Article from PROTECTOR magazine issue 11/2019
Author: Peter Schmitz, CEO Schmitz GmbH
The benefits of automatic processing of vehicle license plates are now manifold. Whether it is a matter of opening a barrier to a parking garage, determining standing times in parking areas, or statistically evaluating the origin of visitors or customers, license plate recognition now provides good services in this regard. However, the question arises as to whether personal data is collected in accordance with the European General Data Protection Regulation (GDPR) when a person passes through a registration point, and these persons should actually give their consent before registration. However, in the case of mass scanning for the purposes stated above, this is not practicable. The operators like to talk themselves into a balancing of interests, but this is on shaky ground.
Can a personal reference be established?
The German Road Traffic Act (StVG) expressly states that a reference to an "identified or identifiable person" can always be established via the license plate of a vehicle. This means that it is at least theoretically possible to establish the personal reference that fills the criteria of Article 4 No. 1 of the GDPR in the sense of being able to relate to a person. Section 39 (1) of the German Road Traffic Act (StVG) provides a basis for a claim to obtain information about the person of the respective registration holder by presenting a specific vehicle registration number. Accordingly, the competent registration authority or the Federal Motor Transport Authority is obliged to disclose the name of the owner of the vehicle registered on the license plate presented, among other things, if a qualified interest of the requesting party is demonstrated. It is therefore questionable whether the abstract existence of a legal possibility to obtain the additional knowledge required to establish a personal reference already makes license plates personal data.
Ruling with a signal effect?
In the context of a recent ruling on the personal reference of dynamic, i.e. changing IP addresses that are regularly reassigned to a specific connection holder, the ECJ clarified that it is not necessary for all the information required to identify the person in question to be in the hands of a single person in order to assume a personal datum. Accordingly, it is rather sufficient if the data processor in question has means that could reasonably be used to have the person in question identified with the help of third parties on the basis of the stored IP addresses. In accordance with the ECJ's referral decision, the Federal Court of Justice subsequently ruled that the existence of legal means to establish the necessary personal relationship is sufficient and thus assumed the existence of personal data.
Time for a new procedure?
If a certain license plate number is known, it is at least theoretically possible without major obstacles to obtain the additional knowledge required to identify the holder by means of an inquiry to the competent authority. This does not require any complicated research into the holder of the additional knowledge, nor is the procedure to be followed for this purpose particularly time-consuming or costly. In contrast to the query of the owner of an established dynamic IP address, no judicial procedure is required for this. The personal reference of a license plate is thus already to be affirmed in the case of indirect identifiability of a person.
The right of citizens to informational self-determination was strengthened in the Federal Constitutional Court's decision on automated license plate checks under the Bavarian Police Tasks Act. A commuter had filed a lawsuit against a system of automated license plate checks operated by the Bavarian police on a federal highway, after previously failing at the Bavarian Administrative Court and the Federal Administrative Court. On December 18, 2018, the Federal Constitutional Court ruled 1) that license plate checks interfere with the fundamental right to informational self-determination even if, in the event of a miss, the license plate is only present for a fraction of a second and is then automatically deleted without a trace. It thus contradicts its own decision of March 11, 2008. It is part of the freedom of the community that citizens can basically move around without being arbitrarily registered by the state, having to account for their righteousness and being exposed to the feeling of being constantly monitored. In his comments on the constitutional limits of automated license plate checks in relation to the Federal Constitutional Court ruling, Professor Dr. Roggan, lecturer at the University of Applied Sciences of the Police of the State of Brandenburg, as follows 2): "The requirement of justification for future plaintiffs is considerably lowered by the ruling, because from now on, in cases of license plate checks, the assertion that one has passed a checkpoint by means of a motor vehicle will be sufficient to demonstrate one's own and direct concern, even if consequences can no longer be reconstructed by deleting them without a trace."
1)https://www.bundesverfassungsgericht.de/SharedDocs/Pressemitteilungen/DE/2019/bvg19
-008.html