Data privacy notice on the collection of video, image and audio data as part of the project “Automated Driving Alliance” between Robert Bosch GmbH and CARIAD SE

The protection of personal data has the highest priority for Robert Bosch GmbH and CARIAD SE (hereinafter "cooperation partners") and is taken into account in all our business processes. The following data protection information provides an overview of the processing of personal data by the cooperation partners as joint data controllers. Personal data means any information relating to an identified or identifiable natural person.

With this data protection information, we provide information about the type, scope and purpose of the processing of personal data from the cooperation partners in the context of research and development on driving assistance systems, automated and autonomous driving, driving functions and other services, as well as the handling of this data. In addition, the page explains which data subject rights exist with regard to the processing of personal data and which essential processes with regard to the processing of personal data are established in the cooperation partners organizations.

1. Scope of application and addressees of this data privacy notice

This data privacy notice applies to the collection and processing of personal data within research and development projects related to driving assistance systems, automated and autonomous driving, driving functions and other services.

Potential addressees of this data privacy notice and data subjects to the data processing described herein, are all road users which are in the vicinity of one of the marked test vehicles during their operation.

2. Which types of personal data are processed by the cooperation partners?

Within the scope of the above-mentioned research and development purposes, marked test vehicles move in public traffic areas and - insofar as permitted by other laws - on private factory, test and other premises.

The vehicles are equipped with camera systems with different angles of coverage, focal lengths and sensor technologies, and in some cases with external microphones and other sensor systems. These systems collect, process and store video, image and audio data from the vehicle environment for the purposes described in Section 4 of this privacy notice.

This data may - depending on the individual use-case - also include the following personal information:

3. Who is the responsible controller for the processing of the data and who can be contacted about data protection?

Within the scope of the “Automated Driving Alliance” project, the cooperation partners are jointly responsible pursuant to Art. 26 (1) GDPR for the data processing activities described below.

For these specific data processing activities, the legally required joint controllership agreement has been concluded between the cooperation partners.

For more information on the joint controllership, please see Section 9.

Joint Controllers:

Robert Bosch GmbH
Robert-Bosch-Platz 1
70839 Gerlingen- Schillerhöhe
Germany

and

CARIAD SE
Berliner Ring 2
38440 Wolfsburg
Germany

If you would like to contact us, please use the following contact options:

E-Mail: privacy@automated-driving-alliance.com

To exercise your data subject rights and to report data protection incidents, you can contact both cooperation partners Data Protection Departments:

Data Protection Officer - Robert Bosch GmbH:

Data Protection and Informationsecurity Department of the Robert Bosch Group (C/ISP)
Postfach 300220
70442 Stuttgart
Germany

E-Mail: DPO@bosch.com

Data Protection Officer - CARIAD SE::

Berliner Ring 2
Brieffach 1080/2
38440 Wolfsburg
Germany

E-Mail: privacy@cariad.technology

4. What is the data used for (purpose of processing) and on what basis (legal basis) does this happen?

The purposes of the data processing are research, development and testing in the areas of driving assistance systems, automated driving, driving functions and other services, including the documentation of these processes and fulfilment of other downstream obligations.

Research, development and testing of such systems require their use in test vehicles under real environmental and traffic conditions - also in public traffic areas - including the acquisition, processing and storage of video, image and audio recordings during and after these operations.

These data sets are used to research, develop and test technical systems for the perception and classification of road users, vehicles, infrastructure and other objects in the context of traffic and environmental situations.

Persons, vehicles, other objects and audio information are only analyzed, classified and processed as "objects" in the context of traffic and environmental situations, e.g. as

Typically, it is not possible to identify persons by name or otherwise personally or to assign detected vehicles or objects to specific persons in this way from the video, image and audio material, and the detection mostly only takes place very briefly as the vehicle passes by.

However, identifiability and identification of natural persons cannot be completely precluded in special situations (e.g. traffic lights, traffic jams, pedestrian crossings), so that the cooperation partners consider the processed data to be personal data according to Art. 4 (1) GDPR.

The primary legal basis of the processing is Art. 6 (1) lit. f) GDPR, a so called "legitimate interest". The legitimate interest of the controller is to carry out research, development and testing on driving assistance systems, automated driving, driving functions and other services.

