Video Data Protection

Recording video footage for scientific purposes – Data Processing Policy

The purpose of this Policy is to secure the compliance of Knorr-Bremse Vasúti Jármű Rendszerek Hungária Kft. (hereinafter referred to as: Knorr-Bremse or Controller) with the current legislation in connection with personal data protection during the data processing in conjunction with recording of public traffic situation video footages for scientific purposes in the expected period between 05.04.2018 – 31.12.2021, furthermore to give adequate and transparent information to the data subjects about the processing of their personal data. During the data processing in conjunction with recording of public traffic situation video footages this Data Processing Policy and Knorr-Bremse’s Data Protection Rules (accessible on our website: http://www.knorr-bremse.hu/media/documents/ railvehicles/supplier_information/Adatvedelmi_szabalyzat_Knorr_Bremse.pdf) shall apply.

In compliance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) the data subject is informed on this website in connection with the video recording and the processing of personal data of the followings:

  • Controller’s contact details;
  • Purpose and the legal basis of personal data processing;
  • Categories of processed personal data and scope of data subjects;
  • Utilisation of personal data, identification of data subject;
  • Conditions of data storage, duration of processing personal data, potential data controllers with the right of access;
  • Rights of data subjects relating to processing personal data;
  • Remedies available for the data subjects.

Controller shall confidentially process the recorded or received personal data, in compliance with the data protection legislation, based on this Data Processing Policy. Controller shall guarantee the purpose of the GDPR, namely that every person should have control of his/her own personal data.

Controller’s contact details

Knorr-Bremse Vasúti Jármű Rendszerek Hungária Kft.

Seat: 1238 Budapest, Helsinki út 105.

Company reg. Nr.: 12089675-2-44

Tax Nr.: 01 09 464653

E-mail: adatvedelem@knorr-bremse.com

Purpose and legal basis of personal data processing

The purpose of recording video footages resulting personal data processing is to facilitate the research and development activity conducted by Knorr-Bremse in the development of a system which is dedicated to optimizing the security of public traffic. In order to develop the artificial intelligence of the system, the analysis of large number of targeted video footages are needed, which will be used during the teaching, testing and validating of the system. The availability of video footages which properly represent real traffic situations are needed for the development of the system. During video recording natural persons and vehicles are recorded as well. Therefore in favour of development of the above mentioned life security protection system, as a goal to be protected and as a goal which guarantees the interest of the whole society, Knorr-Bremse undertakes to process personal data, undertakes to take all reasonable steps in the field of information and process, and undertakes to comply with the principles and regulations concerning on personal data processing.

Knorr-Bremse hereby marks point f) paragraph (1) of article 6. of GDPR as the legal basis of the personal data process, which expresses that, personal data may be processed also if the processing of personal data is necessary for the purpose of the legitimate interests pursued by the controller or by third party, and enforcing these interests is considered proportionate to the limitation of the right for the protection of personal data. In this case the legitimate interest shall be the development of public traffic security. Knorr-Bremse has completed the balance of interest test in connection with legitimate interest as legal basis.

Categories of processed personal data and scope of data subjects

The street view and the traffic situations are recorded by video camera installed by Knorr-Bremse on a vehicle participating in public traffic, meanwhile the following personal data may be processed:

  • People’s facial likeness who are staying or/and moving on the streets;
  • Licence plate number of trains and vehicles which are parking or moving on the streets.

The vehicle equipped with video footage recording system is not recording continuously, the video camera is being operated only for the measurements required for the research. When using the vehicle for purposes other than the purpose of the measurements, no video footage is being recorded so no personal data will be involved.

Utilisation of personal data, identification of data subject

Knorr-Bremse does not intend to use any personal data recorded during the video recording, they are inevitable due to the recording of the footages necessary for the purpose of the research. Only the public traffic situations on the video footages are used by Knorr-Bremse during the research. Knorr-Bremse does not have any equipment or access to any equipment which can be used to link natural persons from the licence plates or faces. The data subjects will not be identified.

Conditions of data storage, duration of processing personal data, potential data controllers with the right of access

Knorr-Bremse will store the recorded video footages for 60 days in original form, after it evaluates and entirely and permanently deletes the useless recorded videos from software development point of view. After the 60-day period following the completion of the recording Knorr-Bremse will directly utilise the usefull recorded videos for and during the development of the system.

