DENSO Privacy Notice: On-Board Camera Data Collection

Last updated on 24 July 2020

DENSO is committed to protecting and respecting your privacy and personal data. This Privacy Notice describes how we, as your personal data Controller, process your personal data during a Project that we are conducting. The Project involves live, automotive manouvres, and records images using an on-board camera. The Project is described below.

If you have any questions about this Privacy Notice, or your personal data in relation to this Project, please contact us at or


  1. The Controller that is responsible for processing your personal data is:
    DENSO CORPORATION 1-1 Showa-cho, Kariya-shi, Aichi, 448-8661 Japan (“DNJP”)
    (also here referred to as “we" or "us" or "our").

  2. The contact details of our Data Protection Officer are as follows:
    Avv. Elena Gilotta, LL. M CIPP-E
    DENSO Automotive Deutschland GmbH, Freisinger Straße 21-23, D-85386 Eching, Germany

  3. The Controller’s European Representative is:
    DENSO AUTOMOTIVE Deutschland GmbH, Freisinger Straße 21-23, D-85386 Eching, Germany

This Privacy Notice sets out the basis upon which we process any personal data that we collect from you, or that you provide to us.


The Controller is in the process of developing an Automated Parking System. We will therefore be conducting vehicle mobility exercises using specially purposed motor cars, with mounted cameras. The cameras will video record live footage of surrounding roads and parking lots. This video footage may therefore capture data about road users, including images of objects, pedestrians, other vehicles and license plates.

The Project is planned to last between July 27, 2020 and December 31, 2020.

3. INFORMATION ABOUT YOU (what we collect from you)

If you encounter one of our vehicles engaged in the Project, it may collect the following personal data about you, including video, electronic or visual information:

  • Your location;

  • the number on the license plate of the vehicle that you are driving, or a passenger in;

  • images of any motor vehicle that you have, or are present in;

  • visual indicators of your general age group.

The vehicle may also collect the following special categories of personal data, such as:

  • your apparent gender;

  • facial features;

  • ethnicity;

  • any visible expressions of your political, religious or philosophical beliefs;

  • data concerning your apparent health (mobility or any visible medical devices); or

  • any visibly displayed indicators of your sexual orientation.

The ways that you provide us with information include the following:

  • By being present within the vehicle camera radius during live Project exercises

  • By corresponding with us by phone, e-mail or otherwise (for example, if you contact us to exercise any of your rights as a Data Subject)

  • If you report a problem or issue to us

If you contact us, we may keep a record of that correspondence but only for a minimal time period to legally validate how we managed any issue raised.

When you visit our website(s), we may automatically collect information about your computer, including your IP address, information about your visit, your browsing history, and how you use our website or our mobile application(s). This information may be combined with other information you provide to us, as described above.

Please note that all of this is subject to our stated or otherwise reasonable retention period (in section 8 below), and subject at all times to your full rights as Data Subjects (covered in section 9 below).


We will restrict the collection of personal data to what is absolutely necessary and never collect unnecessary personal data. We process your personal data for the following purposes:

  • We are trying to develop systems which increase road safety, and improve and enhance the public use of vehicles, by reducing the risk of traffic accidents.

  • To achieve this, as part of our "advance driver assistance system" ("ADAS"), we are currently researching and developing an Automated Parking System. ADAS technology acts as a driving aid and ensures that human beings and road signs, as well as parking spaces and other parking features are recognized, and the ADAS reacts accordingly. ADAS has programs that make the decisions in the vehicle and help to control the vehicle, enabling (partly) autonomous driving.It contains algorithms for image recognition (AI).

  • To develop and improve the Automated Parking System as an ADAS application, based on the image recognition algorithms.

  • To evaluate the ADAS Automated Parking technology integrated into the test vehicles.

We will only use your personal data when the law allows us to, which is referred to as the “legal basis” for processing. For the purposes of the current Project, the legal bases are mainly covered by the following situations:

  • Where it is necessary for our legitimate business interests if your interests and fundamental rights do not override those interests- this means that your interests and fundamental rights come first. The legal basis for processing your personal data is our legitimate interests in validating and improving the Automated Parking functionality.Our primary goals include avoiding traffic accidents and any harmful incidents to persons or property, by recognizing traffic participants and parking infrastructure, and to support parking processes by acting as a parking aid. More information on the balancing of your interests is also available upon request.

    To the extent we process any special categories of personal data, such processing is incidental and necessary for our scientific research purposes. The reason is that such personal data would be impractical or impossible to eliminate before processing (e.g. health data showing that you are using very visible medical devices, such as crutches). In those cases, our interests in incidentally processing such data substantially outweigh those of the data subject in not processing the data, given our objectives.

