Data privacy notice on the collection of video, image and audio data as part of the project “Automated Driving Alliance” between Robert Bosch GmbH and CARIAD SE
The protection of personal data has the highest priority for Robert Bosch GmbH and CARIAD SE (hereinafter "cooperation partners") and is taken into account in all our business processes. The following data protection information provides an overview of the processing of personal data by the cooperation partners as joint data controllers. Personal data means any information relating to an identified or identifiable natural person.
With this data protection information, we provide information about the type, scope and purpose of the processing of personal data from the cooperation partners in the context of research and development on driving assistance systems, automated and autonomous driving, driving functions and other services, as well as the handling of this data. In addition, the page explains which data subject rights exist with regard to the processing of personal data and which essential processes with regard to the processing of personal data are established in the cooperation partners organizations.
1. Scope of application and addressees of this data privacy notice
This data privacy notice applies to the collection and processing of personal data within research and development projects related to driving assistance systems, automated and autonomous driving, driving functions and other services.
Potential addressees of this data privacy notice and data subjects to the data processing described herein, are all road users which are in the vicinity of one of the marked test vehicles during their operation.
2. Which types of personal data are processed by the cooperation partners?
Within the scope of the above-mentioned research and development purposes, marked test vehicles move in public traffic areas and - insofar as permitted by other laws - on private factory, test and other premises.
The vehicles are equipped with camera systems with different angles of coverage, focal lengths and sensor technologies, and in some cases with external microphones and other sensor systems. These systems collect, process and store video, image and audio data from the vehicle environment for the purposes described in Section 4 of this privacy notice.
This data may - depending on the individual use-case - also include the following personal information:
- photos and video sequences showing humans (including facial- and other features) and surroundings of road users in the vicinity of the test vehicles.
- license plates, other characteristics and surroundings of vehicles and other objects in the vicinity of the test vehicles.
- acoustic information from the vicinity of the test vehicles
- additional data from other sensor systems (such as radar, LIDAR) as well as GPS position and time stamp
3. Who is the responsible controller for the processing of the data and who can be contacted about data protection?
Within the scope of the “Automated Driving Alliance” project, the cooperation partners are jointly responsible pursuant to Art. 26 (1) GDPR for the data processing activities described below.
For these specific data processing activities, the legally required joint controllership agreement has been concluded between the cooperation partners.
For more information on the joint controllership, please see Section 9.
Joint Controllers:
Robert Bosch GmbH
Robert-Bosch-Platz 1
70839 Gerlingen- Schillerhöhe
Germany
and
CARIAD SE
Berliner Ring 2
38440 Wolfsburg
Germany
If you would like to contact us, please use the following contact options:
E-Mail: privacy@automated-driving-alliance.com
To exercise your data subject rights and to report data protection incidents, you can contact both cooperation partners Data Protection Departments:
Data Protection Officer - Robert Bosch GmbH:
Abteilung Informationssicherheit und Datenschutz Bosch-Gruppe (C/ISP)
Postfach 300220
70442 Stuttgart
Germany
E-Mail: DPO@bosch.com
Data Protection Officer - CARIAD SE::
Berliner Ring 2
Brieffach 1080/2
38440 Wolfsburg
Germany
E-Mail: privacy@cariad.technology
4. What is the data used for (purpose of processing) and on what basis (legal basis) does this happen?
The purposes of the data processing are research, development and testing in the areas of driving assistance systems, automated driving, driving functions and other services, including the documentation of these processes and fulfilment of other downstream obligations.
Research, development and testing of such systems require their use in test vehicles under real environmental and traffic conditions - also in public traffic areas - including the acquisition, processing and storage of video, image and audio recordings during and after these operations.
These data sets are used to research, develop and test technical systems for the perception and classification of road users, vehicles, infrastructure and other objects in the context of traffic and environmental situations.
Persons, vehicles, other objects and audio information are only analyzed, classified and processed as "objects" in the context of traffic and environmental situations, e.g. as
- pedestrian on the right-hand side of the road
- car at an intersection
- siren signal behind the vehicle
Typically, it is not possible to identify persons by name or otherwise personally or to assign detected vehicles or objects to specific persons in this way from the video, image and audio material, and the detection mostly only takes place very briefly as the vehicle passes by.
However, identifiability and identification of natural persons cannot be completely precluded in special situations (e.g. traffic lights, traffic jams, pedestrian crossings), so that the cooperation partners consider the processed data to be personal data according to Art. 4 (1) GDPR.
The primary legal basis of the processing is Art. 6 (1) lit. f) GDPR, a so called "legitimate interest". The legitimate interest of the controller is to carry out research, development and testing on driving assistance systems, automated driving, driving functions and other services.
The conflicting interests, fundamental rights and freedoms of the data subjects do not outweigh this, as identification by name or other personal identification of individual data subjects is neither necessary nor envisaged. In addition, technical and organizational measures are taken to ensure that the data collected is processed in accordance with data protection requirements.
5. Transfer of personal data to other recipients
The data is only shared with other companies affiliated with the BOSCH or CARIAD group, with cooperation partners, development partners, data processors or other third parties within purposes described above.
Data will only be disclosed if it is legally permissible due to legal provisions and / or official or judicial orders or if the third party has a legitimate interest.
