Dashcams – safety versus privacy? The Austrian perspective

Introduction

Dashcams have become increasingly popular in recent years and a built-in dashcam is now the most sought-after feature among car buyers.(1) Buyers' primary motivation is self-explanatory: recorded footage can be used as evidence in case of an accident. In the United Kingdom, drivers can even report serious road incidents to law enforcement simply by uploading footage to the National Dash Cam Safety Portal.(2) Besides serving as electronic witnesses, dashcams also seem to subconsciously improve driving. A 2015 study found that 80% of high-risk driving events by novice drivers could be prevented simply by equipping their cars with dashcams.(3)

Hence, there are strong arguments in favour of dashcams. However, it is rumoured that they are incompatible with privacy and data protection law and thus illegal on Austrian roads.(4) The Austrian courts have been dismissive of the use of dashcams and, although the Data Protection Authority (DPA) at first upheld decisions to that effect, it recently published guidelines on how to lawfully use dashcams in Austria.(5)

Case law

Prior to the EU General Data Protection Regulation (2016/679) (GDPR), the Supreme Administrative Court issued a prominent decision on the admissibility of dashcams under Austrian data protection law.(6) The court found that the particular dashcam in question was inadmissible because it stored the recordings permanently whenever the device's emergency button was pressed. Since a person could permanently hit the button, the court reasoned that any length could be recorded, which was seen as disproportionate interference with other road users' privacy.

Since the GDPR became applicable, the DPA has issued two decisions on the legality of dashcams in Austria. With recourse to the Supreme Administrative Court's ruling, the DPA found in both cases that dashcam footage was inadmissible:

• In July 2018 the DPA assessed a dashcam that saved only the last 60 seconds of a recording permanently when the integrated accelerometer detected an accident or the emergency button was pressed. The DPA considered the recording to contravene the principle of data minimisation, because the recordings could be stored permanently by simply pressing the emergency button.(7)
• In another decision from September 2018, the dashcam in question permanently saved the recording whenever the car was in motion. The DPA found that this device could not pass the balancing of interests test, since other road users were filmed and their interests were overriding. The road users would not reasonably expect to be filmed by others, particularly when no accident had occurred. The DPA imposed a fine of €220 for the illegal use of the dashcam.(8)

Despite rumours to the contrary, neither the Supreme Administrative Court nor the DPA ruled that the use of a dashcam is generally inadmissible, but assessed the technical specifications of each device separately. This has now been clarified by the DPA's new guidelines.

Guidelines

Earlier in 2020, the DPA published a list of criteria on its website according to which the application of a dashcam could theoretically be admissible based on legitimate interests (note that the national Data Protection Act contains specific provisions for the processing of images, including videos). The DPA makes clear that the admissibility must be assessed on a case-by-case basis. Consequently, a device's technicalities must be scrutinised.

The assessment criteria include as follows:

• The data is processed only for the sole purpose of documenting an accident.
• The recording of public space (eg, a street) is limited to the necessary extent (eg, the recording area is limited to a minimum, there is no large-scale surveillance, the camera angle is down, the camera resolution is as low as possible and it is ensured that more distant people or vehicles cannot be identified).
• Data must be continuously overwritten if there has been no accident. Only in the case of an accident may the recordings be retained, but must be limited to the absolute minimum extent (eg, one minute before the accident to a few seconds after the accident).
• The retention of recordings (ie, stopping the overwriting process) must not depend on the driver's deliberate action but rather on predefined impulses (eg, impact sensors or abrupt steering, driving, braking or acceleration manoeuvres).
• Even accident data must not be stored indefinitely, but only until the purpose is achieved.
• The data's integrity and confidentiality must be ensured (eg, by using state-of-the-art encryption techniques and access restrictions).

Comment

Before running out to buy a dashcam, please be aware that the DPA provides a strong disclaimer. It clarifies that this is only a preliminary legal opinion which may yet be affirmed or declined by the Austrian courts (or even the European Court of Justice). The DPA also highlights that most commercially available dashcams will continue to be inadmissible due to their technical specifications. Those products impermissibly interfere with other road users' fundamental rights to data protection and privacy.

The image processing also must be in line with the Data Protection Act, requiring, among other things, the appropriate marking, keeping logs of the processing and conducting a privacy impact assessment (according to Austria's data protection impact assessment blacklist). These requirements will remain a major obstacle to dashcams becoming a common sight on Austrian roads.

At present, it seems that dashcams are rather neglected at the EU level. However, the market for dashcams is growing steadily and with the rise of autonomous driving, some kind of camera surveillance system in cars will be inevitable. Sooner or later, the admissibility of dashcams must thus be addressed comprehensively at the EU level.

This article was first published in International Law Office.