Data protection policy - aiMotive

Data protection policy

Effective from 25 May 2018

1. Scope of this policy

The purpose of this policy is to set out the terms and conditions under which aiMotive Informatikai Korlátolt Felelősségű Társaság (seat: 1025 Budapest, Szépvölgyi út 22.; registry no.: 01-09-208015; hereinafter: “ aiMotive”), a global provider of vision-first self-driving technology as data controller may process the personal information of individuals in connection with its research and development activities, including the development and testing of artificial intelligence-based applications (hereinafter: “ AI”) in connection with autonomous car systems including, without limitation, aiDrive, aiSim and aiWare.

Furthermore, this policy applies to the processing (e.g. recording, collection) of personal information by aiMotive’s branch offices located in the United States of America and Japan in a way that personal data collected by these entities is sent to Hungary and processed by aiMotive.

This policy contains information on

2. Introduction

aiMotive utilizes artificial intelligence, simulation and supporting hardware architectures for a safe autonomous driving experience.

One of the greatest challenges of self-driving is the complex environments of urban areas. aiMotive’s technology provides a solution for high-speed autonomous driving and is growing into a robust autopilot that handles all the challenges of highway driving. Powered by artificial intelligence, the system predicts the actions of those around it to provide a smooth and safe experience. Utilizing the power of computer vision and artificial intelligence, it provides a global autonomous experience. Unique solutions allow cameras to be supported by several secondary sensors, which results in a safe self-driving solution prepared for any environment, climate and driving culture.

aiMotive uses technology designed to recreate real-world situations and create unique scenarios, which ensures the safe development of autonomous vehicle technology. Incorporating advanced software engineering, artificial intelligence, simulation testing and public road tests, aiMotive’s self-driving technology matures quickly, safely and efficiently.

3. Compliance with applicable privacy regulations

The development and testing of aiMotive’s products involves processing (including e.g. recording and marking) pictures and/or video recordings taken in realistic and real environments such as the streets of a certain part of a city, roads in rural areas and parking garages in order to supply the AI with information enabling the improvement of software systems designed to control the movement of vehicles, including steering, acceleration and deceleration, anti-collision maneuvers and safety-related analysis of the environment.

The recording of such material is made using multiple cameras installed on test vehicles (cars) operated by aiMotive.

aiMotive’s activity is primarily not aimed at processing personal data. However, test drives of aiMotive’s vehicles involves the recording of images (photos) and/or video in urban and rural environments which entails that it is practically inevitable that certain information relating to individuals (such as their image, presence at the given time and place, license plate information etc.), which may qualify as personal data, is processed by aiMotive.

In the light of the above, aiMotive is dedicated to protecting privacy and personal data and strives to put in place necessary measures for this purpose. In order to ensure compliance with the underlying legal regulations and to eliminate, to a reasonable extent, potential negative consequences of the data processing, aiMotive hereby sets out the rules on its processing of the personal data, as well as the rights and remedies of individuals affected by such processing.

aiMotive shall publish this policy on its website and update it as applicable and when necessary (e.g. due to a change in aiMotive’s activities or in laws).

The underlying legal regulations applicable to data controllers established in the EU is contained in Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “ GDPR”).

Given that aiMotive falls under the scope of the GDPR, this policy takes into consideration and is in line with its rules.

This policy is binding on any aiMotive personnel. The terms of this policy are in addition to, not exclusive of or in substitution for the rights and remedies of individuals under the applicable mandatory legal regulations, especially the GDPR.

4. Data processing principles

Before starting the processing of personal data, it must be carefully assessed at all times whether the processing is actually necessary. Personal data must be processed only if the purpose of data processing cannot be realized in another way with less impact on the data subjects.

aiMotive shall process the personal data of data subjects lawfully, fairly and in a transparent manner.

