last updated on 18.7.23
We are committed to safeguarding the privacy and personal data of the individuals possibly involved in the research, development, testing, verification and validation of our products.
This notice applies where we are acting as a data controller with respect to the personal data possibly collected and processed in the course of our products´ (software, hardware and systems) research, development, testing, verification and validation; in other words, where we determine the purposes and means of the processing of that personal data.
In this notice, "we", "us" and "our" refer to:
Veoneer Sweden Safety Systems AB, acting on its own behalf and as agent for each of its Company Affiliate.
How we use your personal data
In this Section 2 are specified:
a) how the processing activity of personal data will happen and why it is necessary for us;
b) the general categories of personal data that we may process;
c) the purposes for which we may process personal data; and
d) the legal base of the processing and its assessment.
Veoneer specially marked test vehicles take pictures and record videos in and from public traffic spaces, private company premises, test sites and other premises. The vehicles are equipped with camera systems that have various recording directions and sensor technology. These systems record, process and store videos and images from the vehicle’s surroundings. Anyone near one of the marked test vehicles during testing operations could potentially be subject of data processing.
The personal data processed may consist in pictures and videos collected by the vehicle camera systems of car plates, pedestrians, cyclists, cars´ occupants and any other individual in the vehicle´s surroundings. Less often, together with the above we may process GPS positioning and data entry time stamps as well.
In the context of this data processing, pedestrians, cyclists, cars´ occupants and other individuals are analyzed, classified, and further processed only as “items” in the framework of the real environmental and traffic conditions. For example, an individual could be classified as “pedestrian at left side of lane”, or as “cyclist passing the car from the right side”.
Personally identifying the individuals recorded is neither necessary nor intended as part of this processing activity and is typically complicated or not even possible. Nevertheless,
since the raw data that is required consists of video and images, it is impossible to rule out the identifiability of people in this process.
The purposes of data processing are research, development, testing, verification and validation of software, hardware and systems for Advanced-Driving Assistance Systems, Collaborative and Automated Driving and any other tool that make driving safer. Including the documentation of these processes and the fulfilment of subsequent obligations.
Research, development, testing, verification and validation of such systems require the use of test vehicles under real environmental and traffic conditions (on public streets as well) including the recording, processing and storage of videos and images during and after such use. Our products are researched, developed, tested, verified and validated to detect and classify road users, vehicles, infrastructure and other objects in the context of traffic and environmental situations.
For example, in the case of ADAS (Advanced driver-assistance systems) algorithms, we need to ensure the quality and reliability of the current vehicle control algorithms and to provide base data for the future development of AI driven control algorithms. A reliable recognition software is essential for the development of autonomous driving vehicles and hence the enhancement of future road users´ safety in general.
The legal basis for this processing is our legitimate interests and of our customers and partners, namely the legitimate interest to perform research, development, test, verification and validation on our software, hardware and systems that make driving safer.
In this regard, Article 6(1)(f) of the GDPR provides that:
"(1) Processing shall be lawful only if and to the extent that at least one of the following applies: ... (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."
We carried out a positive balancing test between your interests and ours in this regard. This means that our legitimate interests are not overridden by your competing interests, rights and freedoms since your personal identification by name or otherwise is neither necessary nor planned and is typically complicated or not even possible. Technical and organizational measures are also undertaken to ensure the recorded data is processed in compliance with data protection requirements. Please contact our Data Protection Officer if you want to know more about.
Providing your personal data to others
We may disclose your personal data to any member of our group of companies (this means our subsidiaries, our ultimate holding company and all its subsidiaries) insofar as reasonably necessary for the purposes, and on the legal bases, set out in this notice. Information about our group of companies can be found at https://www.veoneer.com/en/who-we-are.
We may disclose the images and videos captured by our vehicle camera systems to our suppliers or subcontractors insofar as reasonably necessary for assisting us in research, development, testing, verification and validation activities.
