Data protection violations in the use of a service provider to test a driver assistance system at Volkswagen
Investigations were launched against Volkswagen, by the country’s data protection commissioner, after a test vehicle on which several cameras were mounted was caught in a traffic stop by Austrian police in 2019. The various cameras were used to capture the environment, which will be used to test and train a new assistance system. Several data protection violations came to light during the police check.
For example, the lack of information for data subjects about the data processing of the recordings by means of information signs, the lack of regulation of the activities of the contracted service provider, and the failure to properly document security measures in the list of processing activities were considered data protection violations.
Furthermore, no data protection impact assessment was carried out, although this would have been necessary due to the risk for data subjects.
Volkswagen cooperated with the data protection authority during the investigation and accepted the fine notice.
Art des Verstoßes:
Illegal data processing
Waren sensible Daten betroffen?:
Violation of GDPR Paragraph:
13. Information to be provided where personal data are collected from the data subject
30. Records of processing activities
35. Data protection impact assessment