GDPR guidance for automated driving systems provided in Germany

In its recently published annual report for 2022, the Baden Württemberg data protection authority considered how the use of sensors and camera technology might involve the processing of personal data when the technology is used to enable vehicles to detect and avoid objects, and the extent to which any personal data is subsequently disclosed to the vehicle drivers.

The Baden Württemberg data protection authority said it had visited Mercedes-Benz and inspected an automated driving system it has developed that uses a range of technologies – from light detection and ranging (LiDAR) to radar, ultrasound and wetness sensors, and cameras – to detect objects in the vehicle’s environment.

Munich-based data protection law expert Daniel Widmann of Pinsent Masons said that the authority’s comments in its annual report provide an insight to its current position regarding data processing in the context of assistive or self-driving systems.

“In respect of the Mercedes-Benz system, the Baden Württemberg data protection authority highlighted positively the fact that the data displayed on the digital cockpit screen is reduced to the information which is relevant for the driver and is not a simple unfiltered summary of everything that the car ‘sees’ around itself,” Widmann said.

“Even though personal data may initially be processed at the moment of recording, the authority was unable to identify any indicators of identifiers in the metadata that is processed onboard or displayed in the cockpit. If the data is immediately converted into metadata and the original video sequences are irreversibly deleted without any technical possibility of accessing it, the authority said it is doubtful whether processing of personal data within the meaning of the GDPR takes place and therefore whether the GDPR applies to the data at all. It said that even if the GDPR is applicable, the legitimate interests in processing this data outweigh any minor intrusion there may be to the privacy of the data subjects,” he said.