Knorr-Bremse acts with diligence required by law in the field of storage and security of the video footages, takes all the technical and organizational actions and sets up the procedural rules which are required for the enforcement of the personal data protection and secrecy rules. The video footages containing personal data are accessible exclusively just by employees who take part in the research, otherwise the possibilities of access have been properly restricted by separate organizational measures.

Rights of data subjects relating to processing personal data

According to the GDPR Knorr-Bremse is obliged to provide information upon the data subject’s or an authority’s request. Knorr-Bremse is able to fulfil this obligation according to the technical possibilities at its disposa.

According to GDPR the data subject may request from Knorr-Bremse the followings:

a) access to on his/her personal data being processed;

b) rectification of his/her personal data;

c) erasure or restriction of his/her personal data, except where processing is mandatory;

d) data subject shall have the right to object to the processing of his/her personal data;

e) right to data portability.

a) According to the GDPR upon the data subject’s request the data controller shall provide information concerning the data relating to him/her and processed by the data processor about the sources from where they were obtained, the purpose, grounds and duration of processing, the name and address of the data processor and its activities relating to data processing, and – if the personal data of the data subject is made available to others – the legal basis and the recipients.

In the case of personal data process Knorr-Bremse – given the speciality of video footage – can give information about the personal data process as follows:

  • Set and source of processed personal data, the purpose, grounds and duration of processing as described above;
  • Knorr-Bremse has engaged the following data processors, except that does not transfer any personal data to third parties:

    Knorr-Bremse Systeme für Schienenfahrzeuge GmbH
    Moosacher Strasse 80
    D-80809 München
    Tax ID Number: DE 129 395 680
    Registration Number: HR B 91 181
    E-mail: dataprotectionofficer@knorr-bremse.com

    Knorr-Bremse Fékrendszerek Kft.
    Seat: 6000 Kecskemét, Georg Knorr utca 8.
    Company reg. Nr.: 03-09-000007
    Tax Nr.: 10315192-2-03
    E-mail: adatvedelem@knorr-bremse.com

  • Due to the nature of the stored personal data and considering that Knorr-Bremse does not have face recognition system, during editing and cutting the recorded video footages Knorr-Bremse is technically not able to identify the data subjects, does not store a database about personal data. Thus, the Controller is technically not able to ascertain whether a specific person is included in the video footage or not. Furthermore, Knorr-Bremse is not able to meet any kind of request that would require a search for all occurrences of a specific person on all recorded video footages.
  • Upon the data subject’s or an authority’s request Knorr-Bremse is able to provide information, whether a vehicle equipped with video recording system at a given time, at a given location, actually recorded video footages for measurement purposes or not. The precondition of providing information is to present specific and exact date and location (a minute accuracy date and a named public area).
  • In case the provided place and time means that video footage was not recorded and therefore personal data was collected, the provided information covers only the fact of this and no further information is possible.
  • In case a video footage was recorded by Knorr-Bremse at a given time and place provided by an applicant – within 60 days from the completion of video record, then the parts of video footages containing the relevant and given information can be handed over to data subject or authority. Further precondition of providing the relevant video footage is to have data subject’s own portrait by Knorr-Bremse which shall be used for identification purposes, so only the relevant part of the video footages will be provided with data subject. If subject part of video footage contains other personal data (portrait of other person) this will be erased by a special software.
  • All video footages are available 60 days from the recording, therefore the (parts of the) video footages – upon request – can be provided within 60 days from the recording. After this time some video footages will be deleted in accordance with the above mentioned details, therefore Knorr-Bremse is able to provide information only about the above-mentioned details of the personal data process and the exact date of deletion of the video footage, the possibility of providing the relevant part of a video footage is impossible.
  • Knorr-Bremse provides the information in written in an understandable form upon the request as soon as reasonably possible but within 25 days at latest.
  • Knorr-Bremse may refuse to provide information to the data subject in the cases defined in the GDPR. Should a request for information be denied, Knorr-Bremse shall inform the data subject in written as to the provision of GDPR serving grounds for refusal. Where information is refused, Controller shall inform the data subject of the possibilities for seeking judicial remedy or lodging a complaint with the National Authority for Data Protection and Freedom of Information.

b) According to the GDPR where a personal data is deemed inaccurate, and the correct personal data is at the controller’s disposal, the data controller shall rectify the personal data in question: in the case of this data process – where the target of the processed personal data is extended to only the portrait of unidentified persons (or identification data of vehicles), the data subject’s right for rectification of his/her personal data may not be interpretable so such requests may not be fulfilled by Knorr-Bremse.

c) According to the GDPR the data subject may request from the data controller the erasure or blocking of his/her personal data, except where processing is mandatory.

