The Data State Inspectorate of Latvia clarified that an image of a vehicle and its registration number alone do not constitute personal data. They acquire such status only when they allow for the identification of a specific person.
The Data State Inspectorate (DSI) clarified under what circumstances a vehicle registration number is considered personal data and what obligations arise for paid parking operators when using cameras and license plate recognition systems.
The agency explained that an image of a vehicle and its registration number alone do not allow for the identification of a person if there is no additional information linking the car to a specific owner or driver.
Therefore, at the moment a vehicle enters a parking lot, the operator typically does not process personal data, as they do not know who is behind the wheel.
The inspectorate provides a simple example: a vehicle registration number does not reveal a person's identity just as a coat check number does not identify the owner of the coat.
The situation changes if the registration number is used to establish the identity of the owner or holder of the vehicle, for example, in the case of collecting debts for unpaid parking. In this case, it involves the processing of personal data, and the operator is subject to the requirements of data protection legislation.
If license plate recognition is necessary for tracking the duration of a vehicle's stay, verifying payment, or providing parking services, data processing may be based on the performance of a contract.
In cases where cameras are used for the security of territory, vehicles, or people, the legal basis may be the legitimate interest of the operator. However, they are required to determine the purpose of data processing in advance and justify the necessity of its use.
The inspectorate pays special attention to informing drivers. Notification of video surveillance and automatic license plate recognition must be posted before a vehicle enters the area covered by the cameras, so that individuals can familiarize themselves with the terms before data processing begins.
The informational sign must indicate the fact of video surveillance or automatic license plate recognition, the purpose of processing, information about the operator, and a place where full information about data processing rules can be found.
A detailed notification should contain the legal basis for processing, data retention periods, a list of potential data recipients, and individuals' rights. Such information may be included in the parking rules or on the operator's website, accessible via a QR code.
The DSI emphasizes that a sign stating "Video surveillance is in progress" may not be sufficient if it does not clarify who is processing the data and where to obtain additional information.
The inspectorate also reminds that information may only be stored for as long as necessary to achieve the stated purpose. If parking has been paid for and no disputes have arisen, the operator is not entitled to retain data indefinitely. Exceptions are made in cases where information is needed to resolve a dispute or collect a debt.
Leave a comment