be transmitted for the correct and secure transmission of the anonymized first data set, for example, an IP address of the vehicle computing unit and / or a customer identification number. The server system deletes this additional user-related data to prevent possible re-identification of the motor vehicle or the user based on the anonymized first data set. In particular, the server system deletes all data transmitted by the vehicle computing unit together with the anonymized first data set, except for the anonymized first data set.

[0036] According to at least one embodiment, the further user-related data includes the IP address of the vehicle computing unit and / or an identifier assigned to the vehicle computing unit.

[0037] The identifier assigned to the vehicle computing unit can include a customer identification number or a vehicle identification number.

[0038] According to at least one embodiment, the additional user-related data and the anonymized first data set are transmitted by the vehicle computing unit to a first server computing unit of the server system, and the transmitted user-related data are deleted by the first server computing unit. The anonymized first data set is transmitted by the first server computing unit, in particular wirelessly, to a second server computing unit of the server system, wherein the second server computing unit is, in particular, physically and / or spatially separated from the first server computing unit.

[0039] By separating the first and second server processing units, data security can be further increased, as the second server processing unit never has access to the additional user-related data. Potential misuse of the anonymized first data set would therefore require unauthorized access to two different, independent server processing units. The first server processing unit can be considered an intermediate backend, which forwards the anonymized first data set to the second server processing unit as the target backend.

[0040] According to at least one embodiment, the degree of anonymization is determined by means of the second server computing unit, and the adapted parameter set is generated by means of the second server computing unit and transmitted to the vehicle computing unit.

[0041] According to at least one embodiment, the anonymized first data set is encrypted by the vehicle computing unit before being transmitted to the server system. The encrypted first anonymized first data set is decrypted by the server system, in particular by the second server computing unit, after the additional user-related data has been deleted.

[0042] This ensures that the first anonymized data set is only available in encrypted form on the server system at the same time as the other user-related data. This further increases data security.

[0043] According to at least one embodiment, the success of the deletion of the further user-related data is checked by means of the server system, in particular by means of the second server computing unit, before the decryption, and the decryption is carried out depending on a result of the check.

[0044] In particular, decryption is only performed if, or precisely if, the deletion of the additional user-related data was successful according to the verification result. This can reduce the probability that, for unforeseeable reasons, some of the additional user-related data will be present on the server system at the same time as the decrypted, anonymized first data set.

[0045] According to at least one embodiment, the predetermined parameter set contains a delay period and the anonymized first data set is transmitted to the server system by means of the vehicle computing unit with a time delay according to the delay period.

[0046] In other words, the anonymized first data set, possibly encrypted, is ready for transmission to the server system at a specific time, but the actual transmission is delayed with respect to this time according to the delay duration. This further complicates the assignment of the anonymized first data set to the vehicle or its user, or the group size can be further increased. This further increases the reliability of the process and data security.

[0047] Adjusting the parameter set or generating the adjusted parameter set includes, in particular, adjusting the delay time. The second data set is transmitted to the server system with a time delay, in particular according to the adjusted delay time.

[0048] According to the improved concept, a server system for providing data of a motor vehicle is also specified, wherein the server system has at least one server computing unit configured to receive an anonymized first data set, which is anonymized in particular based on a predefined parameter set, from the motor vehicle or a vehicle computing unit of the motor vehicle. The at least one server computing unit is configured to determine, based on the anonymized first data set, a degree of anonymization achieved by the anonymization, in particular based on the parameter set, and to generate an adapted parameter set based on the degree of anonymization and in particular the parameter set and to transmit it to the motor vehicle or the vehicle computing unit.

[0049] According to at least one embodiment of the server system, the at least one server processing unit includes a first server processing unit and a second server processing unit. The first server processing unit is configured to receive user-related data from the motor vehicle or the vehicle processing unit together with the anonymized first data set, delete the transmitted user-related data, and transmit the anonymized first data set to the second server processing unit.

