Data protection in the Test Bed Lower Saxony

Data protection declaration

The German Aerospace Center (hereinafter referred to as “DLR”), takes the protection of your personal data, with which you provide us in your capacity as a data subject (m/f/d) in connection with the “Test Bed Lower Saxony for automated and connected mobility” project, very seriously.

We would like to provide you with information concerning the personal data which we process within the framework of the project “Test Bed Lower Saxony for automated and connected mobility” as well as the length of time and the purposes for which we do this, and to additionally inform you regarding further information required by the data-protection law.

In accordance with the GDPR (General Data Protection Regulation (EU)) and the BDSG (Bundesdatenschutzgesetz - German federal data protection act), we use the terms defined therein. The definitions can be viewed on the Internet: for the GDPR at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ%3AL%3A2016%3A119%3ATOC and for the BDSG at http://www.gesetze-im-internet.de/bdsg_2018/__2.html .

1. Name and address of the responsible body

The responsible body as defined by the GDPR is:
German Aerospace Center (DLR)
Institute of Transportation Systems
Lilienthalplatz 7
38108 Braunschweig
Internet: https://www.dlr.de/EN/Home/home_node.html

2. Name and address of the Data Protection Officer

German Aerospace Center (DLR)
Data Protection Officer Uwe Gorschütz
Linder Höhe
51147 Köln
E-Mail: datenschutz@dlr.de

3. Purpose of the data processing

The purpose of the data processing is scientific research.

4. Legal basis for the data processing

The legal basis for the processing is Article 6(1)(f) of the GDPR and Article 89 GDPR in conjunction with § 27 BDSG. Important notice: By reason of the legal basis, Art. 89 (2) GDPR (scientific research) is enforced subject to the exceptions to the rights under Articles 15, 16, 18 and 21. See point 8.

5. Data categories

Procedure (depending on current research issue)

Data variant 1:   

Anonymised data of traffic participants (m/f/d) in the form of movement paths:

The camera systems temporarily record personal and person-related image data of the traffic and/or traffic participants (m/f/d) using the motorway.

The collected personal and person-related image data are automatically stored in a volatile random-access memory (cache) for approx. 350 ms and extracted into anonymised scientific vector data by means of real-time processing (algorithm). These vector data contain solely information concerning the movement paths.

Data variant 2:   

Validation of the scientific research data:

For the validation of the scientific research data and the algorithm, temporary recordings of the traffic and/or the traffic participants (m/f/d) using the motorway may be necessary in individual cases. These video data are deliberately stored in such a low resolution that neither faces nor number plates can be clearly identified. The video data are deleted as soon as the purpose of the processing no longer applies.

6. Receiver/third parties

Data processing in the research institution

Within the framework of the research projects, it may become necessary for us to transfer your personal data (see 5. Data categories) to the DLR institute responsible for the respective test evaluation.

External bodies involved in research

In order to achieve the planned research results, it may be necessary for us to transfer your personal data (see 5. Data categories) to other parties involved in research outside DLR. These parties are regularly bound to secrecy and confidentiality as regards the handling of your personal data. In the case of contract processing being involved within the framework of this outsourcing of research to external entities outside DLR, a contract shall be concluded in accordance with the requirements of Art. 28 GDPR, thereby guaranteeing an appropriate level of data protection.

External service providers

Our external service providers, who carry out data processing on our behalf, are contractually obligated, in compliance with Art. 28 GDPR or a cooperation agreement, to treat personal data in accordance with the applicable regulations. Insofar as the external service providers process your personal data (see 5. Data categories), we have ensured, through legal, technical and organisational measures as well as through regular inspections, that they comply with the provisions of the data-protection laws.

7. Storage

The personal data (see 5. Data categories) are stored on an internal, secure DLR server, which is maintained by a central, certified DLR provider.

8. Deletion

The personal data (see 5. Data categories) of the data subject are deleted as soon as the purpose of the processing ceases to exist. Data may also be stored if these have been provided for by the European or national legislator in EU regulations, laws or other regulations to which the data controller is subject.

9. Your rights with respect to your personal data

If your personal data (see 5. Data categories) are processed, you are a data subject in accordance with the GDPR and you are entitled to the following rights vis-à-vis the person responsible pursuant to the regulations stated below:
(1) In accordance with Art. 15 GDPR, you may request information concerning the personal data processed by us. In particular, you may request information on the purposes of the processing, the category of personal data, the categories of recipients to whom your personal data have been or will be disclosed, the planned storage period and the existence of the rights explained in sections 4 and 6 here.
(2) In accordance with Art. 16 GDPR, you may demand the immediate correction of incorrect or incomplete personal data stored by us.
(3) In accordance with Art. 17 GDPR, you may demand the deletion of your personal data stored with us, unless processing is necessary for reasons stated by law, in particular to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or potentially defend legal claims.
(4) In accordance with Art. 18 GDPR, you may demand the restriction of the processing of your personal data if you dispute its accuracy, if the processing is unlawful but you refuse to allow its deletion and we no longer require the personal data, whereas you require it for the assertion, exercise or defence of legal claims or you have lodged an objection to the processing in accordance with Art. 21 GDPR.
(5) In accordance with Art. 20 GDPR, you may receive your personal data that you have provided us with in a structured, common and machine-readable format, or request that it be transferred to another responsible party.
(6) In accordance with Art. 7 (3) GDPR, you may revoke any consent you have given us in regard to data protection at any time. As a result, we may no longer in the future continue to process the data which was based on this consent.
(7) In accordance with Art. 21 GDPR, Right of objection
If personal data are processed on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right to object, pursuant to Article 21 of the GDPR, to the processing of your personal data provided that grounds exist therefore which arise from your particular situation or which are in objection to direct marketing. In the latter case, you have a general right of objection, which we will implement without the specification of a specific situation, unless the processing is necessary for the fulfilment of a task performed in the public interest, Art. 21 (6) of the GDPR.
(8) In accordance with Art. 77 GDPR, you may lodge a complaint with a supervisory authority. As a rule, the supervisory authority of your usual place of residence or workplace or the seat of the responsible body/person is available for this purpose.
In order to exercise these rights, please contact the authority indicated in section 2.

FAQs

Are personal data stored?

No.

Are personal video data processed?

Yes, the cameras capture all moving objects which move through their field of view. This information is processed in real time (milliseconds) via automated processes, anonymised, and the high-resolution video data is deleted directly.

What is stored?

Movement paths of the anonymised objects or video data (black-and-white) with low resolution, without number plates, colour or faces.

For what purpose are the data processed?

For scientific research.

Is there a creation of personalised driving profiles?

No.

Is the test bed used to punish speeding?

No.

Are number plates stored?

No.

Version: 20.01.2020