Volkswagen fined for not providing data subjects sufficient information about the data processing Summary The Decision of the State Commissioner for The police stopped a vehicle for a traffic check near Data Protection (LfD) Lower Saxony Salzburg (Austria), as the police officers noticed The DPA imposed a fine of 1,1 mio EUR for the following unusual attachments to the vehicle that turned out violations: to be cameras. The vehicle was part of a research program that tested and trained a driver assistance • Not providing the other road users sufficient system in order to further avoid traffic accidents. information about the processing (GDPR, Article 13). Among other things, the vehicle recorded the • Not concluding a data processing agreement with surrounding traffic for error analysis. The research the company that carried out the testing (GDPR, trip was carried out by a service provider on behalf Article 28). of Volkswagen. Due to an accident, the vehicle was missing magnetic signs that were meant to inform • Not maintaining a record of processing activities other road users about the recording. (GDPR, Article 30). Even though the data processing took place in Austria, • Not carrying out a data protection impact The State Commissioner for Data Protection (LfD) assessment (GDPR, Article 35). in Lower Saxony handled the case as Volkswagen, All four violations were ‘low severity’. Additionally, the the controller of the processing of personal data, is DPA took into account that the processing served to primarily situated in Germany. optimize the driving assistant system, thus improving road safety. Published: 26-07-22 Journal number: N/A 48