ÚŘAD PRO OCHRANU OSOBNÍCH ÚDAJŮ
Pplk. Sochora 27, 170 00 Praha 7
tel.: 234 665 111, fax: 234 665 444
[email protected], www.uoou.cz
*UOOUX00F1SE9*
Ref. UOOU-04603/21-1
Prague, 4 November 2021
Official record on handling of a complaint
The Office for Personal Data Protection (hereinafter “the Office”) received on 15 February
2021 from the German supervisory authority, via the IMI system, a complaint by a German
citizen against the conduct of the company , established at
Czech Republic, company registration number
. Pursuant to the complainant, the company requires
for the activation of the unlock/lock-up functionality of a car, through the
application/service, for the purpose of identity check of the person asking for the
service activation, a copy of the driving licence even if it already possesses the identity card´s
number of the person who has purchased that car.
conveyed to the German
supervisory authority the information that the controller of customer data in connection with
the operation of the application is the company , established
at: , company registration
number (hereinafter “the Company” or .
The German citizen´s complaint, bearing characteristics of a transborder processing, has been
passed on to the Office as the competent authority for further handling.
The Office, within its competences vested by Article 31 of the Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of natural persons
with regard to the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC (General Data Protection Regulation – hereinafter “the
Regulation (EU) 2016/679”) as well as in connection with Article 50(1) of the Act No. 110/2019
Coll., on personal data processing, asked on 30 March 2021 and repeatedly on 14 April 2021
the Company for statement as to the ownership of the application
accompanied with a detailed description of the customer activation procedure and for the
provision of the relevant documentation.
The following information were particularly requested:
1) Who is the owner of the application? Does the company use this
application for its business activity and if so, in what manner? Please specify precisely.
2) Please describy the entire customer activation procedure of the
application and provide as evidence the relevant documentation.
1/7
3) Do you require a driving licence copy for the activation of the unlock/lock-up
functionality via the application?
a. If yes, are these copies or scans filed and retained by the company ? In what
file?
b. For how long?
c. What software is used for the retention of these documents? (convey precise
information including certificates and provider)
d. If, for the activation of the unlock/lock-up functionality via the
application, a copy of some other proof of identity is required, provide information
as to what kind of proof is required and reply the questions under 3.a) thru 3.c).
4) Provide and evidence the extent of personal data processed by through the
application.
5) Provide the legal grounds pursuant to the Regulation (EU) 2016/679 on the basis of which
processes personal data of its customers via the application;
a. If the legal title laid down in Article 6(1)(f) of the Regulation (EU) 2016/679 is at
stake, submit also the balance tests;
b. If the personal data are processed on the basis of Article 6(1)(a) of the Regulation
(EU) 2016/679, please document how the consent is obtained;
6) If engages a processor for the processing of personal data within the
application in accordance with Article 28(3) of the Regulation (EU) 2016/679,
provide contracts related to these processing operations;
7) Provide, in compliance with Article 30 of the Regulation (EU) 2016/679, records of
processing activities related to the personal data treated via the
application;
8) Submit technical and organizational measures pursuant Article 32 of the Regulation (EU)
2016/679 adopted for the security of personal data processed via the
application including technical specifications and certificates.
To verify the Company´s statement and the real-life practice in this respect, the
car dealer , respectively
company registration number was asked on 9 September 2021 for
explanation about the application. Specifically, it was enquired about the
process of activation of the application, the agreement with the controller (the
Company), the extent and method of customer data collection during the activation of the
application with special focus to the identity checks of customers.
The following information was particularly sought:
1) A copy of the data processing agreement between a.s. and .
2) A comprehensive description of the entire process of activation of the
application including the establishment of the ID account for needs of the customers.
Submit particularly documents evidencing the method of customer data entry and the
extent thereof (e.g. PrintScreen of each specific step, work procedure/employee manual).
3) Provide the legal title pursuant to the Regulation (EU) 2016/679 your company applies for
the processing of customer data via the ID and the application.
2/7
4) Submit copy of guidance and work procedures provided by to the car
dealers for the purposes of ID account establishment and the activation of the
application.
5) Specifically, provide information, if requires a copy of the customer´s driving
licence in order to establish the ID account and to activate the
application.
I.
The information and documentation obtained from concerning the customer
data processing in relation to the service provision agreements reveal the following:
The condition for profiting from the Company´s services is creation and application of the
central user account ID, i.e. the identity for the customer single sign-in to the
online environment. The ID functionality serves to the customer identity
check on the basis of the customer´s personal ID (driving licence). The verified customer can
then use the services. The identity of a verified customer enables to use the
Service advisor, Service technician, Service assistant, Sale services staffer, Head of new cars
sales, New cars sales staffer and Head of used cars sales.
recommends verifying the customer identity during the car service under the
customer´s presence (validity of the personal data and car-related data processed).
