Information pursuant to Art. 13 General Data Protection Regulation (GDPR) concerning video surveillance

1. Contact details of data protection officer

You can contact our data protection officer as follows:

Häfen und Güterverkehr Köln AG
Am Niehler Hafen 2
50735 Cologne
E-mail: datenschutz(at)hgk.de

2. Name and contact details of person responsible

Name and contact details of the person repsonsible are given on local signage in the areas under surveillance.

3. Scope of processing of personal processes

The respective controller generally collects and uses personal data only where this serves the following purposes:

• Exercising of domiciliary rights
• Improvement of criminal prosecution by preservation of evidence in cases of vandalism, damage to property, theft and other criminal offences.

Purposes other than and additional to this are indicated on local signage in the areas under surveillance.

The collection and use of personal data generally takes place only where legitimate interests are present. If therefore the processing is necessary for the protection of a legitimate interest of the respective controller or of a third party and if the interests, basic rights and basic freedoms of the data subject do not prevail over the above-mentioned interest, then Art. 6 Para. 1 f GDPR and Section 4 Para. 1 Federal Data Protection Act (BDSG new version) serves as the legal basis for the processing.

4. Data erasure and storage duration

The personal data of the data subject is deleted or blocked as soon as the purpose of storage ceases to apply; this is the case after the storage period indicated on the respective local signage for the controllers listed.

In addition, data is stored for longer where appropriate recordings are necessary on an individual basis for the pursuit of the specified purposes, for example in the case of a recorded offence.

5. Information concerning the rights of data subjects

Data subjects have the right to request confirmation from the responsible person whether personal data concerning them is processed; if this is the case, they have the right of access to the following information:

• the purposes for which the personal data is processed;
• the categories of personal data that are processed;
• the recipient or categories of recipients to whom the personal data concerning you is disclosed or will be disclosed;
• the planned storage duration of the personal data concerning you or, if concrete information cannot be provided here, criteria for determining the storage duration;
• the existence of a right to rectification or erasure of the personal data concerning you, a right to restrict processing by the controller or a right to object against this processing;
• the existence of a right of appeal with a supervisory authority;
• all available information about the origin of the data, if the personal data was not collected from the data subject;
• the existence of an automated decision-making system including profiling pursuant to Art. 22 Paras. 1 and 4 GDPR and – at least in these cases – meaningful information about the involved logic and extent the desired outcomes of a processing of that kind for the data subject.

The data subject has the right to request information about whether the personal data concerning the data subject is transferred to a third country or to an international organisation. In this connection they can request to be informed about the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

Right to rectification

The data subject has the right to request of the controller the immediate rectification of personal data concerning the data subject that is incorrect and where relevant the completion of incomplete personal data (Art. 16 GDPR).

Right to deletion

The data subject has the right to request of the controller that personal data concerning the data subject be immediately deleted, where one of the following reasons applies:

• The personal data concerning them is no longer necessary for the purposes for which it was gathered or otherwise processed.
• The data subject revokes the data subject’s consent on which the processing pursuant to Art. 6 Para. 1 a or Art. 9 Para. 2 a GDPR is based and no other legal basis exists for the processing.
• The data subject lodges an objection to the processing pursuant to Art. 21 Para. 1 GDPR and there are no overriding legitimate reasons for the processing, or the data subject lodges an objection to the processing pursuant to Art. 21 Para. 2 GDPR.
• The personal data concerning the data subject has been processed unlawfully.
• The deletion of the personal data concerning the data subject is necessary to fulfil a legal obligation under Union law or the law of the member states to which the controller is subject.
• The personal data concerning the data subject has been collected in relation to services offered by the information society services pursuant to Art. 8 Para. 1 GDPR.

If the controller has made the personal data concerning the data subject public and if the controller is obliged under Art. 17 Para. 1 GDPR to erase it, the controller must take appropriate measures, including of a technical nature, and taking into consideration the available technology and the costs of implementation, to inform the controllers that process the personal data that the data subject has requested of them the deletion of all links to this personal data and from copies or replications of that personal data.

