Privacy statement on the use of data obtained from optoelectronic systems at DB Engineering & Consulting

DB Engineering & Consulting GmbH provides engineering services – from the initial idea to design and implementation – for infrastructure, mobility and transport projects in Germany and around the world. In order to secure the market presence and expand the product portfolio, new technologies such as optoelectronic systems, in this case so-called multicopters, terrestrial laser scanners and commercially available camera technology, are applied and used for civil purposes, e.g. infrastructure planning and inspections. Collection, evaluation and use of data from aerial and terrestrial images must be considered a fundamental part of technical advancement, in particular the introduction of building information modeling (BIM).

The following privacy statement provides information about the use of data collected by optoelectronic systems. It explains what data we collect, how we use it and how you can object to having your data processed.

Who is responsible for data collecting and processing?

The party responsible for collecting and processing your data as the Controller is DB Engineering & Consulting GmbH, Part of DB E.C.O. Group, EUREF-Campus 14, Torgauer Str. 12-15, 10829 Berlin, Germany.

The contact person responsible for the use of optoelectronic systems is

DB Engineering & Consulting GmbH, Part of DB E.C.O. Group, Chief Technology Officer, EUREF-Campus 14, Torgauer Str. 12-15, 10829 Berlin, Germany.

If you have any questions or suggestions regarding multicopter, laser scan or camera use, please contact by e-mail: uas@db-eco.com

Dr. Marein Müller is the appointed Data Protection Officer.

If you have any questions or suggestions regarding data protection, please contact DB Engineering & Consulting GmbH’s Data Protection Team at

DB Engineering & Consulting GmbH, Part of DB E.C.O. Group, Data Protection, EUREF-Campus 14, Torgauer Str. 12-15, 10829 Berlin, Germany

E-mail: datenschutz.db-ec@deutschebahn.com

What data do we collect and how and why do we process it?

We collect and process data exclusively for business tasks relating to the business purpose of DB Engineering & Consulting GmbH as an engineering firm.

Multicopters

Multicopters use video technology to take photos and videos to document the condition of sites and structural works. Raw data is used to create standard products, such as 3D point clouds, orthophotos, and 3D surface models.

Data protection for multicopter data - Orthofoto — Orthophoto

Data protection for multicopter data - Digital Surface — digital surface model

Data protection for multicopter data - Point cloud — Point cloud

Raw data may occasionally contain images of people, but images of people are never taken systematically or intentionally. Any persons that happen to appear in images and can be identified are automatically pixelated, i.e. are rendered unidentifiable.

This data process detects people only for the purpose of rendering them unidentifiable. No person-specific data is processed. Likewise, data is not used to monitor employees or participants; it is not used to monitor people’s performance or behavior.

Multicopter flights are announced in advance. On request, residents are provided with an information letter about the specific flight and area covered by the flight.

The legal basis for multicopter use is the safeguarding of the legitimate interests of DB Engineering & Consulting GmbH, Art. 6 Para. 1 S. 1 lit. f of the General Data Protection Regulation, in particular its business purpose, in compliance with the relevant laws and regulations, including the Civil Aviation Act (Luftverkehrsgesetz, “LuftVG”), ordinance on civil aviation (Luftverkehrs-Ordnung, “LuftVO”), Air Traffic Licensing Regulation (Luftverkehrs-Zulassungs-Ordnung, “LuftVZO”), the Occupational Safety and Health Act (Arbeitsschutzgesetz, “ArbSchG”), and authorization by federal states to use unmanned aerial vehicles.

Camera technology for Video2BIM

Additionally, camera technology for Video2BIM is used to take photos and videos to only document the condition of sites and structural facilities.

3D point clouds are automatically calculated as a product using the acquired data (raw data). Raw data may occasionally contain images of people, but images of people are never taken systematically or intentionally. Once the calculation process is complete, it will not be possible to detect any people in the product (3D point cloud) (see photo). Likewise, data is not used to monitor employees or participants, meaning it is not used to monitor people’s performance or behavior.

Data protection for multicopter data - Original image with people — Original image with people

Data protection for multicopter data - Product (3D point cloud) without people — Product (3D point cloud) without people

Prior to a camera recording, information about the use is provided. On request, residents and passers-by are provided with an information letter about the specific flight and area covered by the flight.

