Information on data protection in accordance with Art. 13 and 14 GDPR for data collection in public spaces as part of the mFund collaborative project of the Federal Ministry for Digital and Transport (Bundesministeriums für Digitales und Verkehr) ‘AutoMap’ - Funding code: 19F2256A/B

The joint data controllers within the meaning of the EU General Data Protection Regulation (GDPR) and other national data protection laws of the member states, as well as other data protection regulations, are:

Gottfried Wilhelm Leibniz Universität Hannover

Geodetic Institute

Nienburger Straße 11

30167 Hannover

Tel. +49 511 762-2462

Fax +49 511 762-2468

E-mail: office@gih.uni-hannover.de

Quality Match GmbH

represented by Dr Daniel Kondermann (managing director)

Häusserstraße 36

69115 Heidelberg

Tel.: +49 1514 125985

E-mail: privacy@quality-match.com

The data controllers have concluded an agreement in accordance with Article 26 of the DSGVO, which regulates the rights and obligations with regard to the processing of personal data. Pursuant to Section 5 of this agreement, both parties have undertaken to ensure compliance with the statutory provisions and to take all necessary technical and organisational measures to ensure that the rights of data subjects can be guaranteed at all times within the statutory deadlines.

It was also agreed that Leibniz University Hannover and, in this case, the project-executing agency, the Geodetic Institute, would act as the point of contact for data subjects and provide data subjects with the compulsory information in accordance with Articles 13 and 14 of the DSGVO.

Data Protection Officer of Leibniz University Hannover:

Gottfried Wilhelm Leibniz Universität Hannover

- Data Protection Officer -

Welfengarten 1

30167 Hannover

Tel. +49 511 762-0

Fax +49 511 762-8258

E-Mail: datenschutz@uni-hannover.de

Website

The aim of the above-mentioned collaborative project is to develop a robust positioning system for autonomous vehicles based on recorded environmental information and GNSS/IMU data.
Cutting-edge sensors collect environmental information, which is then compared with high-resolution 3D city models. The focus of the study is the development of real-time data analysis for automated object recognition. The system should be able to be used across a wide area and in different traffic scenarios and environments.

Data recordings in public spaces are essential for the implementation of the project goal. The primary focus is on the collection of building data (3D structure of the building facade), which is collected by driving on city streets. The Geodetic Institute of the Leibniz University Hannover is the data controller for the collection of this raw data (data with personal reference). The Geodetic Institute collects the data by driving a test vehicle on public roads. The data mentioned below is collected by the respective technology:

1. image data (using digital cameras)
2. 3D point clouds (using mobile LiDAR systems (light detection and ranging sensors) to create maps of the surrounding area) and
3. position data (using GNSS (Global Navigation Satellite Systems) for positioning and IMU (Inertial Measurement Unit) for orientation)

In public spaces, personal data or data that can be linked to a person is inevitably captured by chance. Only the data collected by the digital cameras (image data) is relevant, as only this data allows personal data or data that can be linked to a person to be recognised.

LiDAR is a technology that uses laser beams to scan the environment. The images of the surroundings created by the reflected beams do not allow any conclusions to be drawn about individuals due to the quality of the representation and are already used in advanced driver assistance systems (ADAS).

The image data collected consists of randomly captured images of

• passers-by and
• road users,
• vehicle licence plates,
• vehicle inscriptions,
• building facades, etc.

The following figures show how the sensors and cameras are attached to the vehicle and distributed during the data collection campaign:

The collected data (raw data) is initially stored in encrypted form on a hard drive (data logger) in the test vehicle after the data has been collected and transferred from the data logger to the institute's own workstation after reaching the institute. The Geodetic Institute anonymises personal data immediately and before further use of the data using an anonymisation algorithm that pixelates or generally renders unrecognisable data with personal references. Inscriptions on facades and vehicles are excluded from the process, as it is assumed that the data subjects want to be publicly displayed and, in particular, there is no 100% reliable procedure for this. The anonymisation process is validated on a random basis and checked for remaining personal data and vehicle licence plate numbers. In case of doubt, records that have not been sufficiently anonymised are deleted.
As part of an experiment, the AI-supported software chosen for anonymisation was tested in a scenario that was realistic for the productive phase. The evaluation showed that the software anonymises personal data and vehicle registration plate data very reliably. The few data that were not fully anonymised were cases with low image resolution or fragments that did not contain any direct identification features. This means that a high degree of anonymity was already guaranteed by the original and unprocessed image information. Although (re-)identification cannot be completely ruled out here, it would require a disproportionate amount of effort, so it can be effectively excluded.
The user data sets that have been cleaned in this way are transmitted to the project partner, Quality Match GmbH, via a secure data line for further processing.

The legal basis for the processing of your personal data by Leibniz University Hannover is Article 6, para. 1, lit. e), para. 3 of the DSGVO in conjunction with § 13 of the NDSG (processing of personal data for scientific or historical research purposes).
The legal basis for the processing of personal data by Quality Match GmbH is Art. 6, para. 1, lit. f of the DSGVO (processing of personal data to safeguard legitimate interests).

at the Geodetic Institute:

at Quality Match GmbH:

Your personal data mentioned above will be stored for as long as it is needed for the purposes mentioned above.
The following deadlines for anonymisation or deletion of data have been set separately:

You have the following rights with regard to your personal data (in accordance with Articles 15 to 21 of the DSGVO):

• Right of access to the data concerned (Art. 15 DSGVO)
• Right to rectification of the data (Art. 16 DSGVO)
• Right to erasure of the data (Art. 17 DSGVO)
• Right to restriction of processing (Art. 18 DSGVO)
• Right to data portability (Art. 20 DSGVO)
• Right to object to processing (Art. 21 DSGVO)

You have the right to object to the collection and processing of data at any time. The researchers will then no longer process your data unless there are compelling legitimate grounds for the processing or the processing is necessary for the establishment, exercise or defence of legal claims.

In the case of manifestly unfounded or excessive applications, we may demand a reasonable fee. Otherwise, the information will be provided free of charge (Art. 12 para. 5 DSGVO).

In the event of justified doubts as to the identity of the person asserting the above rights, we may request additional information necessary to confirm the identity (Art. 12 para. 6 DSGVO).

After data collection, personal data is stored for a maximum of seven days (raw data). After that, anonymisation takes place so that the data can no longer be assigned (user data). Data subjects' rights can no longer be implemented after anonymisation due to a lack of personal reference.

You have the right to complain to the supervisory authority if you believe that the processing of personal data concerning you is in breach of the law:

The State Officer for Data Protection in Lower Saxony

Prinzenstr. 5

30159 Hannover

Tel. +49 511 120 - 4500

Fax +49 511 120 - 4599

E-Mail: poststelle@lfd.niedersachsen.de

When you contact us by email, we store the data you provide (your email address, possibly your name and your telephone number) in order to answer your questions. We delete the data collected in this context once it no longer needs to be stored, or we restrict the processing of it if there are statutory retention requirements.