In the present case, the Austrian Data Protection Authority answered in the affirmative the question whether automated license plate recognition for the purpose of billing the use of a parking garage is permissible.
The operator of a larger shopping centre (the respondent) provides the use of a parking garage. A camera automatically recorded the registration number of the complainant’s car as she entered the car park. Thus, she claimed a violation of the right to secrecy, as well as a violation of the prohibition of tying.
The Data Protection Authority explained that, in addition to the registration plate, other personal data (exact time and exact place where the vehicle owner was) were processed and that the information and identification obligations were not properly implemented, because the processing (the registration of the registration plate for the purpose of billing the use of the garage) was not stated anywhere before the entry to the garage.
Nevertheless, the Authority found that this was irrelevant. Reasonable expectations must be considered in the balancing of interests. Automated license plate recognition for the purpose of billing the usage of a garage is not uncommon. Furthermore, the respondent has provided appropriate technical and organisational measures to safeguard the interests of the complainant (e.g. the immediate deletion of personal data after the payment).
In the view of the Data Protection Authority, the legitimate interests lie in the rapidness and efficiency of the processing for the execution of such short usage contracts. The complainant did not bring forward any legitimate interests and the respondent has not processed the data for any purpose other than the settlement of the car park ticket. A violation of the prohibition of tying under Art. 7 (4) DS-GVO could not be sustained in the specific case, as the respondent did not base the processing on consent under Art. 6 (1) (a) DS-GVO.
The appeal was dismissed and the decision is final.