Data Privacy Statement

Data Processing by BMW and Valeo in the context of Parking Test Cars

Which entity is responsible for data processing?

Which data do we process and what do we use it for?

What is the legal basis for this data processing?

How long do we store your data?

How do we store your data?

Whom do we share data with and how do we protect you?

Data Processing by BMW and Valeo in the context of Parking Test Cars

The high standards you expect from our products and services are part of our guidelines for handling your data. Our aim is to create and maintain an ongoing relationship with you based on trust. The confidentiality and integrity of your personal data is our top priority.

We want to improve the vehicle comfort by introducing new technologies for further development of assisted, connected, partly and fully automated vehicle comfort parking functions and thus offer you an improved driving experience.

For this purpose, we use our appropriately marked test vehicles to record data from various sensors, including video recording of the vehicle environment.

Which entity is responsible for data processing?

The following parties act as Joint Controllers in the event of processing of personal data.

Bayerische Motoren Werke Aktiengesellschaft,
Petuelring 130, 80788 Munich, domicile and court of registry: Munich HRB 42243
(hereinafter "BMW")

and

Valeo Comfort and Driving Assistance, société par actions simplifiée (SAS), 6 rue Daniel Costantini, 94000 Créteil, France, domicile and court of registry Créteil (France), registered under No. 017 251 067 (hereinafter “Valeo”)

have jointly determined the order of the processing of your personal data in each section of processing. Therefore, they are joint controllers in the meaning of the General Data Protection Regulation (hereinafter "GDPR", Article 26 GDPR) and jointly responsible for data collection and processing in connection with the video recordings for the development of assisted, connected, partly and fully automated vehicle comfort parking functions.

Which data do we process and what do we use it for?

The personal data generated from the use of the marked Parking Test Cars about the vehicle environment are processed as follows.

The Parking Test Cars are equipped with various sensors (such as lidar, radar, ultrasonic sensor, GPS/localization) and video cameras. The surroundings of the Parking Test Cars can be recorded on video and stored for later analysis and combined with the other sensor data collected by various sensors described above.

The video recordings are used to create static and dynamic traffic objects. These can be roadblocks, barriers, cars, motorcycles, bicycles, pillars, walls and speed bumps etc. with their individual position and movement in relation to the test vehicle as well as the position and movement of pedestrians. To calculate the potential movement of the pedestrian - e.g. when a person wants to cross the road - the direction of their gaze can also be analysed.

The video and sensor data are used during the test drives to detect and respond to road users and parking situations with focus on indoor parking facilities and in close proximity of parking facilities entrances. In the later evaluation of the recordings, the video and sensor data are used to develop and improve the algorithms for the assisted, connected, partly and fully automated vehicle comfort parking functions.

However, we are not interested in determining the identity of a person, and the system is not configured for that purpose, as this is not necessary for the development of the assisted, connected, partly and fully automated vehicle comfort parking functions. All traffic objects are therefore only categorized as cars, motorcycles, pedestrians, etc. Nevertheless, recordings of individual road users, license plates or other personal data may be contained in these video recordings. In the images below you may see the recordings of other vehicles and pedestrians within the view field of a test vehicle. They are only recognized as "persons", "cars" or "trucks" by the algorithm and are classified accordingly. The images are not used to identify the passing pedestrians, the different car models, or their drivers.

The following images show the video recording (picture 1) and the information extracted by the software, consisting of the object identification "truck = pink square", "car = yellow square" and "person = blue square" (picture 2).

What is the legal basis for this data processing?

The legal basis for the collection and processing of these video recordings of the surroundings of the Parking Test Cars (including the recording of personal data such as video recordings of pedestrians, drivers) by us is the legitimate interest of BMW and Valeo pursuant to Art. 6 (1) lit. f GDPR.

BMW’s and Valeo’s legitimate interest in the processing and storage of these video recordings results from its interest in operating the Parking Test Cars in further developing the platform for assisted, connected, partly and fully automated vehicle comfort parking functions. During the development process, the data collected by the Parking Test Cars will be used to develop and validate the algorithms for different functions of partly and fully automated parking. Furthermore, there is also a legitimate interest in processing the data of the Parking Test Cars after the start of production, which is particularly important (i) to develop/validate updates of the software ("bug fixing") and (ii) to establish a defence in case of litigation or (iii) to comply with legal obligations, in particular with regulatory requirements.

