Germany
Volkswagen
GDPR enforcement action by Data Protection Authority of Niedersachsen on 2022-07-26.
Case details
- Authority
- Data Protection Authority of Niedersachsen
- Date
- 2022-07-26
- Controller / Processor
- Volkswagen
- Sector
- Industry and Commerce
- Quoted Articles
- Art. 13 GDPR, Art. 28 GDPR, Art. 30 GDPR, Art. 35 GDPR
- Type of violation
- Insufficient fulfilment of information obligations
Summary
The DPA of Lower Saxony has imposed a fine of EUR 1. 1 million on Volkswagen.
The company had installed cameras on a test vehicle. The vehicle was being used to test and train the functionality of a driving assistance system to prevent traffic accidents. For this purpose, the traffic around the vehicle was recorded with the cameras.
However, Volkswagen failed to provide information in accordance with Art. 13 GDPR about the data processing by the cameras attached to the vehicle.
The DPA further found that, contrary to its obligation under Art. 28 GDPR, Volkswagen had not concluded a processing agreement with the company that carried out the journeys. Also, no data protection impact assessment pursuant to Art. 35 DSGVO had been carried out and the technical and organizational protection measures had not been outlined in the list of processing activities.
Volkswagen has cooperated extensively with the DPA.
Related fines