Collection of personal data can only be performed for specific, clear and legal purposes. aiMotive shall avoid all data processing that is done in a manner that cannot be adjusted to the purpose related to the personal data in question in the first place or shall terminate such data processing immediately. aiMotive is only entitled to process personal data to the extent necessary and shall delete all personal data concerning which the purpose of data processing ceased to exist or the legal basis for data processing cannot be justified.

aiMotive shall ensure that

Personal data processed by aiMotive shall be accurate and up to date.

Personal data that is useless from the perspective of the purposes of data processing or becomes useless in the meantime shall be erased immediately.

Storage of personal data shall be done in a manner that makes identification of the data subjects possible only for a period necessary for the achievement of the purposes of personal data processing.

Processing of personal data shall be performed so that by applying appropriate technical or organizational measures, the adequate security of personal data can be ensured, including all measures that serve to protect personal data against unauthorized or illegal processing, incidental loss, destruction or damage.

5. Legal basis of data processing

For the purposes set out in section 8 of this policy, aiMotive collects and processes the information (including personal data) listed in section 9 of this policy (hereinafter: “ AI Input Data”) from and about individuals and stores it in its files (which may include written, printed and electronic form).

The legal basis of the processing of AI Input Data under this policy is the legitimate interests pursued by aiMotive under sections 6 (1) f) (legitimate interest) and 6 (1) c) (compliance with a legal obligation) of the GDPR.

aiMotive’s legitimate interests in this regard are the successful development and testing of its technology, which would become impossible without the recording of images during the public road test drives, while compliance with a legal obligation primarily refers to the provisions of Point 3 of Annex 17 of KöHÉM decree no. 6/1990. (IV. 12.) (hereinafter: “ Decree”).

Considering the safeguards put in place, the related balancing test carried out by aiMotive determined that its legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subjects which require protection, therefore the legitimate interest mentioned in the previous paragraph serves as valid legal basis for the data processing.

6. Details of the data controller and its data protection officer

The data controller in respect of personal data processed under this policy is as follows:

The data controller’s data protection officer:

7. Persons with access to AI Input Data

AI Input Data processed by aiMotive under this policy may be accessed by the following persons at aiMotive (as applicable from time to time), on a need-to-know basis and in line with the principle of data minimization:

Without prejudice to its obligations and liability under the applicable data protection regulations, aiMotive may grant access to AI Input Data to third party data processors, based on the respective engagements, to process AI Input Data in accordance with the instructions of aiMotive for the purposes indicated herein. aiMotive may also grant access to other data controllers as well, if it is justified by the activity of aiMotive and if it is done in compliance with the respective data protection provisions. For more information on such data processors and data controllers, please refer to section 13 of this policy.

8. Purpose of data processing

Within the scope of its Research and Development and testing activity aiMotive may process AI Input Data for the following purposes:

I. under legitimate interest:

II. under legitimate interest:

9. AI Input Data

aiMotive may process the following AI Input Data in connection with its Research and Development, testing and demonstration activities (with data that could qualify as personal):

aiMotive will not record or collect acoustic data (sound), wireless network (Wi-Fi) or mobile network data during its activities under this policy.

10. Source of information collected

aiMotive collects the personal data under this policy directly using its own equipment and personnel. aiMotive will not collect AI Input Data from third parties.

11. Use of information

In line with the principle of purpose limitation, AI Input Data will only be processed to the extent that it is necessary for the specific purposes set out in section 8 of this policy.

12. Details of the collection and processing of AI Input Data

aiMotive collects and processes AI Input Data within the framework of the procedure described in this section 12.

12.1. Prior notification of the public

Prior to the commencement of recording activity aiMotive shall inform the public about the planned route which the aiMotive test vehicles will use for the purposes of recording AI Input Data in order to notify individuals that might be affected by such recording activity. All information in respect of aiMotive’s activity in Hungary shall be published in Hungarian and English. All information in respect of aiMotive’s activity abroad shall be published in English, and also in the local language, if explicitly required by laws.