In addition, BMW and Valeo have a keen interest in improving vehicle and road safety through the development of its driving systems. Also, this could serve the interest of the general public. The video recordings of test vehicle surroundings are necessary to help to ensure the safe use of the assisted, connected, partly and fully automated parking vehicles.

How long do we store your data?

We store your personal data only as long as required for the intended purpose in accordance with the applicable laws, and for a maximum of 36 months. As a developer of vehicle safety-related products, Valeo will retain a part of the collected data as evidence for product liability and compliance obligations for a maximum period of 15 years in its own responsibility.

If data is processed for multiple purposes, it will be deleted or stored in an anonymized form that cannot be directly traced back to you once the last intended purpose has been fulfilled.

How do we store your data?

We utilise state-of-the-art technology to store your data. The following safeguards are used, for example, to protect your personal data from misuse and or any form of unauthorised processing:

Access to personal data is restricted to a limited number of authorised persons for the stated purposes.

• The data collected is only transmitted and stored in an encrypted form.
• The IT systems used for processing data are segmented from other systems to prevent unauthorised access and hacking.
• Access to these IT systems is constantly monitored to detect and prevent misuse.

Whom do we share data with and how do we protect you?

In order to develop and validate safe and reliable algorithms for the development of the assisted, connected, partly and fully automated parking platform, we need to conduct test drives to generate enough test-driving hours for each hardware/software combination that is used in the field. This requires a very large amount of camera and sensor data, which cannot be captured by one company alone.

Therefore, we share your data generated by the Parking Test Cars among each other. BMW and Valeo may further each share this data with selected BMW Group companies or Valeo affiliates, respectively. We may further engage carefully selected service providers by data processing agreements to process data on BMW’s and/or Valeo’s instructions.

Each Party may individually and in its own responsibility share your data generated by the Parking Test Cars with its carefully selected cooperation partners.

Valeo’s cooperation partners may include:

OEM partners and their suppliers, in order to use video and sensor data to avoid duplicated and therefore unnecessary test drives, universities and institutes, in order to cooperate in the field of research and development, and suppliers (including development service providers, technology service providers, cloud service providers, and image processing software providers, etc.).

BMW’s cooperation partners may include:

OEM partners and their suppliers, in order to use video and sensor data to avoid duplicated and therefore unnecessary test drives, universities and institutes, in order to cooperate in the field of research and development, and suppliers (including development service providers and technology service providers). BMW’s transfer of video and sensor data to our cooperation partners is subject to strict purpose limitation (i.e. for development purposes in the field of automated parking).

BMW and Valeo and its cooperation partners will use this data in particular to (i) develop, validate and refine the software that will operate on the platform and (ii) to integrate the software into the vehicles. The data will be transmitted in encrypted form only.  

The video and sensor data will not be used to identify individuals. This means that BMW, Valeo or their respective cooperation partners do not identify individuals in the recordings since the identification of individuals is not relevant for the development of the assisted, connected, partly and fully automated vehicle comfort parking functions. For the development of these systems, it is only relevant and necessary to classify pedestrians as persons (as distinguished from cars or trucks, for instance) and their direction of movement.

Personal data will, as a general rule, be hosted and processed within the European Union. If, in rare cases, personal data will be processed outside the European Union, BMW and Valeo have implemented appropriate measures to protect the personal data:

If data is processed in countries outside the European Union (EU) that are not determined by the European Commission as having an adequate level of personal data protection, the transferring Party uses EU Standard Contractual Clauses ("EU SCCs"), with appropriate technical and organisational measures, to ensure that your personal data is processed in accordance with European data protection standards.

The European Union has already established a comparable level of data protection for certain countries outside the EU, such as the UK, Canada and Switzerland. Since the level of data protection is comparable, data transmission to these countries does not require the implementation of additional measures or conclusion of agreements.

If you would like to learn more about the processing of your data under the joint control and responsibility of the Parties, or if you would like to exercise your rights as data subject, you may contact us at any time under:

• BMW Customer Service – by sending an email to datenschutz@bmw.de

or

•  Valeo – by sending an email to dpo.external@valeo.com

You may also contact one of the company’s Data Protection Officers:

BMW AG
Datenschutzbeauftragter
Petuelring 130
80788 München, Germany

Valeo Comfort and Driving Assistance SAS
Data Protection Officer
100 rue de Courcelles
75017 Paris, France

The Parking Test Cars are marked for instance with the following or similar stickers, which are attached to the Parking Test Cars:

As the data subject, you may claim certain rights under the GDPR and other relevant data protection regulations.