The conflicting interests, fundamental rights and freedoms of the data subjects do not outweigh this, as identification by name or other personal identification of individual data subjects is neither necessary nor envisaged. In addition, technical and organizational measures are taken to ensure that the data collected is processed in accordance with data protection requirements.

5. Transfer of personal data to other recipients

The data is only shared with other companies affiliated with the BOSCH or CARIAD group, with cooperation partners, development partners, data processors or other third parties within purposes described above.

Data will only be disclosed if it is legally permissible due to legal provisions and / or official or judicial orders or if the third party has a legitimate interest.

Categories of recipients to whom data may be disclosed within the scope of the purposes described above are in particular:

If data is transferred to recipients in third countries as part of the research, development and testing processes or downstream processing, this will only be done if an adequacy decision has been taken in accordance with Art. 45 GDPR, on the basis of suitable guarantees within the meaning of Art. 46 GDPR or if permitted under other applicable law.

6. Automated decisionmaking

There is no automated decision making, nor a “profiling” subsequent to Art. 22 GDPR taking place.

7. Retention of personal data

The video and image data is processed and stored for as long as is necessary for the research, development and testing processes mentioned. If, on a case-by-case basis, there is a further legal basis or a further legitimate interest for continued storage and processing (for example, for the proper documentation of the aforementioned processes, due to legal retention obligations or other legal requirements), the data will be stored for a correspondingly longer period.

8. Data subjects’ rights towards the joint controllers

The GDPR sets out the following data subjects’ rights, that can be exercised against any of the joint controllers.

Additional information on the exercise of data subjects' rights:

This is a "processing activity for which the identification of the data subject is not necessary" according to Art. 11 GDPR. No additional identification features of data subjects are processed beyond the video, image and audio data collected.

Exercising and fulfilling data subject rights will therefore - depending on the individual case - often require further information from the data subject, in particular information on the LOCATION and TIME at which he or she may have been affected by the joint processing (i.e. information on when and where you were specifically in the vicinity of one of the trial vehicles). This additional information may be necessary, in order to determine whether a specific person is affected by the joint processing at all and to actually be able to fulfil the rights mentioned below, such as access, erasure, etc.

Special remarks on the restrictability of data subjects' rights:

We would also like to point out that, in the context of the present processing, your rights under Art. 15 GDPR (right of access), Art. 16 GDPR (right to rectification), Art. 17 GDPR (right to erasure), Art. 18 GDPR (right to restriction of processing) and Art. 21 GDPR (right to object) may be subject to special additional restrictions. These special restrictions apply if the exercise and fulfilment of these rights in the specific case would probably make the realisation of research purposes impossible or seriously impair them and the restriction is therefore necessary for the fulfilment of these research purposes.

This special restrictability and its requirements result in particular from Art. 89 GDPR in conjunction with § 27 BDSG and from Art 17 GDPR.

Contact persons are listed in Section 3.

9. Information on joint controllership according to Art. 26 GDPR

What is the reason for the joint controllership of the cooperation partners?

Robert Bosch GmbH and CARIAD SE work closely together in function and vehicle development as part of the “Automated Driving Alliance” project. This also applies to the processing of personal data, insofar as this has been collected by corresponding development vehicles. The cooperation partners have jointly defined the processing phases of this data in the individual process stages. They are therefore jointly responsible for the protection of your personal data within the process steps described below (Art. 26 GDPR).

For which process stages is there joint controllership?

The joint controllership of the cooperation partners includes the collection, storage and further processing of video, image and audio data. The cooperation partners collect data on test vehicles and transmit it to a common IT system where the data is stored and can be accessed or processed by both cooperation partners for research, (further) development and testing purposes.

Outside the project, the cooperation partners can process data under separate responsibility, provided this is legally permissible.

What have the parties agreed?

As part of their joint controllership under the GDPR, the cooperation partners have also agreed that the collection of data also fulfils the information obligations under Art. 13 and 14 of the GDPR with regard to joint controllership.

What does this mean for data subjects?

Data protection rights can be asserted both with Robert Bosch GmbH and with CARIAD SE through the contact data provided in Section 3. The cooperation partners will inform each other without delay about requests from data subjects. They will provide each other with all information necessary to respond to such requests in a timely manner.