12.2. Place and time of the collection of AI Input Data

aiMotive will make reasonable efforts to make recordings, including the collection of AI Input Data at such times and places where it is likely that not many individuals will be present, in order to minimize the number of individuals affected by the collection of AI Input Data.

Notwithstanding the above, for the purposes of optimization of AI and thereby improving the safety of autonomous driving systems, it is required from time to time that a larger number of individuals and objects appear around the test vehicles (including driving at peak hours) in order to construct and improve the algorithms used to recognize humans in the environment of the test vehicle (e.g. for the purposes of developing anti-collision and/or accident prevention algorithms).

12.3. Equipment recording and storing AI Input Data

AI Input Data is recorded and stored using on-board IT equipment comprising the following main elements installed in aiMotive vehicles:

Recording devices on vehicles used for testing will be placed in a way to prevent viewing of areas that are otherwise hidden from the views of pedestrians (i.e. the cameras on the vehicles are placed lower than an average person’s eye level).

In certain cases, AI Input Data is also collected manually by the employees of aiMotive by cameras.

12.4. Collection and processing of AI Input Data by aiMotive

After the recordings under section 12.2 and 12.3 are made, raw AI Input Data is transferred to aiMotive’s mainframe system where it is stored locally at aiMotive’s premises. aiMotive’s Data Team processes the Data. This includes labeling objects on the raw image/video data in order to enable the AI to identify objects as belonging to certain categories (e.g. parts of the road, vehicles, road signs, pedestrians, vegetation, traffic lights, other objects, etc.). In order to enable effective “machine learning” by the AI (i.e. to have the AI “learn” from real images and video), AI Input Data used in this phase is not cleansed of personal data.

Besides “training” AI, aiMotive’s simulation team uses the raw data to build a realistic simulated environment for testing purposes. The final version of the virtual testing environment does not include personal data (i.e. there are no recognizable faces, no visible license plate numbers, etc.).

If the raw data used for the simulated environment is not useful for AI teaching purposes nor is it necessary for the simulation team for any purpose (incl. further development of the simulated environment, etc.) any more, the raw data shall be anonymized (with blurring faces, license plates, etc.) or permanently deleted. The virtual testing environment is used to design, test and improve AI. AI Input Data used during the simulation and development process is not published.

To the necessary extent Marketing and Communication department also uses AI Input Data for marketing purposes (creating demonstration videos, etc.). During this marketing type of application, Marketing and Communication department uses only unrecognizable materials (blurred and obfuscated images), therefore these will not contain any personal data.

Once the AI is tested in the virtual environment and is deemed operational, the AI is loaded into aiMotive’s testing vehicles. Such testing vehicles use AI to control the testing vehicle’s movement under real circumstances (i.e. in an urban or rural environment). The testing vehicles are also equipped with cameras that feed real-time video data into the AI control system, which controls the car based on such real-time data. Such real-time data includes AI Input Data and may be stored by the car’s on-board computer system, from where it is transferred to aiMotive’s own storage devices and/or the cloud, in order to review the testing process of a given software (version or build) once the test run is completed.

The final versions of the software are not intended to store any AI Input Data as they will rely on pre-programmed features that do not require personal data to be stored in the vehicle system to perceive and recognize objects in the environment. Also, the final version of the software controlling the autonomous vehicle’s movement will not make any recording of the environment while it is in operation.

12.5. Publication of material including AI Input Data for demonstration purposes

For demonstration purposes, aiMotive may from time to time create and publish images and/or videos made during the development and testing phases of a certain software version. Such publication of images and video material may include making it available online for download via the Internet. Prior to such publication, if and to the extent it is reasonable based on the intended purpose, images/videos are cleansed of personal data.

13. Third party data processors or data controllers

AI Input Data may be transferred to companies within aiMotive’s group of companies and third-party data processors engaged by them located in one of the European Economic Area (hereinafter: “ EEA”) member states and third countries where the adequate protection of the AI Input Data is ensured. The list of countries belonging to the latter category can be accessed here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

When the processing of AI Input Data is carried out by a third-party processor, aiMotive ensures that the necessary contractual and organizational measures are in place to guarantee safe processing of AI Input Data.

