Volkswagen fined 1.1 million euros for using a vehicle with cameras

Volkswagen fined 1.1 million euros for using a vehicle with cameras

The Lower Saxony data protection authority has fined Volkswagen Aktiengesellschaft 1.1 million euros under Article 83 of the General Data Protection Regulation (GDPR).

Is it legal to install video surveillance cameras in a vehicle facing the public road?

You have probably seen thousands of videos of accidents recorded by other cars, or even robberies of third parties recorded from vehicles parked on public roads. 

Cameras to record everything that happens around our car, also known as Dashcam or on board cameras, are increasingly used to record a journey, make videos for Youtube or even to use the videos as evidence in possible traffic accidents. 

Nowadays we can find an endless number of these products and for all tastes: cameras with night vision, with anti-vandalism and anti-theft systems for the car, among others.

However, it is important to note that before buying any of these devices, we should examine each case to determine whether using a camera in the car could lead to any type of sanction. The use of this technology will be legal or illegal depending on where and how it is used.

This is precisely what prompted the Lower Saxony State Data Protection Commissioner to impose such a fine on Volkswagen for violations of data protection law committed by a Volkswagen vehicle during the testing of a new driver assistance system to prevent traffic accidents.

The vehicle in question was missing identification signs with a camera symbol and other information required under data protection law.

According to Article 13 of the GDPR, where personal data of an individual, in this case other road users, are processed, they must be informed, among other things, about who is processing the data, for what purpose and for how long the data will be kept.

Under what circumstances is it legal to be recorded with a car camera?

It all depends on the use we make of these cameras in the car and the images we capture from them, which will determine the legality or illegality of both the device installed and the content recorded on it. In this regard, it is important to remember what is the limit that separates a recording for video surveillance purposes and what would be a recording within the personal or domestic sphere.

The processing of images carried out by a natural person in the context of purely personal or domestic activities is not covered by the obligations imposed by the data protection legislation in force. This is laid down in Article 2(1)(c) of the GDPR. However, if the data are made available or made known to an indeterminate number of persons, e.g. through publication on social media, data protection law would apply.

AEPD ruling on these video-surveillance systems

The Spanish Data Protection Agency (AEPD) questions “the legality of a video surveillance system in which the generic purpose would be to obtain evidence to denounce the possible infringement of traffic regulations”. 

The AEPD establishes that “any processing of personal data must be legitimized by one of the grounds of art. 6 of the RGPD” and therefore “it will be necessary to assess whether there is a legitimate interest”.

“The purpose of the processing is legitimate taking into account its link to the right to judicial protection, excluding the use of the images for other purposes such as labour control, as well as the recording of the sound inside the vehicle, which will be deactivated when it is marketed in Spain. The link to the right to judicial protection is specified in the fact that the images will only be accessed when an event takes place that is identified with accidents or dangerous situations inside the vehicle, susceptible of generating responsibilities in the jurisdictional sphere”.

“The marketing of the device is limited to public and private means of transport licensed for the transport of persons and/or goods, excluding its installation in other types of vehicles. The recording of images towards the outside is limited to the front of the vehicle and, towards the inside, it excludes the recording of the driver’s image. In addition, the recordings made are progressively cancelled and can only be recovered in the event of an event”.

Consequently, and according to the AEPD, the recording of images is legitimate when the images are only accessed at specific times and when the capture of images is limited, in accordance with the principle of minimization.

Regarding access to these recorded videos, the AEPD recommends that “it should be restricted to specifically authorized persons with specific credentials”. In addition, the processing of these images should “blur those of persons or other data such as number plates who are not involved in it”.

The AEPD also specifies a limitation on the time of the recordings. “In such a case, the recovery of the recordings is limited to a maximum period of time of 20 seconds before and after the moment of the event”. Likewise, “a temporary period of conservation of the images is foreseen for a maximum period of three years, which is justified as this is the statute of limitations period for very serious infringements”.