What about data protection?

Personal data relating to you will be processed at various points for the purposes of project execution. Personal data is any information on the basis of which you can be identified, either directly or indirectly. Data is processed in accordance with the EU’s General Data Protection Regulation (GDPR). In addition to personal registration, this relates to the camera technology used, which serves to guarantee vehicle control and passenger safety. In their capacity as data controllers, the project partners Hamburger Hochbahn AG, IAV and Siemens Mobility have concluded an agreement regarding joint data processing.

Who is the controller?

The following project partners are responsible for data processing:

1. Hamburger Hochbahn AG

Steinstrasse 20

20097 Hamburg

2. IAV GmbH Ingenieurgesellschaft Auto und Verkehr

Carnotstrasse 1

10587 Berlin

3. Siemens Mobility GmbH

Otto-Hahn-Ring 6

81739 Munich

Who is your contact?

Your first point of contact for all data protection issues and for the exercise of rights as a data subject is Hamburger Hochbahn AG:

Hamburger Hochbahn AG (see above) Email: datenschutzbeauftragter@hochbahn.de

What is the legal basis for each form of data processing?

Data processing is performed in accordance with the following legal bases:

• Article 6, paragraph 1, point (f), of the GDPR (legitimate interest)
• Article 6, paragraph 1, point (a), of the GDPR (consent)

What legitimate interests are pursued?

The legitimate interest relates to the execution of a research project to improve the current state of the art regarding automated driving as well as to the surveillance of the interiors of the vehicles used in order to guarantee the safety of the persons carried, the property of the transport company and also generally in the public sphere.

What data will be processed and for what exact purposes?

We are not interested in identifying an individual person, and our system is not configured for such purposes.

Our vehicle is equipped with a set of sensors consisting of radar sensors, lidar sensors and cameras, which serve the development and implementation of the automated driving functions. Cameras are also installed in the interior for safety.

Radar and lidar sensors are placed along the route. These sensors extend the vehicle’s field of vision to enable predictive and high-performance driving of the shuttle and to avoid potential accident hazards.

The radar and lidar sensors in the vehicle and on the route do not detect people or vehicles, just buildings.

Camera technology:

As part of the HEAT project, cameras are used to ensure the safety of passengers and those around them, to manage safe operations, to prevent and solve criminal offences and for the protection of property. The cameras are located in the vehicle interiors and exteriors.

Cameras located on the vehicle’s exterior:

There is an area-view camera (‘fisheye camera’) on each side of the vehicle. The vehicle attendant therefore has a 360-degree field of vision in close proximity to the vehicle (up to about ten metres away). By displaying the surroundings on a monitor, these cameras are used to compensate for the design-related severely restricted field of vision for the vehicle attendant while driving. The camera mounted on the front of the vehicle can also be accessed by the Hamburger Hochbahn control centre in the event of a safety incident.

The following image shows video footage captured by the area-view camera

The cameras located inside the vehicle are for surveillance and safety. Due to the absence of the driver in autonomous vehicles, various safety and monitoring functions will be lost. It is one of the goals of the research activities to find out what requirements arise out of this absence and how they can be fulfilled. The camera system records the interior of the vehicle, including the door area. The faces of people outside the vehicle only become visible in the camera image once the person is within the door area.

The Hamburger Hochbahn control centre has access to the cameras in the vehicle interior. The video stream from these cameras is by default set to inactive and is only switched to active mode by Hamburger Hochbahn dispatchers in the event of a safety incident.

The following image shows the recording range of the interior cameras

Passenger registration: The passenger must register in order to use the HEAT shuttle. An app has been developed for passenger registration; this is the responsibility of IAV GmbH Ingenieurgesellschaft Auto und Verkehr. The app-specific data privacy notice is made available within the app. This can also be found here. Insofar as the app is not to be used, a paper form may alternatively be completed for the purpose of passenger registration.

The data will not be used for any other purpose (e.g. marketing).

How long will the data be stored?

If you revoke your consent (in relation to your registration as a passenger), your data will be erased insofar as it is no longer required for data retention purposes and insofar as its erasure is not precluded by any statutory record retention obligations. All other personal data will be erased at the end of the project in 2021.

How will your data be stored?

We store your data in line with the latest technology. For example, the following security measures are in place to protect your personal data from misuse or other unauthorised processing:

• Access to personal data is restricted to a limited number of authorised persons for the specified purposes
• Access to these IT systems is continuously monitored in order to detect and prevent misuse at an early stage

Will data be shared with third parties?

Under certain circumstances, camera surveillance data will be shared with the local law enforcement agencies. Data will not be shared with any other third parties.

What are your rights as a data subject?

In accordance with the data protection laws as applicable, you may, among other things, have the right to:

• Revoke your consent at any time
• Request confirmation as to whether we are processing personal data relating to you and receive information regarding the personal data we process
• Demand the rectification of incorrect personal data
• Demand the erasure of the personal data processed by us
• Demand restriction of the processing of personal data
• Object to your personal data being processed on grounds relating to your particular situation

We ask that you contact the address stated above directly regarding the establishment of your rights as a data subject.

Notwithstanding this, every data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to them infringes the GDPR. The data subject can assert this right to a supervisory authority in the member state of their habitual residence, place of work or place of the alleged infringement. The competent supervisory authority in Hamburg is:

The Hamburg Commissioner for Data Protection and Freedom of Information

Ludwig-Erhard-Str. 22, 7th floor 20459 Hamburg Tel.: +49 (0)40 428 544 040 Email: mailbox@datenschutz.hamburg.de