[0050] Further embodiments of the server system according to the improved concept follow directly from the various embodiments of the method according to the improved concept and vice versa.

[0051] According to the improved concept, a communication system is also specified, comprising a server system according to the improved concept and a vehicle computing unit for the motor vehicle. The vehicle computing unit is configured to anonymize a first data set generated by the motor vehicle based on a predefined parameter set in order to generate the anonymized first data set and transmit the anonymized first data set to the server system.

[0052] Further embodiments of the communication system according to the improved concept follow directly from the various embodiments of the method according to the improved concept, and vice versa. In particular, a communication system according to the improved concept is configured to carry out a method according to the improved concept or carries out such a method.

[0053] The invention also includes combinations of the features of the described embodiments.

[0054] Exemplary embodiments of the invention are described below. The figures show: Fig. 1 is a schematic representation of an exemplary embodiment of a communication system according to the improved concept; Fig. 2 is a flowchart of an exemplary embodiment of a method according to the improved concept; and Fig. 3 is a flowchart of a further exemplary embodiment of a method according to the improved concept.

[0055] The exemplary embodiments explained below are preferred exemplary embodiments of the invention. In the exemplary embodiments, the described components each represent individual, independently considered features of the invention, which also further develop the invention independently of one another and are thus also to be considered as components of the invention, either individually or in a combination other than that shown. Furthermore, the described exemplary embodiments can also be supplemented by further features of the invention already described.

[0056] In the figures, functionally identical elements are provided with the same reference numerals.

[0057] In Fig. 11 shows a schematic representation of an exemplary embodiment of a communication system 1 according to the improved concept, which includes a server system 2 and a vehicle computing unit 6 of a motor vehicle 5. The motor vehicle 5 can be considered part of the communication system 1 in various embodiments. The motor vehicle 5 has, in particular, one or more sensor systems 7, for example, environmental sensor systems, speed sensors, temperature sensors, and so on, as well as a GNSS receiver 7', for example, a GPS, GLONASS, Galileo, and / or Beidou receiver. The server system 2 contains at least one server computing unit 3, 4. In various embodiments, the server system 2 contains a first server computing unit 3 and a second server computing unit 4, which is physically and spatially separated from the first server computing unit 3.

[0058] The functioning of the communication system 1 is explained in more detail below using exemplary embodiments of a method for providing data of the motor vehicle 5 according to the improved concept, in particular with reference to the figures Fig. 2 and Fig. 3 .

[0059] In Fig. 2 A flowchart of an exemplary embodiment of a method according to the improved concept is schematically shown. Also schematically shown are the server system 2 and the vehicle computing unit 6.

[0060] In a first method step S1, data is collected by means of the motor vehicle 5, for example using the sensor systems 7 and / or the GNSS receiver 7' and optionally by other components of the motor vehicle 5 and / or by means of the vehicle computing unit 6, which data include both non-user-related data, such as environmental sensor data, weather data or operating data of the motor vehicle, for example a motor vehicle speed, as well as user-related or user-related data, such as communication data, position data of the motor vehicle 5, time stamps relating to the environmental sensor data or the position data, vehicle identification data, such as a VIN and so on.

[0061] In step S2, the collected data is anonymized by the vehicle processing unit 6. For this purpose, for example, parts of the collected data can be removed or deleted, such as the name of a user, information concerning an official license plate number of the motor vehicle 5, or other data directly suitable for identifying the user or the motor vehicle 5. During anonymization, data parts that can be indirectly used to identify the user or motor vehicle, i.e., pseudonymous data, can also be removed. For example, starting and / or destination positions of routes traveled or planned using the motor vehicle 5 can be removed.

[0062] Furthermore, anonymization may include obscuring position data of the motor vehicle 5, which was generated or determined, for example, based on map information or signals received by the GNSS receiver 7', and / or obscuring corresponding times at which the motor vehicle 5 was located at the corresponding positions. Obscuring can be achieved by artificially adding tolerances or errors or by delaying the processing or uploading of the data to the server system 2. Time stamps of the position data can also be removed accordingly.