We will disclose the processed images and videos captured by our vehicle camera systems to our customers and partners in order to serve our common legitimate interest to perform research, development, test, verification and validation on our software, hardware and systems.
In addition to the specific disclosures of personal data set out in this Section 3, we may disclose your personal data where such disclosure is necessary for compliance with a legal obligation to which we are subject. We may also disclose your personal data where such disclosure is necessary for the establishment, exercise or defense of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.
International transfers of your personal data
In this Section 4, we provide information about the circumstances in which your personal data may be transferred to countries outside the European Economic Area (EEA).
We and our other group companies have offices and facilities in Sweden, Germany, Romania, Japan, United States, India and other countries. Our partners and suppliers of research, development, testing, verification and validation services are situated in Japan, India, Israel and other countries. The European Commission has made an "adequacy decision" with respect to the Japanese Data Protection System. Besides that, transfers to each of these countries will be protected by appropriate safeguards, namely the use of standard data protection clauses adopted by the European Commission (a copy of which can be obtained at https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en). Furthermore. when possible we will privilege the use of VDIs (Virtual Desktop Infrastructures) and of sets of pseudonymized or anonymized data.
Retaining and deleting personal data
This Section 5 sets out our data retention policies and procedure, which are designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of personal data.
Personal data that we process for the purposes identified under Section 2 shall not be kept for longer than is necessary for serving such purposes.
If there is occasionally a legal basis that extends beyond this or a further legitimate interest for storage and processing to continue (e.g., for proper documentation of said processes due to retention obligations or other statutory requirements), the data is accordingly stored for a longer period.
Amendments
We may update this notice from time to time by publishing a new version on our website.
You should check this page occasionally to ensure you are happy with any changes to this notice.
Your rights
In this Section 7, we have summarized the rights that you have under data protection law.
Your principal rights under data protection law are:
a) the right of access;
b) the right to erasure;
c) the right to object to processing;
d) the right to complain to a supervisory authority;
e) the right to rectification of inaccurate data;
f) the right to restriction of processing.
You have the right to obtain information as to whether or not your personal data is being processed by us. If data is being processed, you have the right to access this data and information on the processing.
In some circumstances you have the right to the erasure of your personal data without undue delay. Those circumstances include when you object to the processing under the conditions laid down under the GDPR. However, there are exclusions of the right to erasure. The general exclusions include where processing is necessary for compliance with a legal obligation; or for the establishment, exercise or defense of legal claims.
As stated above, you have the right to object to our processing of your personal data on grounds relating to your particular situation. If you make such an objection, we will cease to process the personal information unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defense of legal claims.
If you consider that our processing of your personal information infringes data protection provisions, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. You may do so in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.
You have the right to demand that we correct your personal data. For video and image data this right can usually be applied only by means of erasure.
You have the right to request a restriction of the processing of your data.
Please note that in the context of this processing, right to access, right to rectification, right to erasure, right to restriction of processing and right to object may be subject to additional limitations. These special limitations apply if exercising or complying with these rights would likely render impossible or seriously impair the achievement of our research purposes in specific cases and the limitation would thus be necessary for the fulfilment of these research purposes. This special limitation and the criteria for it are particularly derived from Article 89 GDPR and Article 17 GDPR.
You may exercise any of your rights in relation to your personal data by written notice to us (please refer to the contacts under Section 8.2 below).
Depending on the specific case, you could be required to provide additional information in order to exercise and fulfil your data subject rights. Especially information on the location and time at which you may have been subject to processing (i.e., information on exactly when and where you were near one of our test vehicles). This additional information may be required to determine whether a specific person was subject to the processing and to be able to actually comply with the rights specified above.
Our details
We are registered in Sweden under registration number 559396-6327, and our registered office is at BOX 13089, 103 02 Stockholm, Sweden.
You can contact our Data Protection Officer
a) by email at [email protected] , or
b) by post using this address: Stahltweite 21/a, 22761 Hamburg, Germany.