Categories of recipients to whom data may be disclosed within the scope of the purposes described above are in particular:
- Internal and external cooperation partners as well as development partners of the persons responsible within the framework of the research and development processes.
- Suppliers within the scope of the research and development processes.
- Other service providers (in particular IT service providers as well as service providers for data processing / data evaluation).
If data is transferred to recipients in third countries as part of the research, development and testing processes or downstream processing, this will only be done if an adequacy decision has been taken in accordance with Art. 45 GDPR, on the basis of suitable guarantees within the meaning of Art. 46 GDPR or if permitted under other applicable law.
6. Automated decisionmaking
There is no automated decision making, nor a “profiling” subsequent to Art. 22 GDPR taking place.
7. Retention of personal data
The video and image data is processed and stored for as long as is necessary for the research, development and testing processes mentioned. If, on a case-by-case basis, there is a further legal basis or a further legitimate interest for continued storage and processing (for example, for the proper documentation of the aforementioned processes, due to legal retention obligations or other legal requirements), the data will be stored for a correspondingly longer period.
8. Data subjects’ rights towards the joint controllers
The GDPR sets out the following data subjects’ rights, that can be exercised against any of the joint controllers.
Additional information on the exercise of data subjects' rights:
This is a "processing activity for which the identification of the data subject is not necessary" according to Art. 11 GDPR. No additional identification features of data subjects are processed beyond the video, image and audio data collected.
Exercising and fulfilling data subject rights will therefore - depending on the individual case - often require further information from the data subject, in particular information on the LOCATION and TIME at which he or she may have been affected by the joint processing (i.e. information on when and where you were specifically in the vicinity of one of the trial vehicles). This additional information may be necessary, in order to determine whether a specific person is affected by the joint processing at all and to actually be able to fulfil the rights mentioned below, such as access, erasure, etc.
- Right of access: Data subjects have the right to request information on whether personal data in question are being processed. If data are processed, data subjects have the right to be informed about these data as well as about the modalities of the processing in accordance with Art. 15 GDPR.
- Right to rectify inaccurate data: Data subjects have the right to request the correction of personal data in question.
- Right to erasure: Data subjects have the right to request the erasure of personal data concerning them.
- Right to restriction of processing: Data subjects have the right to request restriction of the processing of their data.
- Right to object: Data subjects have the right to object to the processing of their personal data.
-
Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a data protection authority. To do so, you can contact the data protection authority responsible for your place of residence or federal state or the data protection authority responsible for each of the cooperation partners.
Data protection authority responsible for Robert Bosch GmbH::
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Visitor Adress:
Lautenschlagerstraße 20
70173 Stuttgart
GermanyPostal Adress:
Postbox 102932
70025 Stuttgart
GermanyTel.: +49 (711)/615541-0
FAX: +49 (711)/615541-15
E-Mail: poststelle@lfdi.bwl.deData protection authority responsible for CARIAD SE::
Die Landesbeauftragte für den Datenschutz Niedersachsen
Visitor Adress:
Prinzenstraße 5
30159 Hannover
Germany
Postal Adresse:
Postbox 221
30002 Hannover
DEUTSCHLANDTel.: +49 (511)/120 4500
FAX: +49 (511)/120 4599
E-Mail: poststelle@lfd.niedersachsen.de
Special remarks on the restrictability of data subjects' rights:
We would also like to point out that, in the context of the present processing, your rights under Art. 15 GDPR (right of access), Art. 16 GDPR (right to rectification), Art. 17 GDPR (right to erasure), Art. 18 GDPR (right to restriction of processing) and Art. 21 GDPR (right to object) may be subject to special additional restrictions. These special restrictions apply if the exercise and fulfilment of these rights in the specific case would probably make the realisation of research purposes impossible or seriously impair them and the restriction is therefore necessary for the fulfilment of these research purposes.
This special restrictability and its requirements result in particular from Art. 89 GDPR in conjunction with § 27 BDSG and from Art 17 GDPR.
Contact persons are listed in Section 3.
9. Information on joint controllership according to Art. 26 GDPR
What is the reason for the joint controllership of the cooperation partners?
Robert Bosch GmbH and CARIAD SE work closely together in function and vehicle development as part of the “Automated Driving Alliance” project. This also applies to the processing of personal data, insofar as this has been collected by corresponding development vehicles. The cooperation partners have jointly defined the processing phases of this data in the individual process stages. They are therefore jointly responsible for the protection of your personal data within the process steps described below (Art. 26 GDPR).
For which process stages is there joint controllership?
The joint controllership of the cooperation partners includes the collection, storage and further processing of video, image and audio data. The cooperation partners collect data on test vehicles and transmit it to a common IT system where the data is stored and can be accessed or processed by both cooperation partners for research, (further) development and testing purposes.
Outside the project, the cooperation partners can process data under separate responsibility, provided this is legally permissible.
What have the parties agreed?
As part of their joint controllership under the GDPR, the cooperation partners have also agreed that the collection of data also fulfils the information obligations under Art. 13 and 14 of the GDPR with regard to joint controllership.
What does this mean for data subjects?
Data protection rights can be asserted both with Robert Bosch GmbH and with CARIAD SE through the contact data provided in Section 3. The cooperation partners will inform each other without delay about requests from data subjects. They will provide each other with all information necessary to respond to such requests in a timely manner.