Dashcams: Panta rhei in the data protection world?

Austrian case law:

Prior to the GDPR, the Austrian Administrative Supreme Court (Verwaltungsgerichtshof) issued a prominent decision (VwGH, 12 September 2016, Ro 2015/04/0011) on the admissibility of dashcams under Austrian data protection law. The court found that the particular dashcam in question was inadmissible, because it stored the recordings permanently whenever the device's "emergency button" was pressed. Since a person could permanently hit the button, the court reasoned that any length could be recorded, which was seen as disproportionate interference with the privacy of other road users.

Since the GDPR became applicable, the DPA has issued two decisions on the legality of dashcams in Austria. With recourse to the ruling of the Austrian Administrative Supreme Court, the DPA found in both cases that the dashcams were inadmissible:

• In July 2018, the DPA assessed a dashcam that only saved the last 60 seconds of the recording permanently in case the integrated accelerometer detected an accident or when the emergency button was pressed. The DPA considered the recording to contravene the principle of data minimisation, because the recordings could be stored permanently simply by pressing the emergency button. 
• In another decision from September 2018, the dashcam in question permanently saved the recording whenever the car was in motion. The DPA found that this device could not pass the balancing of interests test, since other road users were filmed and their interests were overriding, as they need not reasonably expect to be filmed by others, in particular when no accident occurred. The DPA even imposed a fine of EUR 220 for the illegal use of the dashcam.

Contrary to rumour, neither the Austrian Administrative Supreme Court nor the DPA ruled that the use of a dashcam is generally inadmissible but assessed the technical specifications of each device separately. This is now clarified by the DPA's new guidelines.

The guidelines:

Most recently, the DPA published a list of criteria on its website according to which the application of a dashcam could theoretically be admissible based on "legitimate interests" (note that Austria's national Data Protection Act contains specific provisions for the processing of images, including videos). The DPA makes clear that the admissibility must be assessed on a case-by-case basis. Consequently, the technicalities of the device must be scrutinised.

Those assessment criteria include:

• The data are only processed for the sole purpose of documenting an accident.
• The recording of public space (= street) is limited to the necessary extent (e.g. the recording area is limited to a minimum; no large-scale surveillance; the camera angle is "down"; the camera resolution is as low as possible, it is ensured that more distant people or vehicles cannot be identified, etc.).
• If data is retained, the data is only recorded to the absolute minimum extent (e.g. one minute before the accident to a few seconds after the accident). Data is continuously overwritten if there has been no accident.
• Even accident data must not be stored indefinitely, but only until the purpose is achieved.
• The integrity and confidentiality of the data must be ensured, e.g. by using state-of-the-art encryption techniques and access restrictions.

Before running out and buying your own private dashcam, you should be aware that the DPA provides a strong disclaimer. It clarifies that this is only a preliminary legal opinion, which may yet be affirmed or declined by the Austrian courts (or even the ECJ). The DPA also highlights that most commercially available dashcams will continue to be inadmissible due to their technical specifications. Those products impermissibly interfere with other road users' fundamental right to data protection and privacy.

In any case, the image processing needs to be in line with the provisions of the Austrian Data Protection Act, requiring inter alia the appropriate marking, keeping logs of the processing and conducting a Privacy Impact Assessment (according to Austria's DPIA Blacklist). These requirements will remain a major obstacle to dashcams becoming a common sight on Austrian roads.