Tracking: DPA Lower Saxony Fines Volkswagen €1.1 Million

The State Commissioner for Data Protections Lower Saxony (LFD) in Germany has investigated Volkswagen (VW) for allegations of unlawful data processing. VW used a test vehicle to experiment and train the functioning of a driver assistance system to avoid accidents. However, while doing this the system captured the surrounding vehicles for error analysis. Under GDPR it is unlawful to collect this information without notifying the road users whose data was captured. They should be made aware who was doing the processing, for what purpose and how long the data would be stored. 

The VW vehicle was stopped for a traffic check by the Austrian police who noticed unusual attachments on the vehicle. These turned out to be cameras and were being used to test and train the functionality of a driver assistance system. The cameras recorded the traffic situation around the vehicle, among other things, so it could be analysed. 

GDPR Regulations

The GDPR states that where personal data relating to a data subject are obtained from him or her, the controller shall provide the following, the:

• Identity and contact details of the controller and, where applicable, his representative
• Contact details of the data protection officer, where applicable
• Purposes of the processing for which the personal data are intended
• Legal basis for the processing

Following an accident, the vehicle was missing magnetic signs with camera symbols and other mandatory information required by the GDPR. It was also found after further investigation that VW had not concluded an order processing contract with the company that carried out the journeys. Under GDPR it would have been required to have a written contract between a controller and processor. In addition, there was no data protection impact assessment carried out. This would have highlighted which possible risks and their containment must be assessed before processing begins. 

The State Commissioner for Data Protections Lower Saxony ordered VW to pay a fine of €1.1 Million ($1,119,871 USD). VW has cooperated with the investigation fully and accepted the fine notice. 

To see more about GDPR news, click here.