  • Where We need to Comply with a Legal or Regulatory obligation (for example, if footage from our cameras detected information relevant to a serious crime)

  • Where this is in the public health or public interest (for example, during pandemics or medical emergencies)

We require all of our third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. Our instructions are always linked to the legal bases covered above.

We never share your personal information with any parties outside the DENSO Group without your knowledge, and this is always subject to your legal rights as a data subject. The only exception to this is where we are legally obliged to do so, or need to comply with a public health or public interest obligation.

Please consider that we may sometimes sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new participants may use your personal data in the same way as set out in this Notice. They would also be bound by the same legal obligations and responsibilities for your personal data.


5.1 Transfer to service providers

We have engaged the following external service providers to provide certain services to us in connection with the Project:

  1. DENSO AUTOMOTIVE Deutschland GmbH, Freisinger Straße 21-23, D-85386 Eching, Germany, one of our Group Companies (also the Controller’s European Representative),which will coordinate collecting your personal data on our behalf, and whose DPO will respond to any queries you submit in relation to your personal data;

  2. C-More Automotive GmbH (Kemptener Str. 99, D-88131 Lindau (Bodensee)), which will be operating the vehicles and cameras during the execution of the Project;

  3. Contractors in Japan and Vietnam that will put tags on the blurred video footage to indicate, for example, human beings, animals, traffic signs, and other objects;

  4. Other DENSO entities in Japan which will assist with decrypting, blurring and labelling your personal data;

These service providers have access to and otherwise process your personal data (i.e. they act as processors/sub-processors on our behalf). They have access to blurred data only.

We will enter into contracts (called Data Processing Agreements) with all external service providers that will require them to safeguard your personal data and to process such data only as instructed.

5.2 International transfers of Persona lData

The personal data that we collect about you is transferred to and processed by recipients which are located in Japan. Japan has been recognized by the EU Commission as providing an adequate data protection level as within the EU (Art. 45 GDPR).

Further, your personal data is transferred to other recipients outside of the European Economic Area in Vietnam, which do not provide for an adequate level of data protection. We therefore ensure that the data transferred to Vietnam is in line with EU legal requirements, specifically through the use of a specific contract, which conforms in full with the EU-approved standard contractual clauses.


The personal data that we collect from you is temporarily stored within Germany, before being securely encoded, and transferred to DENSO in Japan. From there, it is decrypted and securely stored on servers located within DENSO Japan, or approved sub-processors. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice. DENSO has also concluded strict agreements with all parties processing personal information on its behalf.


All information you provide to DENSO is stored on secure servers. The following measures are used to protect your personal data:

  • All data is securely stored on servers in Japan and in transit usingcryptography

  • All data access has an audit trail

Although the transmission of information via the internet is never completely secure, we will do our best to protect your personal data. Once we have received your personal data, we will use strict procedures and security features to prevent unauthorised access.


Your personal data will be kept for up to 2 and a half years after the end of the Project, subject to your rights referred to in section 9 below.

In all cases, we will never keep your information longer than strictly necessary under (national or EU) law


As a Data Subject, you have certain rights and you may freely exercise them at any time by contacting us through this web form. Below is a summary of your rights and what they mean from your perspective:

  • Access: “show me my personal data.”

  • Rectification: “correct my personal data.”

  • Erasure (the Right to be Forgotten): “forget all about my personal data.

  • Restricted Processing: “you can only do [x,y,z…] with my personal data.”

  • Notification: “I must know that you have my personal data and what you are doing with it.”

  • Data Portability: “if I ask you, you must give me my personal data in a format that I can easily use or share.”

  • Objection: “you cannot process my personal data.” We would need to immediately stop Processing the Personal Data, unless:

    • we somehow had compelling and legitimate grounds for processing your personal data, which override your interests, rights and freedoms (very rare); or

    • we needed to continue processing your personal data in order to establish or defend an existing or actually expected legal claim.

  • Exemption from automated decisions: “you cannot use your systems or processes to categorise me and make automatic decisions about me using my personal data, unless you get extra permission from me with the right for me to obtain human intervention to express my point of view and contest the decision

If you exercise a right, we will revert to you as soon as possible, and complete it within 1 month, unless the request is exceptional. Please consider that we will be able to satisfy your deletion request only if and when we are not obliged to keep your information under national or EU legislation or reason of public interest.

If you wish to raise a complaint on how we have handled your personal data, you can contact us to have the matter investigated: or .

At all times, you have an absolute right to refer matters about how we use your personal data to: Bavarian Data Protection Authority: Bayerischer Landesbeauftragter fuer den Datenschutz