In its decision dated July 4, 2019, GZ DSBD123.652/0001-DSB/2019, the data protection authority had to deal with the question of the permissibility of automated license plate recognition at a parking garage for the purpose of billing for the use of the garage.
The respondent is the operator of a major shopping center, which provides the use of a parking garage. When entering the parking garage of the respondent, the license plate number of the complainant’s car was automatically recorded by a camera before passing the entry barrier. The complainant alleged a violation in the right to secrecy as well as a violation of the prohibition of tying, since – in summary – the use of the parking garage was only possible if the automated registration of the license plate was tolerated. The respondent based the processing at issue on legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR.
The data protection authority first noted that, in addition to the license plate number, other personal data were processed, namely the exact time and place where the complainant as holder (and, in the present case, also driver) were located. Likewise, the information and labeling obligations were apparently not properly implemented, since the purpose of processing, namely the collection of the license plate number for the purpose of billing for the use of the garage, was not indicated on the sign in front of the entrance.
However, in the opinion of the data protection authority, this is irrelevant: although reasonable expectations must also be taken into account when weighing interests, automated license plate recognition for the purpose of billing for garage use is not unusual (cf. the decision of the DPA of March 18, 2019, GZ DSB-D196.007/0005-DSB/2019, which approved the content of rules of conduct pursuant to Article 40 (5) of the GDPR regarding garage and parking operations in Austria). In addition, the respondent has also cited appropriate technical and organizational measures to protect the complainant’s interests accordingly (including immediate deletion of personal data after settlement).
The data protection authority considers the legitimate interests to lie in the speed and efficiency of such processing in order to handle such short-use contracts (parking garage use). Conversely, the complainant has not put forward any legitimate interests; in particular, the respondent has not processed the complainant’s data for any purpose other than the settlement of accounts.
A possible infringement of the right set forth in Art. 7 Para. 4 GDPR was not to be addressed, since the respondent did not base the processing on consent pursuant to Art. 6 (2) GDPR. 1 lit. a GDPR has been based. A violation of the information obligations according to Art. 13 DSGVO
was not the subject of the proceedings.
The appeal was therefore dismissed and the decision is final.