(01) Ottl 6351

Title of the paper: Legal data processing in motorized manual timber harvesting in forestry 4.0. 

In the context of motor-manual timber harvesting with a chainsaw, systems for sensor-based data acquisition are increasingly being used, with which personal data are processed. The manufacturers of these systems are data controllers under data protection law in relation to the owners of the chainsaws. The owners of the machines are data subjects under data protection law. If the chainsaws are additionally managed by third party additional users as data subjects, then in this relationship both the manufacturers and the owners are data controllers under data protection law. Commissioned processing by the manufacturers is not to be assumed. There is also no joint responsibility of manufacturers and owners towards the additional users.

The data processing is subject to permission. Data processing by manufacturers can be legitimized by consent. Something else only applies if the data subject is an employee and the data processing is carried out at the instigation of the employer. The performance of a contract can legitimize data processing by manufacturers only in the event that the data subject has purchased the system for data collection directly from the manufacturer. Legitimate interests, however, can always justify data processing by manufacturers because they have product monitoring obligations to fulfill and must ensure product safety. Similar principles apply mutatis mutandis to data processing by service agencies. Consent is therefore in principle not a mandatory requirement for the processing of chainsaw data by manufacturers and service agencies. Data processing will regularly be legitimized by a legitimate interest of the manufacturers and service agencies.

In the private sector, data processing by owners may be legitimized by the consent of the data subject. In the area of commercial chainsaw use, data processing by owners can only be legitimized by the consent of the data subject if the data subject works for the owner on a selfemployed basis. On the other hand, if the data subject is an employee of the owner, their consent cannot legitimize data processing by the owner. The performance of a contract cannot justify data processing by the owners, because, taking a close look at life, no constellation is conceivable in which data processing is necessary for the performance of a contract with the owner. For purposes of the employment relationship, only data on the equipment number as well as information on the operating time and machine operations as well as the location data can be processed by the owner.

However, legitimate interests can always justify the processing of data by the owner, because the owner has a legitimate interest in optimizing the operation of the chainsaws in economic terms. Thus, consent is also not a mandatory requirement for the processing of chainsaw data by the owner. Here, too, data processing will regularly have to be legitimized by a legitimate interest of the owner. However, the collection of employee data requires the co-determination of an elected works council or staff council in any case, because the data is objectively suitable for monitoring employees in any case.