If the recipient third-party data processor or data controller is located in a third country that does not ensure an adequate level of protection for personal data (e.g. certain Asian countries or the U.S.), aiMotive ensures that the data transfer takes place on the basis of the Standard Contractual Clauses (hereinafter: “SCC”) adopted by the European Commission for such transfers.

The SCC used by aiMotive during such transfers can be accessed here: https://commission.europa.eu/publications/standard-contractual-clauses-controllers-and-processors-eueea_en

14. Duration of the processing of personal data

AI Input Data may be processed by aiMotive according to the followings:

aiMotive determines the erasure periods applicable to the personal data in a way that no personal data is retained once the term of the data processing has passed. aiMotive has the necessary internal organizational measures in place that ensure that such erasure periods are respected and applied in practice.

15. Data Security

Maintaining data security means guaranteeing the confidentiality, integrity, availability and accuracy (for authorized purposes) of the personal data.

Confidentiality means that only people who are authorized to use the data can access it.

Integrity means that personal data should be accurate and suitable for the purpose for which it is processed.

Availability means that authorized users should be able to access the data if they need it for authorized purposes.

Accuracy means that the data is kept up to date and every reasonable step is taken to ensure that inaccurate data is erased or rectified without delay.

These principles are enforced by putting in place appropriate hardware and software-based security measures (including physical entry and system access control, locks, alarms, firewalls, etc.). aiMotive has in place procedures and technologies to maintain the security of all personal data from the point of collection to the point of destruction.

16. Rights of data subjects

16.1. List of the data subjects’ rights

Individuals affected by aiMotive’s processing of their personal data hereunder in the course of aiMotive’s activities have the right:

16.2. Right of access

The data subject has the right to obtain from aiMotive confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and the following information:

Further, if the data subject decides to exercise his/her right of access, aiMotive shall provide a copy of their personal data undergoing processing.

For any further copies requested by the data subject, aiMotive may charge a reasonable fee based on administrative costs.

If the data subject makes the request by electronic means and unless otherwise requested by the data subject, aiMotive shall provide the information in a commonly used electronic form (e.g. via email).

16.3. Right to rectification

The data subject has the right to obtain from aiMotive without undue delay the rectification of inaccurate personal data concerning him/her. Taking into account the purposes of the processing, the data subject has right to have incomplete personal data completed.

16.4. Right to erasure or right to be forgotten

The data subject has the right to obtain from aiMotive the erasure of personal data concerning him/her without undue delay and aiMotive shall have the obligation to erase the personal data without undue delay where one of the following grounds applies:

The above does not apply if the processing is necessary for compliance with a legal obligation, which requires processing by EU or member state law to which aiMotive is subject or for the establishment, exercise or defense of legal claims.

16.5. Right to restriction of processing

Data subjects have the right to obtain from aiMotive restriction of processing where one of the following applies:

Where the processing has been restricted under this section, such personal data shall, with the exception of storage only be processed with the data subject’s consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or a member state.

The data subject who has obtained restriction of processing shall be informed by aiMotive before the restriction of processing is lifted.

16.6. Communication by aiMotive of the rectification, erasure of personal data or restriction of processing

aiMotive shall communicate any rectification or erasure of personal data or restriction of processing to each recipient (e.g third party data processors) to whom it disclosed the personal data, unless this proves impossible or involves disproportionate effort.

17. Remedies

Individuals – regardless of their right to file complaints – may turn to courts if their rights under the GDPR were violated in the course of processing their personal data.

Lawsuits can be initiated before the competent court against aiMotive (e.g. Hungary, Sweden or Finland depending on the location of the data processing). If the individual’s usual place of residence is in another member state of the EU, the individual may initiate the lawsuit before the court of such member state.