[0063] The specific anonymization measures ultimately depend on the purpose for which the data from the motor vehicle 5 is to be used. For example, if the data is to be used to create a traffic flow map or a weather map or the like, position data and possibly also time data or temporal information are required, at least to a certain extent. Anonymization is therefore carried out based on a predefined parameter set that determines which parts of the data are to be removed or obscured and the degree of obscuration. The vehicle computing unit 6 can receive the parameter set, for example, from the server system 2.

[0064] Anonymisation particularly achieves group anonymisation, so that motor vehicle 5 can no longer be clearly identified in a fleet of other motor vehicles.

[0065] In step S3, the anonymized data is encrypted by the vehicle computing unit 6. In step S4, the encrypted anonymized data is transmitted to the server system 2. In addition to the anonymized data, other user-related data is also transmitted, in particular an IP address of the vehicle computing unit 6.

[0066] In step S5, this additional user-related data is therefore deleted by server system 2. The deletion occurs, in particular, without the encrypted, anonymized data being decrypted beforehand. In the optional step S6, the success of the deletion can be verified, and only if it is determined that all user-related data transmitted together with the anonymized data has been removed will the data be forwarded or further processed. After the user-related data has been deleted, the encrypted, anonymized data is decrypted by server system 2 in step S7.

[0067] In step S8, a quality check of the anonymization can be performed. For this purpose, the server system 2 can determine, in particular, the degree of anonymization achieved by the anonymization and compare it, for example, with a predefined threshold value for the degree of anonymization. Depending on the result of the comparison, the parameter set for anonymizing the data can be adjusted in step S9. This can improve or gradually improve the effectiveness of the anonymization.

[0068] In step S10, the adjusted parameter set is transmitted to the vehicle processing unit 6 or to corresponding vehicle processing units of the other vehicles in the fleet. The vehicle processing unit 6 can then use the adjusted parameter set for further anonymization. In step S11, the anonymized data is transferred to its intended use via the server system 2 or made available for use by third parties.

[0069] In various embodiments, the encryption in step S3 and the decryption in step S7 are not performed.

[0070] In Fig. 3 A flow diagram of another exemplary embodiment of a method according to the improved concept is shown. The method according to Fig. 3 largely corresponds to the procedure regarding Fig. 2 . In the embodiment of the method according to Fig. 3However, the server system 2 has the first server computing unit 3 and the second server computing unit 4.

[0071] The anonymized and possibly encrypted data as well as the further user-related data are therefore transmitted in step S4 from the vehicle computing unit 6 to the first server computing unit 3. The step S5 for deleting the further user-related data is carried out by the first server computing unit 3, and in step S5' the anonymized data without any further user-related data are transmitted from the server computing unit 3 to the second server computing unit 4. The steps S6 to S11 correspond to the Fig. 2 explained steps and are executed by the second server processing unit 4.

[0072] The physical and organizational separation of server processing units 3 and 4 prevents a potential attacker from gaining access to both the decrypted anonymized data and other user-related data.

[0073] As explained in particular with regard to the figures, the improved concept makes it possible to improve the data security of personal or motor vehicle-related data when using data from a motor vehicle and to increase the reliability of data protection. List of reference symbols

[0074] 1Communication system 2Server system 3,4Server processing units 5Motor vehicle 6Vehicle processing unit 7Sensor systems 7GNSS receivers S1 to S11Procedure steps

Claims

1. A method for providing data of a motor vehicle (5), wherein - a first dataset is generated by the motor vehicle (5) and the first dataset is anonymized by a vehicle computing unit (6) of the motor vehicle (5); and - the anonymized first dataset is communicated to a server system (2) by the vehicle computing unit (6), - the anonymization is performed based on a predetermined parameter set, characterized in that - a degree of anonymization achieved by the anonymization is determined by the server system (2) based on the anonymized first dataset; and - an adapted parameter set is generated based on the degree of anonymization and communicated to the vehicle computing unit (6) by the server system (2).

