Each license plate is not only linked to technical date, but also to personal data of the owner of the vehicle. Theoretically, it would therefore be possible to acces personal data.
To avoid this and to comply with the GDPR laws, strict measures are taken when linking different datasets. The combination of location, time and vehicle data could lead to a unique identification which is not necessary for the study being carried out.
Data tables will therefore be kept separately and only linked with the absolute minimum number of unique identifiers to guarantee anonymity:
- The dataset from the remote sensing campaign: measured exhaust results with and without location, time stamp and vehicle identifier.
- The dataset of the vehicle registration: relevant characteristics of the vehicle (euro-norm, fuel type, year of manufacturing...) and vehicle identifier
- Where available, Car Pass: data on kms run and vehicle identifier
Where necessary, double blind linking of data will be used by means of a unique token to make the combination of location, timestamp, and vehicle identifier completely anonymous. This guarantees an analysis with only the relevant data, without the unique identifiers.
Contractor Transport & Mobility Leuven will carry out an initial processing of the data to ensure that further processing is carried out (partly by TML, partly by its subcontractor ICCT) with data that are no longer privacy sensitive... To this effect, a data processing, as set out in the data processing agreement between Port of Antwerp-Bruges and Transport & Mobility Leuven.
Transport & Mobility Leuven will make sure that the original data cannot be re-established by its subcontractor ICCT from the anonymous data it processes.
3.2. Under no circumstances shall Port of Antwerp-Bruges collect special categories of personal data, such as data concerning race, political opinions, health, religious and other beliefs, sexual orientation, or the like.
4. Sources of personal data
4.1. In this case, Port of Antwerp-Bruges collects the following personal data:
- The dataset of the vehicle registration as set out under 3.1 above
This dataset will be combined with:
- The dataset from the remote sensing campaign: measured exhaust results with and without location, time stamp and vehicle identifier.
- Where applicable, CarPass: data on mileage and vehicle identifier
5. Purposes for which the data are processes
5.1. Personal data which will be processed:
- Technical characteristics of the vehicle as registered in the vehicle registration will be combined with the data on exhaust gasses as measured by remote sensing, to compare the theoretical euro norm with the actual emissions of the vehicle.
- Personal data linked to the vehicle registration will not be used.
5.2. Your personal data will be shared with to third parties within the EU in the context of this processing, namely:
Transport & Mobility Leuven will process the technical data for Port of Antwerp-Bruges. Transport & Mobility will remove the personal data that will come with the technical data, from the datasets.
5.3. Port of Antwerp-Bruges makes agreements with every contractor it shares personal data with and signs a data processing agreement when required. Port of Antwerp-Bruges only works with companies offering conclusive guarantees for data processing and data protection.
6. Legal basis of the processing
6.1. Personal data are processed for the following purposes:
Processing is in the public interest, more specifically the improvement of the air quality in and around the Port of Antwerp-Bruges. This is done in 2 ways:
- Making an inventory of the actual emissions of the vehicles in the port
- Sanctioning of vehicles with excessive emissions by the competent authorities after selection through remote sensing
7. Period for which the data are kept
Port of Antwerp-Bruges will keep the data for as long as is necessary for the goals as described in 6.1 above.
More specifically the data will be kept for the duration of the project, which means for 6 months after the data have been obtained.
8. Your rights as the person concerned
You can exercise your rights at any moment by sending an e-mail (with proof of identity by attaching a copy of the relevant page or side of your identity card or document) to dpo@portofantwerpbruges.com. Port of Antwerp-Bruges shall reply within one month. Some rights can be exercised directly by you, by making use of the relevant settings.
- You are entitled at any time to withdraw your permission; however, this will not affect the legitimacy of any processing carried out based on your permission before it was withdrawn.
In cases where Port of Antwerp-Bruges acts based on its legitimate aims or in the public interest, you are entitled at any time to make an objection against the processing of personal data concerning you, for reasons of your specific situation. In such a case you must explain your specific reasons. Port of Antwerp-Bruges shall then suspend the processing, unless it is able to show compelling, legitimate grounds for the processing that are more important than your interests, rights and liberties as the person concerned, or that are related to obtaining, exercising, or substantiating a court order.
- You are entitled to get a definite answer from Port of Antwerp-Bruges as to whether personal data concerning yourself are being processed, and if they are, to inspect this personal data. In responding to this request Port of Antwerp-Bruges shall also provide the details of the processing. AHA shall send you a copy of the personal data being processed.
- You are entitled to require Port of Antwerp-Bruges to immediately rectify incorrect personal data concerning yourself. You can also require Port of Antwerp-Bruges to complete any personal information that is incomplete. In some cases, you may be able to rectify or complete your own personal data yourself, for example by accessing an application.
- You are entitled to require Port of Antwerp-Bruges to delete personal data concerning yourself, without unreasonable delay. Port of Antwerp-Bruges shall delete personal data when the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, when there is no longer a lawful ground for data processing, when the data subject objects to the processing and there are no overriding legitimate grounds for the processing, when the personal data have been unlawfully processed, when the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject or when the personal data have been collected in relation to the offer of information society services.
In cases where Port of Antwerp-Bruges has made personal data public and is then required to delete it, Port of Antwerp-Bruges shall take reasonable measures to inform other data processors with access to the information that you have asked for all copies of it, reproductions of it or links to it to be deleted.
In some cases Port of Antwerp-Bruges is not allowed to delete certain personal data, such as when the processing is necessary for exercising the right of freedom of expression and information, for (b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, for reasons of public interest in the area of public health, for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes or for the establishment, exercise or defence of legal claims. The data subject will be informed accordingly if this is the case.
When you ask for your personal data to be deleted, your e-mail address will be kept on a separate list so that Port of Antwerp-Bruges can prove and verify which data subjects have asked for deletion of their personal data and cannot be added to our systems in the future.
- You are entitled to place limitations on the processing of personal data – if you contest their correctness, or if their processing is illegitimate but you oppose deletion of the data, or if Port of Antwerp-Bruges no longer requires the data for the purposes of the processing but you still need it for obtaining, exercising or substantiating a court order, or if you oppose the processing – until such time as Port of Antwerp-Bruges is able to show legitimate grounds for the processing, or until it is able to check the correctness of the data.
In such a case the personal data shall not be processed (apart from simply being saved) except with your permission, or except for obtaining, exercising, or substantiating a court order, or for protecting the rights of another natural or artificial person, or for other weighty reasons of general interest for the European Union or a Member State.
- You are entitled to obtain the personal information concerning you, that you have supplied to Port of Antwerp-Bruges; you are entitled to receive it in a structured, conventional, machine-readable form, and you are further entitled to then pass it on to another data processor. This may apply e.g., whenever the processing is based on permission or an agreement to which you are a party, or when the processing is carried out by automated processes.
- Finally, you are entitled at any moment to submit a complaint to the supervisory authority, namely the Data Protection Authority.