Germany: Ambient scan in autonomous driving only non-targeted fleeting data acquisition

 

Autonomous driving raises a number of questions not only from a technical point of view, but also from a data protection point of view. The world of data protection is currently particularly concerned with whether the filming of the route, and thus also of people and license plates, constitutes data processing.

In a nutshell: According to the literature, the scope of application of the GDPR has already not been opened up, since this form of recording is not to be regarded as an encroachment on the right to informational self-determination. The data is only collected in a non-targeted and fleeting manner and there is also no interest in identifying individuals.

This is justified by the fact that the car's protection system focuses more on the functions of pure object recognition. Furthermore, the sensor data would only be used at the moment and for the purpose of evaluating the obstacles - beyond that there would be no storage and thus no further processing of the data.

This opinion is supported by the case law of the BVerfG, which has already repeatedly dealt with the collection of data that is technically inevitable as a by-product of surveillance, such as the registration of vehicle number plates. As an exception, there is no interference with the fundamental right to informational self-determination if this data is made anonymous again immediately after the technical co-registration, so that no one can take note of it or even (further) process it.

Even if a person could access this data due to a technical deletion error, it must be taken into account that there is no interest in the re-identification of pure obstacle data in the case of autonomous driving, since this does not serve the original processing purpose. Although potential identifiability is sufficient in terms of data protection law, the low probability of actual identifiability must also be taken into account in the present case. This is not the case if the person disappears in the crowd due to a lack of additional identification features, as in the context of obstacle detection by autonomous vehicles.

We are also of the opinion that data processing within the meaning of the GDPR does not already exist if it is only a matter of fleeting data collection that was not intended and there is no interest in further use of the data or use has already been prevented due to technical measures.

It is important in practice to clearly document the connection between the unwanted data collection and the technical background for verification purposes.

 

For further information, please contact:

Diane Frank, Partner

e: diane.frank@schmid-frank.de

Wolfgang Schmid, Partner

e:  wolfgang.schmid@schmid-frank.de

SCHMID FRANK, Augsburg

#WLNadvocate #Germany #ITlaw #techlaw #technologylaw #legal #lawfirm #network #companylaw #GDPR #autonomousdriving