On 26 July 2022, the Lower Saxony data protection authority ("Lower Saxony DPA") announced that it has imposed a fine of 1.1 million euros on Volkswagen ("VW") due to GDPR violations.
It found that VW has violated data protection regulations when it tested a driving assistance system while using a service provider in 2019. VW has accepted the fine.
VW conducted vehicle outings using a test car, on which cameras were attached, for testing and training a driving assistance system designed for preventing traffic accidents. The cameras recorded the traffic around the car, inter alia, for error analysis. In 2019, the car was stopped by Austrian police near Salzburg for a traffic check, as police officers had noticed the unusual attachments.
Following an investigation, the Lower Saxony DPA found that VW had violated the GDPR in four ways:
VW immediately remedied these violations and cooperated fully with the Lower Saxony DPA.
The Lower Saxony DPA deemed these violations to have a low level of severity. It also pointed out that it has no objections to the collection and processing of personal data during such test drives, also taking into consideration that the processing serves to optimize a driving assistance system designed to prevent accidents and increase road safety.
Despite this rather mild assessment, the Lower Saxony DPA—after cooperating with the other European data protection authorities concerned pursuant to Article 60 GDPR—imposed the substantial fine of 1.1 million euros on VW. This shows that even GDPR violations of relatively low severity may nevertheless lead to substantial fines by data protection authorities.