The protection of personal data is a top priority for us and is taken into account in all our business processes. The following data protection information provides data subjects with an overview of the processing of personal data by the consortium partners of the KISSaF research and development project listed under point 2 (hereinafter referred to as the consortium partners) as joint data controllers under data protection law (Article 26 (1) DSGVO) in connection with the processing of video and image data from test drives for the development of AI-based (artificial intelligence) situation interpretation for automated driving. Personal data means any information relating to an identified or identifiable natural person.

With this privacy notice, we inform data subjects about the nature, scope and purpose of the joint processing of personal data by the consortium partners in the context of the aforementioned research and development project. In addition, data subjects will learn what rights they have with regard to the joint processing of personal data and what the essential contents of the data protection agreement of the consortium partners contain with regard to the collection and processing of personal data.

Table of contents

1. To whom does this privacy notice apply?
2. Who is responsible for processing the data and whom can data subjects contact about data protection?
3. Where does the data come from and what data is processed?
4. What are the data used for (purpose of processing) and on what basis (legal basis) does this happen?
5. Will the data be passed on?
6. Does automated decision making take place?
7. How long is the data stored?
8. What rights do data subjects have vis-à-vis the consortium partners?

1 To whom does this data protection information apply?

Here, the consortium partners of the KISSaF research and development project inform data subjects about the protection of personal data during the joint collection, processing, and storage of video and image data in and from public traffic areas and - to the extent permitted by other law - on private factory, test, and other premises. This data will be collected by specially designated test vehicles of the consortium partners to conduct research, development, and testing of AI-based functions in the area of automated and autonomous driving. (Hereinafter, the Research and Development Project.

Potentially affected by this data processing is anyone who is in the visual environment of one of the designated test vehicles during the test operation.

2 Who is responsible for processing the data and whom can data subjects contact about data protection?

In the context of the aforementioned research and development project, the consortium partners are jointly responsible under data protection law for part of the data processing, such as the collection and storage of data in the course of the test drives, in accordance with Article 26 (1) of the GDPR. The exact scope of joint responsibility results from the processing activities of personal data described below. Apart from the jointly performed processing activities, the consortium partners are each independent data controllers within the meaning of Art. 4 No. 7 DSGVO and independently responsible for compliance with the applicable data protection law.

Data subjects can reach the consortium partners at the following contacts:

• Group Data Protection Officer ZF Friedrichshafen AG Löwentalerstrasse 2088046 Friedrichshafen E-mail: datenschutz@zf.com
• INGgreen Data protection Carl-Spaeter-Str. 76 56070 Koblenz sicherheit@ing-green.de
• Data Protection Officer TU Dortmund University Dortmund University of Technology August-Schmidt-Strasse 4 44227 Dortmund datenschutzbeauftragter@tu-dortmund.de

3 Where does the data come from and what data is processed?

In the context of the above-mentioned research and development project, a test vehicle marked by means of a clearly visible sticker moves in public traffic areas as well as - to the extent permitted by other law - on private factory, test and other premises. The vehicle is equipped with a camera system with different recording directions, focal lengths and sensor technologies, as well as other sensor systems. These systems collect, process and store video and image data from the vehicle environment for the purposes described in section 4 of this privacy notice.

This data may - depending on the individual case - also contain the following personal information:

• Persons (characteristics as well as behavior and surroundings of road users and other persons in the vicinity of the test vehicles).
• License plate numbers, other characteristics and surroundings of vehicles and other objects in the vicinity of the test vehicles
• Additional data from other sensor systems (such as radar, LIDAR) as well as GPS position and time stamp of data collection

4. what are the data used for (purpose of processing) and on what basis (legal basis) does this happen?

The above data will be recorded for the purpose of later analysis and processed by the consortium partners after the trip according to the project description. In particular, the video data will be used in a later evaluation to detect errors in models and driving functions and to classify them.

Data Collection: Recording of road traffic by means of a measurement system for the purpose of collecting training data in order to train object-classifying AI algorithms.

System Performance Test: Validation of signal progressions and possibly occurred errors with the help of the recorded video sequences, with which the prevailing traffic situation can be reproduced.

Capability & Robustness Test: see System Performance Test

Further details can be found in the project description, which can be requested from the consortium partners mentioned under point 2.

The legal basis of the processing is the "safeguarding of legitimate interests" according to Art. 6 para. 1 p.1 lit. f DSGVO. The legitimate interest of the controller here is the performance of research, development and testing of AI-based functions in the field of automated driving.

The conflicting interests, fundamental rights and freedoms of the data subjects do not outweigh this, as identification by name or other personal identification of individual data subjects is neither necessary nor envisaged and in most cases also not possible. Technical and organizational measures are also taken to ensure that the data collected is processed in a manner that complies with data protection requirements.

5 Will the data be passed on?

The consortium partners do not pass on personal data to third parties.

6. Does automated decision-making take place?

Automated decision-making in individual cases or profiling within the meaning of Art. 22 DSGVO does not take place.

7. How long will the data be stored?

The video and image data will be processed and stored for as long as is necessary for the aforementioned research development and testing processes. If, on a case-by-case basis, there is a legal basis beyond this or a further legitimate interest for continued storage and processing (for example, for the proper documentation of the aforementioned processes, due to legal retention obligations or other legal requirements), the data will be stored for a correspondingly longer period.

8 What rights do data subjects have vis-à-vis the consortium partners?

In the context of the joint processing of personal data, data subjects have the following rights vis-à-vis the consortium partners. These can be asserted against each consortium partner within the framework of data processing under joint responsibility.

Special information on the exercise of data subject rights:

This is a case of "processing for which identification of the data subject is not necessary" pursuant to Article 11 of the GDPR. No additional identification features of data subjects are processed beyond the video and image data collected.

Exercising and fulfilling data subject rights will therefore - depending on the individual case - often require further information from the data subject, in particular information about the LOCATION and TIME at which he or she may have been affected by the joint processing (i.e. information about when and where you were specifically in the vicinity of one of the test vehicles). This additional information may be necessary to determine whether a specific person is affected by the joint processing at all and to actually be able to fulfill the rights mentioned below such as information, deletion, etc.

• Right of access: data subjects have the right to request information as to whether personal data in question are being processed. If data is processed, data subjects have the right to information about this data as well as information about the modalities of the processing in accordance with Art. 15 DSGVO.
• Right to rectify inaccurate data: Data subjects have the right to request the rectification of concerning personal data. In the case of video and image data, this right can usually only be implemented through deletion.
• Right to erasure: Data subjects have the right to request the erasure of personal data concerning them.
• Right torestriction of processing: data subjects have the right to request restriction of the processing of their data.
• Right to lodge a complaint with a supervisory authority: Data subjects have the right to lodge a complaint with a supervisory authority, for example, the data protection authority competent for their place of residence, their place of work or for the place of the possible data protection breach.
• Right to object: data subjects have the right to object to the processing of their personal data.

Special notes on the restrictability of data subject rights:

We would like to point out that in the context of the present joint processing, the rights of data subjects under Article 15 of the GDPR (right to information), Article 16 of the GDPR (right to rectification), Article 17 of the GDPR (right to erasure), Article 18 of the GDPR (right to restriction of processing) and Article 21 of the GDPR (right to object) may be subject to special additional restrictions. These special restrictions apply if the exercise and fulfillment of these rights in the specific case would likely make it impossible or seriously impair the realization of research purposes and the restriction is therefore necessary for the fulfillment of these research purposes. This special restrictability and its requirements result in particular from Art. 89 DSGVO in conjunction with. § Section 27 BDSG and from Article 17 DSGVO.