The legal basis for use of cameras is the safeguarding of the legitimate interests of DB Engineering & Consulting GmbH, Art. 6 Para. 1 S. 1 lit. f of the General Data Protection Regulation, in particular its business purpose, in compliance with the relevant laws and regulations, including the General Data Protection Regulation and the Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”).

Terrestrial laser scanners

The use of terrestrial laser scanners to record images and point clouds serves the pure documentation of the condition of the terrain and structures.
The raw data may contain random, but never systematic and never targeted recordings of people and/or personal data (e.g. license plates). If people or personal data are recorded and should be recognizable, they will be made unrecognizable.
Therefore, processing of personal data is not happening. Likewise, the monitoring of personnel/involved parties and thus a control of performance and behavior is excluded.
During a scan operation, information signs are posted to inform about the works. Residents or passers-by will receive on request a notice on the specific use and recorded area.
The legal basis for use of terrestrial laser scan operations is the safeguarding of the legitimate interests of DB Engineering & Consulting GmbH, Art. 6 Para. 1 S. 1 lit. f of the General Data Protection Regulation, in particular its business purpose, in compliance with the relevant laws and regulations, including the General Data Protection Regulation and the Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”).

How long do we store data?

We store the collected and calculated data only for as long as is necessary to fulfil the purpose for which the data was collected or if this is required by law, for a maximum of one year after the end of active project use. Terrestrial point cloud data is deleted after the legal retention period.

Data that we process for technical reasons is deleted once it has fulfilled its intended use.

Multicopters

If the quality of raw image data collected during a multicopter flight is sufficient, the data will then be uploaded to a technical platform using a web interface, and any persons that are identified will be pixelated. Raw data collected locally is deleted on all devices without undue delay once it has been successfully uploaded.

Camera technology

The raw data is irrevocably deleted from the capture device immediately after it is uploaded to the technical platform (via SharePoint Online).

Terrestrial laser scanners

The raw data recorded is processed by a limited group of employees to purge the data, stored in a storage area with restricted access and then deleted from all other devices. Further processing only takes place using the purged data, without reference to persons.

The raw data will be deleted after the legal retention period has expired.

Do we share your data with other parties?

We do not share any personal information with third parties.

In addition, the use of external service providers is conceivable for the operation of multicopters, terrestrial laser scanners as well as for the use of camera technology and also for the processing of contracts, such as data center service providers, forwarding services or other parties involved in the performance of the contract.

If we use these services, these service providers will process data on our behalf. We select service providers carefully, and they are subject to contractual requirements. Service providers work under strict conditions and according to our instructions, which we ensure through technical and organizational measures and with additional monitoring.

What rights do you have?

Our aim is to avoid processing personal data through the use of optoelectronic systems. However, you have the following rights if you feel that your personal rights have been affected:

You may request information as to what personal data about you is being stored.

You may request that your personal data be corrected, deleted or its processing restricted (blocked) provided this is permitted by law and possible in the existing contractual relationship.

You have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for DB Engineering & Consulting GmbH, Part of DB E.C.O. Group, is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin, Germany, e-mail: mailbox@datenschutz-berlin.de
You have the right to portability of the data that you have provided to us based on a declaration of consent or a contract (data portability).

Withdrawal of consent
If you have given us your consent to data processing (for example, your consent to receive a newsletter), you may withdraw it at any time by the same means you used to give consent. Any processing of your personal data that took place from the time at which you granted your consent to the time at which you withdrew it will still be considered to have been lawful.

Right of objection
You can object to the data processing for reasons arising from your particular situation, if the data processing is based on our legitimate interests or is necessary for the performance of public tasks.
If we process your data for the purpose of direct advertising, you may object to this promotional approach at any time with future effect.

To exercise your rights, you may send a letter by post to: DB Engineering & Consulting GmbH, Part of DB E.C.O. Group, Chief Technology Officer, EUREF-Campus 14, Torgauer Str. 12-15, 10829 Berlin, Germany. Alternatively, you may send an e-mail to the following address: uas@db-eco.com

Updates to the privacy policy

We will update this privacy statement to reflect modified features or changes to the legal basis. We therefore recommend that you review this privacy statement regularly. If your consent is required, or if components of the privacy statement contain provisions regarding our contractual relationship with you, changes will be made only with your consent.

Last modified February 2024