The right to deletion of data does not exist where the processing is necessary:

• to exercise the right to freedom of expression and information;
• to fulfil a legal obligation required under Union law that requires the processing under the law of the member states to which the controller is subject, or for the performance of a task that is in the public interest or that takes place in the exercising of official authority that has been transferred to the controller;
• for reasons of public interest in the area of public health pursuant to Art. 9 Para. 2 Points h and i and Art. 9 Para. 3 GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes or for statistical purposes pursuant to Art. 89 Para. 1 GDPR, where the right stated under Section a) is likely to make the realisation of the objectives of this processing impossible or to severely impact it, or
• for the assertion, exercising or defence of legal claims.

Right to restrict processing

The data subject has the right to request of the controller that processing be restricted:

• if the data subject disputes the correctness of the personal data concerning the data subject for a period that enables the controller to check the correctness of the personal data;
• if the processing is unlawful and they refuse the erasure of the personal data and instead request the restriction of the use of the personal data;
• the controller no longer requires the personal data for the purposes of processing but the data subject nevertheless needs it for purposes of assertion, exercising or defence of legal claims, or
• if the data subject lodges an objection to the processing pursuant to Art. 21 Para. 1 GDPR and it is still not clear whether the legitimate reasons of the controller prevail over the data subject’s reasons.
• If the processing of the personal data concerning the data subject has been restricted, this data can only be processed – other than its storage – with the data subject’s consent or for the assertion, exercising or defence of legal claims or to protect the rights of another natural or legal person or for reasons of an important public interest of the Union or of a member state.
• If the processing is restricted in accordance with the above-mentioned conditions, the data subject will be informed by the controller before the restriction is lifted.

If the data subject has asserted the right to rectification, erasure or restriction of processing against the controller, the latter is obliged to notify all recipients to whom it has disclosed the personal data concerning the data subject of the rectification or erasure of the data or of the restriction of processing, unless this proves to be impossible involves a disproportionately high outlay.

Right to data portability

The data subject has the right to receive the personal data concerning the data subject that the data subject has provided to the controller in a structured, common, machine-readable format. The data subject also has the right to transfer this data to another controller without hindrance by the controller to whom the personal data was provided, provided that

• the processing is based on consent pursuant to Art. 6 Para. 1 a GDPR or Art. 9 Para. 2 a GDPR or on a contract pursuant to Art. 6 Para. 1 b GDPR and
• the processing is performed using automated processes.
• In the exercising of this right, the data subject is further entitled to ensure that the personal data concerning the data subject is transferred directly from one controller to another controller, to the extent that this is technically feasible. Freedoms and rights of other persons may not be affected by this. The right to data portability does not apply for the processing of personal data that is required for the performance of a task that is in the public interest or that takes place in the exercising of official authority that has been transferred to the controller.

The data subject has the right vis-a-vis the controller to be informed about the recipient of the personal data.

Right to object

The data subject has the right, for reasons arising from their particular situation, to lodge an objection at any time against the processing of personal data concerning the data subject. The controller will then no longer process the personal data, unless it can demonstrate compelling legitimate grounds for the processing that prevail over the interests, rights and freedoms of the data subject, or the processing serves the assertion, exercising or defence of legal claims (Art. 21 GDPR).

Right of appeal to a supervisory authority

All data subjects have, without prejudice to any other administrative or judicial remedy, the right to appeal to a supervisory authority if the data subject is of the view that the processing of the personal data concerning the data subject is in violation of the GDPR (Art. 77 GDPR).

The data subject can assert this right before a supervisory authority in the member state in which the data subject has the data subject’s place of residence, place of work or the site of the suspected violation.

In North Rhine-Westphalia, the competent supervisory authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2-4
40213 Düsseldorf

The supervisory authority before which the appeal is lodged informs the appellant about the status and outcomes of the appeal, including the possibility of a judicial remedy under Art. 78 GDPR.

Dated: July 2023