In case of this present peronal data process – where the target of the processed personal data is extended to only the portrait of unidentified persons (or identification data of vehicles), the precondition of erasing or blocking shall be the identification of the data subject, which can be fulfilled by Knorr-Bremse only if the data subject determines the exact time and place regarding the possible video footage record about him/her and provides a portrait about him/her with Knorr-Bremse. Without these the data subject cannot be identified so the request for erasing or blocking cannot be fulfilled.

d) According to the GDPR the data subject shall have the right to object to the processing of personal data relating to him/her:

  • if processing or disclosure is carried out solely for the purpose of discharging the controller’s legal obligation or for enforcing the rights and legitimate interests of the controller, the recipient or a third party, unless processing is mandatory;
  • if personal data is used or disclosed for the purposes of direct marketing, public opinion polling or scientific research, and;
  • in all other cases prescribed by law.

In the case of this present personal data process, the target of the processed personal data is limited to the portrait of unidentified persons (or identification data of vehicles), the above-mentioned conditions – allowing object – do not exist, so the right to object is not interpretable.

e) Right to to object

The data subject is entitled to receive the personal data concerning him/her, which has been provided to Knorr-Bremse, in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller without hindrance (where technically feasible) from Knorr-Bremse, where the processing is based on your consent, or is necessary for the performance of a contract, and the processing is carried out by automated means.

The data subject during practicing his/her right to data portability is entitled to request to forward directly his/her personal data among the data controllers.

Remedies available for data subjects

If a data subject has any comments or requests to the Controller’s data process, please use the following e-mail address:

  • adatvedelem@knorr-bremse.com

    If data subject has any objection against Controller’s process and the data subject assumes that his/her rights might been violated by Controller, the data subject is entitled to appeal for remedy to the following authorities:
  • National Authority for Data Protection and Freedom of Information
    Native name: Nemzeti Adatvédelmi és Információszabadság Hatóság
    Seat: 22/C. Szilágyi Erzsébet fasor, Budapest, H-1125
    Po. box: Pf.: 5. Budapest, H-1530
    Telephone: 06-1-391-1400; Fax: 06-1-391-1410
    E-mail: ugyfelszolgalat@naih.hu
    Web: http://www.naih.hu
  • Procedure on competent Regional Court
    In case of violation of right of self-determination the data subject is entitled to appeal to the court against the Controller. The case shall fall within the competence of the Regional Court. The action shall be heard by the competent Court. If so requested by the data subject, the action may be brought before the tribunal in whose jurisdiction the data subject’s home address or temporary residence is located. Any person otherwise lacking legal capacity to be a party to legal proceedings may also be involved in such actions. The Authority may intervene in the action on the data subject’s behalf.
    The Court shall hear such cases in priority proceedings. The burden of proof to show compliance with the law lies with the data controller.
    When the court’s decision is in favour of the plaintiff, the court shall order the Controller to provide the information, to rectify, block or erase the data in question, to annul the decision adopted by means of automated data-processing system, to respect the data subject’s objection.

Compensation and restitution

Data controller shall be liable for any damage caused to a data subject as a result of unlawful processing or by any breach of data security requirements.

Data subject whose rights relating to personality had been violated as a result of unlawful processing or by any breach of data security requirements shall be entitled to restitution from Controller.

Where the data controller is able to prove that the damage or the violation of rights relating to personality occurred due to an unavoidable cause that falls beyond the realm of data process, it shall be relieved from liability.

No compensation or restitution shall be paid where the damage or the violation of rights relating to personality was caused by intentional or serious negligent conduct on the part of the aggrieved party.

This Policy shall enter into force on 5 April 2018 and shall be valid until its withdrawal or modification.

Knorr-Bremse shall be entitled to modify this Policy at any time.

Knorr-Bremse may provide information on this Policy and its interpretation in an electronic way. Please send your questions related to this to the following e-mail address: adatvedelem@knorr-bremse.com.

Budapest, 5 April 2018

Tivadar Tavaszi
managing director

András Sávos
managing director

Share