ID functions as single identity within the environment. The customer
registration within one environment is enough then to start using other services that
offers or will offer in future.
Conditions of the ID usage on the legal grounds pursuant to Article 6(1)(b) of the
Regulation (EU) 2016/679 and information on the customer data processing are, in sense of
Article 12 et all. of the Regulation (EU) 2016/679, are presented to the customer upon the car
purchase and are also publicly accessible on the website
, that
contain links to the privacy policy, cookies and also the standalone service,
for the activation of which it is necessary to close online separate agreement with the
Company Contact to the data protection officer is
provided there as well: .
The process of signing on to the services:
After entering the online environment, the customer signs on by using the
ID whereby the registration process is initiated.
Upon opening the account, the customer is transparently made acquainted
with the “Conditions for using “ and the “Information on personal data
processing“. These documents are part of the information provided at time of the online sign-
on to the services and are publicly accessible on the Company´s website as
well.
After establishing the user account by a customer, a step follows that match
the vehicle (by entering the VIN code) with the user account. Entering (by the
customer) of the generated code into the car infotainment follows. After this security step,
the car is “parked in the virtual garage” provided by the account and the
customer is enabled to profit from the services contracted.
3/7
The electronic processing of customer data is, pursuant to the commercial terms, based on
the free decision of the customer to contract paid services (first order for
services linked to a new car is free of charge).
The online contract with the Company related to the services related to one
vehicle is concluded in the sense of Article 6(1)(b) of the Regulation (EU) 2016/679.
The period of the contractual relationship is set for three, or for more years. If car user, the
customer can cancel the service order without providing any reasons within 14 days as from
its conclusion.
The services can be used via:
Infotainment equipped with a system directly from production;
Management unit of the e-call system enabled also for the mobile apps of the online
service;
Webpages of the service;
Mobile app.
Usage of certain online services is for security reasons subjected to the
customer identity check at the Company´s authorized partner on the basis of driving licence.
For instance, is a service from the category marked as II.
“Unlock and lock up“ (the customer can remotely, via the portal or a mobile app lock up or
unlock a particular car. For the service activation, it is necessary that an authorized
partner verifies the customer´s identity).
The Company processes customer data for the purpose of closing a contract on provision of
the mobile online services, whereas the provision of customer data is a
contractual condition. Refusal to provide these personal data may result in the non-conclusion
of the agreement.
Processing of customer data required by the Company in relation to the online
service is thus realized for the purpose of the contract performance pursuant to Article 6(1)(b)
of the Regulation (EU) 2016/679, whereas the extent of the data processed (driving licence
number, issuing country and date of expiry) is, in sense of Article 5(1)(c) of the Regulation (EU)
2016/679, adequate, relevant and limited to what is necessary in relation to the purposes and
meets the security role of preventing the customer´s car from misuse in relation to the false
usage of the service by an unauthorized person, for instance, the remote
unlocking and locking up of the vehicle.
The contract performance is conditioned by the active acceptance of the “Conditions of
ID application“, whereby the customer may refuse the provision of the
services and use the car without these services. The possibility to use the whole scope
of these services is dependent on the particular car´s equipment as well as on the specification
of services that the customer contracted with .
The company is in sense of Article 4(7) of the Regulation (EU) 2016/679 the data
controller as well as the owner and operator of the application that can be
used only with the use of publicly available communication technologies. The application is
equipped with the so-called “connective services” that connect the vehicle with its authorized
user. The online infotainment means an interactive solution of breakdowns and problems with
4/7
the car or the remote access to the information about the car condition, remote unlocking
and locking up, etc.
stores customer data in the sense of the processing agreement “Agreement on
protection of personal data for the purpose of compliance with the Regulation (EU) 2016/679
(GDPR) with regard to custom-performed processing of personal data“ with the data processor
which is the company in Germany, agreement number:
. is in position of a processor in sense of
Article 4(8) of the Regulation (EU) 2016/679.
Both and are part of the
It is clear from the documents and the written statement by that the company
does not require from its customers copy of the driving licence, but processes, in order to
ensure the services ordered by the customer (for security reasons to oversight
the ID system) data entered in the driving licence: number of the licence, date and
country of issuance, expiry date. The driving licence number is entered into the system online
by the customer, or on the customer´s request by the authorized dealer or service at time of
the ID or activation.
„Dealers may at time of the car handover proof the identity of the customer for the purposes
of activation of some security-relevant services by checking the name,
surname and date of birth displayed on the customer´s driving licence and compare them with
the data provided by the customer upon the registration with ID, respectively
. Or, as the case may be for security, to the end of performance of the
agreement (remote unlocking and locking up of the car) enters into the system the driving
licence number, date and country of issuance and the expiry date.