2. The method according to claim 1, characterized in that - user-related data is communicated to the server system (2) together with the anonymized first dataset by the vehicle computing unit (6); and - the communicated user-related data is deleted by the server system (2).

3. The method according to claim 2, characterized in that the user-related data includes an IP address of the vehicle computing unit (6) and / or an identifier associated with the vehicle computing unit (6).

4. The method according to any one of claims 2 or 3, characterized in that - the user-related data and the anonymized first dataset are communicated to a first server computing unit (3) of the server system (2) by the vehicle computing unit (6); - the communicated user-related data is deleted by the first server computing unit (3); and - the anonymized first dataset is communicated to a second server computing unit (4) of the server system (2) by the first server computing unit (3).

5. The method according to claim 4, characterized in that - the degree of anonymization is determined by the second server computing unit (4); and - the adapted parameter set is generated by the second server computing unit (4) and communicated to the vehicle computing unit (6).

6. The method according to any one of claims 2 to 5, characterized in that - the anonymized first dataset is encrypted by the vehicle computing unit (6) before communication thereof to the server system (2); and - the encrypted anonymized first dataset is decrypted by the server system (2) after deleting the user-related data.

7. The method according to claim 6, characterized in that - before decryption, a success of deletion of the user-related data is checked by the server system (2); and - the decryption is performed depending on a result of the checking.

8. The method according to any one of the preceding claims, characterized in that the predetermined parameter set contains a delay period and the anonymized first dataset is communicated to the server system (2) delayed in time according to the delay period by the vehicle computing unit (6).

9. The method according to any one of the preceding claims, characterized in that a group size is determined by the server system (2) based on the anonymized first dataset, which corresponds to a number of motor vehicles, to which the anonymized dataset can be related, and the degree of anonymization is determined depending on the group size.

10. The method according to any one of the preceding claims, characterized in that - a second dataset is generated by the motor vehicle (5) and the second dataset is anonymized by the vehicle computing unit (6) based on the adapted parameter set; and - the anonymized second dataset is communicated to the server system (2) by the vehicle computing unit (6).

11. The method according to any one of the preceding claims, characterized in that - the motor vehicle (5) is part of a motor vehicle fleet, which includes one or more further motor vehicles; and - the adapted parameter set is communicated to a respective further vehicle computing unit of each further motor vehicle of the motor vehicle fleet by the server system (2).

12. The method according to claim 11, characterized in that - a further dataset is generated by each further motor vehicle of the motor vehicle fleet and the respective further dataset is anonymized by the respective further vehicle computing unit based on the adapted parameter set; and - the respective anonymized further dataset is communicated to the server system (2) by the respective further vehicle computing unit.

13. A server system for providing data of a motor vehicle (5), the server system (2) comprising at least one server computing unit (3, 4), which is configured to obtain an anonymized first dataset from the motor vehicle (5), characterized in that the at least one server computing unit (3, 4) is configured - to determine a degree of anonymization achieved by the anonymization based on the anonymized first dataset; and - to generate an adapted parameter set based on the degree of anonymization and to communicate it to the motor vehicle (5).

14. The server system according to claim 13, characterized in that - the at least one server computing unit (3, 4) includes a first server computing unit (3) and a second server computing unit (4); - the first server computing unit (3) is configured to obtain user-related data from the motor vehicle (5) together with the anonymized first dataset, to delete the communicated user-related data and to communicate the anonymized first dataset to the second server computing unit (4).

15. A communication system comprising a server system (2) according to one of claims 13 or 14 as well as a vehicle computing unit (6) for the motor vehicle (5), wherein the vehicle computing unit (6) is configured - to anonymize a first dataset generated by the motor vehicle (5) based on a predetermined parameter set to generate the anonymized first dataset; and - to communicate the anonymized first dataset to the server system (2).