The Lower Saxony data protection authority ('LfD Niedersachsen') announced, on 26 July 2022, that it had issued a decision in which it imposed a fine of €1.1 million to Volkswagen AG, for violation of Articles 13, 28, 35, and 30 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following a traffic control by the Austrian police.

Background to the decision

In particular, the LfD Niedersachsen reported that a Volkswagen test vehicle had been stopped by the Austrian police in 2019, following which the police officers had noticed unusual attachments on the vehicle, which turned out to be cameras. More specifically, the LfD Niedersachsen explained that the vehicle was used to test and train the functionality of a driving assistance system to avoid traffic accidents and that the traffic around the test vehicle was recorded for error analysis.

Findings of the LfD Niedersachsen

Further to the above, the LfD Niedersachsen found that:

• due to an oversight, the test vehicle was missing the information signs that would have been warranted pursuant to Article 13 of the GDPR;
• Volkswagen had not concluded a processing agreement with the company that carried out the drives, thus violating Article 28 of the GDPR;
• no Data Protection Impact Assessment ('DPIA') had been carried out pursuant to Article 35 of the GDPR; and
• there was no explanation of the technical and organisational security measures in the list of processing activities, resulting in a violation of the documentation requirements pursuant to Article 30 of the GDPR.

However, the LfD Niedersachsen highlighted that no violations had been found with regards to the collection and further processing of personal data that occurred in the process.

In light of the above, the LfD Niedersachsen imposed a fine on Volkswagen, taking into account the fact that the violations were of low severity and that Volkswagen had promptly remedied its deficiencies. Notably, the LfD Niedersachsen explained that, due to the cross-border nature of the data processing in question, before issuing the penalty notice, it had involved other European data protection authorities in the context of the cooperation procedure established under Article 60 of the GDPR.

Outcomes

In conclusion, the LfD Niedersachsen imposed a fine of €1.1 million on Volkswagen, which it accepted.

You can read the press release, only available in German, here.