Privacy Notice for Data Collection Through ON-Board Cameras

Google Translate

The Privacy Notice will be translated, using an automatic translation service. Please note that as it is a machine translation by an automatic translation system, the result of translation may not be accurate. Also note that the translated contents may not have the same meaning as in the original text.

This Privacy Notice describes how we process your personal data, in particular within the meaning of the EU General Data Protection Regulation ("GDPR") in the event that one of our vehicles collects your personal data as part of our project to develop vehicle tools to improve pedestrian and road safety ("Project").

  1. Controller, Data Protection Officer, Representative

The controller that is responsible for processing your personal data ist
Toyota Motor Corporation 1 Toyota-cho, Toyota-shi, Aichi, 471-8571 Japan in-data.protection@mail.toyota.co.jp (hereinafter referred to as "we" or "us" or "our").
The contact details of our data protection officer are as follows
DPO Service GmbH, Bethmannstraße 50-54, 60311 Frankfurt/Main, Germany, datenschutz@dposervice.de
The contact details of our representative are as follows
Toyota Motor Europe NV/SA (TME) Avenue du Bourget/Bourgetlaan 60, 1140 Brussels, Belgium Data.Protection@toyota-europe.com.

  1. Categories of personal data, processing purposes, legal basis and source

If you encounter one of our vehicles engaged in the Project, it may collect the following personal data about you: location; video; electronic or visual information such as if applicable, the number on the license plate of the car you are driving, age, gender etc.; and special categories of personal data such as facial features, ethnic origin, political opinions, religious or philosophical beliefs, data concerning health (disability, wearing glasses), sexual orientation (if any of these are visible).

We process such personal data for the following purposes

  • The overall purpose is to increase road safety by reducing the risk of traffic accidents.
  • To achieve this, we are developing a further generation of the "advance driver assistance system" ("ADAS"). ADAS will act as driving aid and ensure that human beings as well as road signs are recognized and the ADAS reacts accordingly. ADAS has programs that make the decisions in the vehicle and help to control the vehicle/enable (partly) autonomous driving and contains algorithms for image recognition (AI).
  • To develop and improve the ADAS applications which are developed based on the image recognition algorithms.
  • To evaluate the ADAS integrated into the vehicles.

The legal basis for the processing of such personal data is Article 6(1)(f) of the GDPR. Our legitimate interest are to validate and improve the functionality of the ADAS to avoid traffic accidents by recognizing traffic participations and to support driving processes by acting as a driving aid. More information on the balancing of interests test is available upon request.

To the extent we process special categories of personal data (i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person's sex life or sexual orientation), such processing is necessary for scientific research purposes and our interests in processing substantially outweigh those of the data subject in not processing the data (Article (9)(2)(j) of the GDPR and Section 27 (1) of the German Federal Data Protection Act ("FDPA")). More information on the balancing of interests test is available upon request.

  1. Recipients

3.1 Transfer to service providers

We engaged the following external service providers to provide certain services to us in connection with the Project

  1. Contractors in Japan that will put tags on the blurred video footage to indicate e.g. what is a human being and what is a traffic sign.
  2. Denso, 1-1 Showa-cho, Kariya-shi, Aichi, 448-8661 Japan, Aisin 2-1 Asahi-machi, Kariya, Aichi 448-8650, Japan, and Continental Automotive Corporation, New Stage YOKOHAMA 4F 1-1-32 Shin-urashimacho, Kanagawa-ku, Yokohama-shi, Kanagawa 221-0031 Japan, all located in Japan that will develop servers, develop the analysis tool application and develop logic development will receive blurred data in an encrypted transfer in order to so. Continental Automotive Corporation will engage Continental Automotive Systems, Inc., 1 Continental Drive 48326 Auburn Hills, MI USA, located in the US as subcontractor, which will receive blurred data only. Further, Toyota Motor Europe NV/SA, Avenue du Bourget/Bourgetlaan 60, 1140 Brussels, Belgium located in Belgium will receive blurred data to assist with the development.
    These contractors receive your personal data in an encrypted transfer and process your personal data only as instructed (i.e. they act as processors/subprocessors on our behalf). The personal data will be shared with the service providers in an encrypted transfer.
  3. DEKRA Test Center S.A, Z I La Plaine Sud―Montredon, Rue du Castellas BP223 11102 Narbonne CEDEX FRANCE conducts the test driving with the vehicles, i.e. the collection and measurement of the data. The hard disc drive on which the personal data is collected, is encrypted. DEKRA does not have access to the personal data collected.
    We will sign contracts with those external service providers that will require them to safeguard the personal data and to process such data only as instructed.
    We may also transfer your personal data to law enforcement agencies, governmental authorities, legal counsel and external consultants in compliance with applicable data protection laws. Our reason for such potential transfers could be compliance with our legal obligations or advancing our legitimate interests, such as the exercise or defense of legal claims. More information on the balancing of interests test is available upon request.

3.2 International transfers of Personal Data

The personal data that we collect about you is transferred to and processed by recipients which are located in Japan. Japan has been recognized by the EU Commission as providing an adequate data protection level (Art. 45 GDPR). Further, your personal data is transferred to other recipients outside of the European Economic Area, i.e. the US, that do not provide for an adequate level of data protection. To the extent your personal data are transferred to countries that do not provide for an adequate level of data protection from an EU law perspective, we will base the respective transfer on appropriate safeguards, such as standard data protection clauses adopted by the European Commission (Art. 46 (2) GDPR), where this is required under applicable law. You can ask for a copy of such appropriate safeguards by contacting us as set out in Section 1.

The access to your personal data is limited to recipients with a need to know.

  1. What rights do you have and how can you exercise your rights?

You may have the right to: request access to your personal data, request rectifications to your personal data; request erasure of your personal data; request restriction of processing of your personal data; and object to the processing of your personal data.

Please note that these rights might be limited under the applicable national data protection law and that we do not intend to identify you and may not be able to identify you. To learn more about these rights, please click on this link or scroll down to the Exhibit - Your Rights. Refer to section 1, above, to contact us to exercise your rights.

You also have the right to lodge a complaint with a data protection supervisory authority.

  1. How long do we keep your personal data?

Your personal data will be retained for 7-10 years, as long as necessary in order to i) develop the ADAS system and improve it after the launch of the system and to (ii) use the data for updates of the system.

  1. Automated Decision Making

We do not engage in automated decision-making in the context of the Project.

Exhibit

Your Rights

  1. Right of access

You may have the right to obtain from us confirmation as to whether or not personal data concerning you is processed, and, where that is the case, to request access to the personal data. The access information includes―inter alia―the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access.

You may have the right to obtain a copy of the personal data undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.

  1. Right to rectification

You may have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

  1. Right to request erasure ("right to be forgotten")

Under certain circumstances, you may have the right to obtain from us the erasure of personal data concerning you and we may be obliged to erase such personal data.

  1. Right to restriction of processing

Under certain circumstances, you may have the right to obtain from us restriction of processing your personal data. In this case, the respective data will be marked and may only be processed by us for certain purposes.

  1. Right to object

Under certain circumstances, you may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and we can be required to no longer process your personal data.