The Parties jointly agreed on which obligations each Party fulfills under the GDPR. You may exercise your rights under the GDPR towards both Parties, BMW as well as Valeo. The Parties immediately inform each other about the exertion of the rights of a data subject and provide the other Party with all necessary information to fulfill the request. In principle, the reply will be provided by the Party to which you asserted his or her rights to.

In certain situations, we may be unable to respond to your request as a data subject due to legal requirements or based on the information available to us. For instance, we may not be able to retrieve images of recorded persons, since the persons recorded in the Parking Test Car environment cannot be identified without additional information, and processing such additional information would result in the processing of more personal data, thereby adversely affect the principle of data minimisation. In these cases, it may not be possible to fulfill your requests under Art. 15 to 20 GDPR except where you provide us with additional information that allows us to clearly identify you (e.g. by providing location, date, time when you assume you have been recorded, if you were a pedestrian or in another vehicle, your position in relation towards the vehicle). Even with this additional information we may not be able to verify your entitlement to access or delete the data where it is not sufficient to identify you, or since we do not identify any persons on the video recordings, and would therefore not know who the data subjects on the recordings are, where it would adversely affect the rights and freedoms of others.

During and immediately after the data collection activities of the Parking Test Cars (e.g. if you are a pedestrian within the camera’s field of view and you become aware of the recording), you can directly object and ask the test driver for the deletion of relevant data.

Under the GDPR, you are entitled to claim the following specific rights vis-à-vis BMW or Valeo as the data subject:

Right of access by the data subject (Art. 15 GDPR):

You have the right to request information on the data we hold about you from us at any time. This information includes, but is not limited to, the categories of data we process, the purposes for which it is processed, the source of the data if not collected directly from you, and, if applicable, the recipients with whom we have shared your data. You can obtain a copy of your data from us free of charge. If you require multiple copies, we reserve the right to charge you for these copies.

Right to rectification (Art. 16 GDPR):

You have the right to request that we rectify inaccurate data relating to you. Photographs or video recordings are by nature "correct" because they represent a photographed or recorded person in reality. We will not edit recordings in any way so that your stored data is accurate and up to date.

Right to erasure (Art. 17 GDPR):

You have the right to request that we erase your data, as long as the legal requirements for this are satisfied. This may be the case under Art. 17 GDPR if

• the data is no longer required for the purposes for which it was collected or otherwise processed.
• you withdraw the consent on which data processing is based, and there is no other legal basis for processing.
• you lodge an objection to the processing of your data and there are no legitimate reasons for processing, or you object to data processing for direct marketing purposes.
• the data was processed unlawfully, and provided that processing is not required.
• for scientific research purposes and provided that the deletion of the data is not likely to prevent or seriously affect the achievement of that objective.
• to establish, exercise or defend legal claims.

Right to restriction of processing (Art. 18 GDPR):

You have the right to request that we restrict processing of your data if

• you dispute the accuracy of the data – in which case processing may be restricted during the time it takes to verify the accuracy of the data.
• processing is unlawful, and you reject the deletion of your data, requesting that its usage be restricted instead.
• we no longer need your data, but you need it to establish, exercise or defend your rights.
• you have lodged an objection to its processing, as long as it is not certain that our legitimate reasons outweigh yours.

Right to data portability (Art. 20 GDPR):

You have the right to request that we transfer your data – if technically possible – to another responsible party. However, you may only enforce this right if data processing is based on your consent or is necessary for the performance of a contract. Rather than receiving a copy of your data, you may also ask us to submit the data directly to another responsible party specified by you.

Right to object (Art. 21 GDPR):

You have the right to object to the processing of your data at any time for reasons that arise from your particular situation, as long as data processing is based on your consent, on our legitimate interests or those of a third party. In this case, we will cease to process your data. This does not apply if we can show that there are compelling legitimate grounds for processing that outweigh your interests, or if we need your data for the establishment, exercise or defence of legal claims.

We make every effort to comply with all requests within one month. However, this period may be extended for reasons relating to the specific right or complexity of your request.  

BMW AG and Valeo Comfort and Driving Assistance SAS take your concerns and rights very seriously. However, if you believe that we have not responded in an appropriate manner to your complaints or concerns, you have the right to lodge a complaint with your local data protection authority or may have the possibility to seek judicial remedy.