The “Privacy BlackBox” project: data protection-compliant in-car camera use

Legal experts at the University of Passau are taking part in the “Privacy BlackBox” project through which Uniscon GmbH and Fraunhofer AISEC aim to develop a solution to permit the data protection-compliant use of in-car dashcams.

As a means of providing security against potential claims, more and more motorists are turning to so-called dashcams which film what is happening on the road ahead. What many of them are not aware of, is that filming without due cause and above all permanently through the windshield constitutes a breach of data protection legislation and an infringement of the personal rights of other road users. 

As a result, unlike in America or Russia, the use of such videos as evidence is disputed before German courts. There is currently no uniform EU-wide data protection regulation covering the use of these video recordings. The issue of whether and how the recorded data may be used must be determined on the basis of a thorough assessment of interests in each individual case, assisted by guidance from the data protection authorities. In the past this has generally required the involvement of multiple courts and judicial bodies. 

Manually initiated recording when the need arises via cameras that are activated only when sensors detect an unusual event such as heavy braking or shock – referred to as “crashcams” – while necessitating additional effort and expense, does not offer a complete solution to the dilemma. The issue of lawful use, or even targeted manipulation of the recordings, still remains, especially when data must subsequently be edited: Non-involved persons must be pixelated and irrelevant recordings deleted. In addition to the technical considerations, there is also the question of the timeliness of the recording if it is to serve as an aid to decision-making before the court.

The Privacy BlackBox – data protection and traceability 

Fraunhofer AISEC is working with the University of Passau and Uniscon GmbH to develop a solution which will permit the data protection-compliant recording, storage and evaluation of sensitive data: the “Privacy BlackBox” foresees reliable protection of image, audio and video data against misuse, as well as in justified individual cases the evaluation of such data for strictly delimited purposes. The “Privacy BlackBox” is based on two central components: 

• A trusted recording device allows for the decentralized storage of data with no single-point-of-failure and secure data encryption directly at the device. Responsibility for the technological design of this device lies with Fraunhofer AISEC, given its expertise in the fields of IT security, trusted computing and integrity protection. 

• A digital trustee infrastructure protects against unauthorized access to data and guarantees transparent traceability and secure event logging. As the industrial partner, the company Uniscon GmbH will establish and operate this infrastructure.

Lack of legal clarity calls for scientific expertise 

Legal support for the project is provided by the Chair of Public Law, European Law and Information Technology Law at the University of Passau. Through its research focussing on “digitization, the networked society and (Internet) cultures”, the University has for many years addressed the issues of IT security and security law. “With the Privacy BlackBox we are aiming to develop a solution which will exploit the advantages of digitization – in this case, dashcams – and at the same time preserve the privacy of the individual,” explained Professor Meinhard Schröder of the University of Passau. “Particularly since the advent of the GDPR, the issue of data protection has acquired an entirely new significance. Besides uniform legal regulations, there is also a lack of technical innovations that can directly take account of such regulations. We are working on this.” 

Applications in Industry 4.0 

The development of the Privacy BlackBox is a joint project undertaken by three experienced partners. In future, it is expected that the Privacy BlackBox will be used not just in motor vehicles, but also in an industrial environment to inspect plant and machinery. Video recordings of technical inspections and investigations in the field of critical infrastructure will allow the procedures to be documented in detail. In a parallel with the in-car recording of personal data, from time to time in the course of such inspections, trade secrets may be recorded which necessitate strict access control and the comprehensive protection of sensitive data.

Detailed press release