Dealers are legal persons on their own on the basis of business contracts and possess all
necessary documents concerning processing of personal data circulating among
and the dealer network.“
provides to the dealer network a detailed guidance how to proceed during the
customer identity check for the purposes of . A customer is regarded as proven if the
driving licence number, country of issuance and its expiration has already been entered into
the system. A customer that has not been verified cannot get the “unlock and lock-up service”
activated for security reasons (Documented by file ).
The submissions from are filed under ref. .
II.
The statement was verified with the dealer
, company registration number
(hereinafter ).
Concerning activation of the application, the Office received the following
information:
has closed an Agreement on processing of personal data with the data controller
and provides, within its business activity, for the car owner also other
services from , among others the registration with ID, and
5/7
respectively. Consequently, is in the position of a processor in the sense
of Article 4(8) of the Regulation (EU) 2016/679.
has confirmed the statement that the creation of a ID
account and its activation is done by the customer itself and that for its opening it is not
necessary to provide a driving licence copy.
The activation of the application is done by the customer as well. The manual
(Brochure titled on-line services) how to proceed is given to the customer at
time of a binding order of a car. The customer, with help of the manual, activates access to
the service. Later, upon the handover of the new car and upon the customer´s
request, the dealer helps the customer with the sign-on into the ID environment and
with the activation of service in the vehicle. The sign-in and the service
activation is performed with the access data which the customer itself has activated.
In case the customer decides to use some of the extended services (e.g.
remote unlock/lock-up), the identity is checked exclusively under the customer´s physical
presence at the dealer´s.The customer verification process is performed in accordance with
the relevant methodology, the The customer´s
identity is checked via the personal ID (driving licence).
Any copy of driving licence for verification of the customer identity, neither durin the
activation, is not requested pursuant the methodology and the information conveyed
by an representative.
It was found out and back checked that a.s. provides its customers the service
called on the basis of a contract (e.g. remote unlocking/locking up of the car)
and processes in this regard customer data in sense of Article (6)(1)(b) of the Regulation
(EU) 2016/679. For the purpose of an enhanced security, the processed data include also the
licence number (and country of issuance and expiry date) which is entered into the
ID system and (as the case may be) to the system and serve to the
identity verification of a customer requiring the service (e.g. remote unlocking/locking up of
the car).
It shall be stated, on the basis of the aforementioned findings, that does not
require copy driving licences. Dealers can offer their customers help during the activation of
the application, but neither they are authorized to require a copy of driving
licence from customers.
The German customer´s claim that requires for the activation of the
application a driving licence copy has not been proven.
The supporting documents from the car dealer in the Czech Republic, the company
are filed under the reference
Summary:
It has not been found out on the Czech Republic´s territory that or its
authorized dealer requested a copy of driving licence for the purpose of activation of the
agreement relating to .
6/7
On the contrary, the Company has provided evidence that it has not requested any driving
licence copies for the activation of the services, the registration with which is
done online and upon the customer´s request.
Moreover, for the provision of additionally contracted services of , again on
the customer´s request (e.g. the service of remote unlocking and locking-up),
requires electronic processing of the driving licence number, country of issuance and date of
expiration. These data are transferred electronically to the Company by the customer itself
whereas an authorized representative may help him upon request. The transfer
of these data by the customer is voluntary, but it is a condition for the provision o f the
requested services.
At time of the activation of this service, an authorized representative does verify
on spot the customer´s identity on the basis of the personal data stored in the system and the
physically presented driving licence.
It is an electronically closed contract concerning the provision of services between
and the customer in sense of Article 6(1)(b) of the Regulation (EU) 2016/679.
The company does not require from customers for the activation of the
service any copy of driving licence and it has been concluded that the
company´s procedure did not fall under Article 4(7) and 4(8), Article 5, Article 6(1)(b), Artcile
(12) and other following Articles of the Regulation (EU) 2016/679, and consequently, no
breach of the relevant legal obligation has been detected.
The complainant failed to document his claim that , a.s. would allegedly have
required copy of driving licences from the authorized dealers in Germany for the purpose of
their processing for the activation of the service. Therefore, the Office
considers that the merit of complaint shows an individual wrongdoing by am authorized
company in Germany which required a driving licence copy for the activation of the remote
service of unlocking and locking up of a vehicle.
In accordance with the Regulation (EU) 2016/679 and the Act No. 110/2019 Coll. on
processing of personal data, the complaint towards the company has been
adjourned, as there is no reasoned suspicion as to the breach of legal regulations, neither of
regulations specifically related to the protection of personal data, nor of other regulations.
Therefore, the content of the complaint has not been found reasonable as to the launch of an
investigation or commencement of administrative proceedings whilst it would not be
appropriate to settle the matter in other way.
Any further Office´s proceeding would not open the possibility to find out further facts that
could support any conclusion other than the one described in this official record .
The German supervisory authority will be informed of the outcome of this case through the
IMI system.
(signed electronically)
7/7