Privacy notice for passerbys affected by the autonomous driving project run by Berliner Verkehrsbetriebe (BVG) AöR

Within the NoWeL4 project, personal data is processed by several joint controllers within the meaning of Art. 26 GDPR: BVG AöR, MOIA GmbH and Volkswagen Autonomous Mobility GmbH.

However, the primary point of contact (central contact point) for data subjects is:

Berliner Verkehrsbetriebe (BVG) AöR
Holzmarktstraße 15–17
10179 Berlin

You may generally exercise your rights against any of the joint controllers. For the purpose of swift and consistent handling, BVG coordinates requests from affected passers-by as the central contact point

In the NoWeL4 project, BVG, together with technology partners, is testing autonomous vehicles at automation level 4 on public roads in the city of Berlin. The vehicles participate in regular road traffic and move independently within a defined test area.

In order to participate safely in road traffic, the vehicles need to perceive their surroundings. Various sensors are used for this purpose, in particular cameras and acoustic sensors for detecting road users, vehicles and obstacles. Further information is available here.

The vehicles are fitted with clearly visible markings indicating video surveillance and identifying the responsible controller.

Processing is carried out exclusively for the following purposes:

• ensuring road safety, in particular by detecting persons, vehicles and obstacles,
• navigation and control of the autonomous vehicles,
• testing, analysis and further development of autonomous driving functions within the pilot project,
• securing evidence in the event of safety-relevant incidents (e.g. accidents, hazardous situations).

The data is not used for surveillance, marketing or profiling purposes.

When autonomous vehicles pass by, environmental data may be captured for a short period of time, in particular by visual sensors (e.g. cameras for detecting road users) and acoustic sensors (ambient road-traffic sounds).

No targeted identification of individual persons takes place.

The systems are designed for object detection and do not include biometric facial recognition functionality. No audio recording takes place.

Further information can be found from our partner responsible for data protection in this respect: Datenschutz zur Testphase autonomer Ridepooling-Systeme (White-Label-Kontext) | MOIA

Personal data is processed only where an appropriate legal basis exists and in accordance with the applicable purpose limitation requirements.

Further information can be found from our partner responsible for data protection in this respect: Datenschutz zur Testphase autonomer Ridepooling-Systeme (White-Label-Kontext) | MOIA

Data generated in connection with the perception of the vehicle’s surroundings is processed only until the relevant legal basis and purpose no longer apply.

Further information can be found from our partner responsible for data protection in this respect: Datenschutz zur Testphase autonomer Ridepooling-Systeme (White-Label-Kontext) | MOIA

Access to the data is limited exclusively to:

• BVG AöR
• MOIA GmbH
• Volkswagen Autonomous Mobility GmbH

The data is not disclosed to unauthorised third parties and is not published.

In the event of safety-relevant incidents, data may be transmitted to the competent authorities (e.g. police, public prosecutor’s office) where this is necessary to avert danger or prosecute criminal offences (Section 4(3) sentence 3 BDSG, Section 20(3) BlnDSG).

The vehicles make automated driving-dynamic decisions (e.g. braking or evasive manoeuvres) to ensure road safety.

No automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning passers-by or similarly significantly affects them takes place.

As a rule, personal data is not transferred to countries outside the European Economic Area (third countries). If a transfer to a third country becomes necessary within the project, it will take place only in compliance with the requirements of Art. 44 et seq. GDPR, for example on the basis of standard contractual clauses and supplementary measures.

As a data subject, you have the following rights:

• Right of access (Art. 15 GDPR): You may request information as to whether and which personal data concerning you is processed.
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR): You may request the erasure of your data where the statutory requirements are met.
• Restriction of processing (Art. 18 GDPR)
• Objection to processing (Art. 21 GDPR)

How can you exercise your rights?

You can exercise your rights as a data subject by e-mail to:

Info-datenschutz@bvg.de

or

datenschutz@bvg.de

or by post to:

Berliner Verkehrsbetriebe (BVG) AöR
- Group Data Protection Officer -
Holzmarktstraße 15–17
10179 Berlin

Special note: Identification is generally not possible (Art. 11 GDPR):

Since passers-by in the vehicle environment usually cannot be identified without additional information and identification is typically not required for the purposes of environmental perception, we are not obliged to process additional data solely for the purpose of identification.

To enable us to assess whether you may have been affected by a recording, we need sufficient information from you, for example:

• exact location,
• date,
• as precise a time as possible (the more precise, the better),
• where applicable, a description of the situation or position.

Access (Art. 15 GDPR):
You have the right to obtain confirmation from us as to whether we process personal data concerning you. If this is the case, you may request access to this data and further information in accordance with Art. 15 GDPR.

Since persons captured in the vehicle environment generally cannot be identified without additional information and identification is generally not required for our purposes, we are not obliged to process additional data solely for the purpose of identification.

To enable us to assess whether you may have been the subject of a recording, we require, where available, in particular:

• location (street/intersection/distinctive surroundings),
• date and as precise a time as possible,
• where applicable, a brief description of the situation.

Erasure (Art. 17 GDPR):
You have the right to request the erasure of your personal data where the statutory requirements are met (Art. 17 GDPR). Since incidentally captured persons generally cannot be identified without additional information, we require, where available, in particular information about the location as well as the date and the most precise time possible in order to assess your erasure request, where applicable supplemented by a brief description of the situation.

We decide on a case-by-case basis and document whether erasure would seriously impair the development or testing purposes (Art. 17(3)(d) GDPR).

Where data is required for the establishment, exercise or defence of legal claims, it may, where applicable, be stored for longer within the limits of the statutory requirements.

Objection (Art. 21 GDPR):

You may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

XI. Competent supervisory authority

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin

Phone: +49 30 13889-0
E-mail: mailbox@datenschutz-berlin.de
Website: www.datenschutz-berlin.de

You have the right to lodge a complaint with this authority about the processing of your personal data.

As of: July 2026

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin

Telephone: +49 30 13889-0
Email: mailbox@datenschutz-berlin.de
Website: www.datenschutz-berlin.de

You have the right to lodge a complaint with this authority regarding the processing of your personal data.

As of: April 2026