Autonomy Vehicle Public Filming Data Privacy Notice
How we use data from Rivian-owned or -operated vehicles to enhance vehicle safety features
1. PURPOSE OF THIS NOTICE AND OVERVIEW
Rivian respects your privacy, and we are committed to protecting it. The purpose of this Autonomy Vehicle Public Filming Data Privacy Notice ("Notice") is to inform you how we process personal data as a data controller within the meaning of applicable data privacy laws when we capture live video footage, images, and signals while conducting public filming using Rivian-owned or -operated vehicles to enhance our vehicles’ capabilities for driver assistance features. Specifically, we may collect the personal data of pedestrians, other drivers, or others in the vicinity of our vehicles during filming.
This Notice does not cover the processing of personal data related to images collected from customer-owned vehicles. Please see our Data Privacy Notice for more information regarding our practices for handling this personal data, including collection, storage, or usage, and our legal grounds for processing personal data.
This Notice uses the term "we", "us" or "our", which refers to the legal entity of the Rivian Automotive group of companies ("Rivian") that will collect and use the personal data collected through the vehicle’s cameras. Please see section 8 ("Contact Us") below for more information.
As we will describe below in more detail, Rivian-made vehicles are equipped with cameras that capture road markings, signage, and other public objects and places that can be accessed by or seen from the vehicles. We may use that footage to enhance our vehicles’ capabilities for ADAS-related features and improve the vehicles’ safety features to improve road safety.
2. CATEGORIES OF PERSONAL DATA WE COLLECT
During our filming, we may collect and process the following categories of personal data:
- Video and Image Data. Video and images of pedestrians, other drivers, or others in the vicinity of our vehicles during filming.
- License Plate Data. License plate numbers and states of other vehicles.
- Location Data. We may collect and process location data, such as GPS location, which helps us determine the vehicle’s location to support our driver assistance features.
We do not attempt to associate this data with any identifiable individuals or vehicles, unless required to do so by law or for the purposes of a crash investigation.
3. PURPOSES AND LEGAL GROUNDS FOR WHICH RIVIAN COLLECTS AND USES YOUR PERSONAL DATA
We collect and process the data in Section 2 for the following purposes:
- to train and improve our existing driver assistance algorithms and image recognition (AI), including recognition of road markings and signage, designed to increase road safety by reducing the risk of traffic accidents;
- to improve vehicle safety features, including collision avoidance brake assistance, lane keep assistance, and distance keeping features;
- to develop new automated driving features and/or other advanced driving assistance systems; and
- to develop maps and other driver assistance safety features specific to each country.
Any Rivian-owned vehicles that we use for the above purposes are marked in a conspicuous way, in particular by our company logo, a dedicated website URL and a QR code through which this Notice can be accessed.
The processing of the data listed in Section 2 is necessary for the purposes of the legitimate interests pursued by Rivian. Pursuant to Art. 6(1)(f) of the European Union General Data Protection Regulation, we conducted an assessment that the processing is proportional and does not outweigh the rights and interests of the captured individuals, including children.
4. CROSS-BORDER DATA TRANSFERS
We may transfer your personal data or store it internationally, including to or in countries that do not have data protection laws equivalent to those in the country where you reside or where your personal data is collected, for the purposes described above. For example, we may share the captured footage with Rivian teams and third parties with whom we have contracted to help annotate and analyze the images involved in the above processing activities, including those located in the United States.
- For transfers from the European Economic Area ("EEA") Member States or UK to countries for which the European Union ("EU") Commission or the United Kingdom ("UK") Information Commissioner’s Office has issued an adequacy decision saying the level of data protection is equivalent to the level within the EU or UK, we can rely on those adequacy decisions; this applies, for example, for data transfers between the UK and EEA Member States.
- For transfers from the EEA or UK to countries without an adequacy decision, Rivian has implemented appropriate safeguards to provide the necessary level of data protection, primarily by entering into appropriate data transfer arrangements based on approved standard contractual clauses.
- Personal data about Canadians or that is collected in Canada may be transferred or stored outside of Canada, including to/in the United States, the United Kingdom, the European Union, and Serbia, and may be subject to the laws and accessible to the courts, law enforcement and national security authorities of such jurisdictions. Please contact our Canadian Privacy Office and Quebec Privacy Officer as listed in Section 8 ("Contact Us") below if you wish to ask a question or obtain written information about our policies and practices with respect to service providers and other members of the Rivian group of entities outside of Canada who may process or store personal data.
5. DATA RETENTION AND SECURITY
We mitigate the potential risks to the rights and freedoms of natural persons by performing the above processing activities and subsequently deleting the footage when it is no longer needed. Most video footage and associated images will be deleted within one year of collection. A small portion of video and images may be kept longer only as necessary to improve the object detection algorithm.
We have implemented appropriate technical and organizational measures to protect the captured data against loss, alteration, unauthorized access, and disclosure, as well as accidental and unlawful destruction.
The video footage will be stored temporarily on encrypted data storage drives before being transferred to the cloud. The data will only be accessed by authorized Rivian personnel and trusted third parties for the annotation and analysis noted above.
6. YOUR DATA PRIVACY RIGHTS
Depending on your location and applicable laws and regulations, you may also have data privacy rights regarding Rivian’s processing of your personal data. Based on the legal requirements applicable to your jurisdiction, and subject to any legal restrictions or exceptions, you may have the rights described below.
- Access/Know. Request confirmation from us as to whether or not your personal data is being processed by Rivian and, if so, access to such data and/or the more detailed circumstances of the data processing.
- Deletion/Erasure. Request that your personal data be deleted without undue delay. In certain circumstances, it may not be possible for us to accept your request, for example, when the processing is necessary to comply with a legal obligation, or if the processing is necessary for the performance of a contract.
- Restriction of Processing. Request that we restrict processing of your personal data. In certain circumstances, it may not be possible for us to accept your request, for example, when the processing is necessary to comply with a legal obligation, or if we can demonstrate compelling legitimate grounds otherwise.
- Object to Processing. Object, on grounds relating to your particular situation, to our processing of personal data concerning you which is (i) necessary for the performance of a task carried out in the public interest, (ii) carried out in the exercise of official authority vested in us, or (iii) processed by us on the basis of our legitimate interest. In this case, where applicable, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
- Complaints. Lodge a complaint with a supervisory authority at any time if you are of the opinion that the processing of personal data relating to you violates applicable law. If the complaint relates to provisions of the EU GDPR, you can lodge such complaint with a supervisory authority in particular in the Member State of your place of residence, your place of work or the place of the alleged infringement. You may identify the applicable lead supervisory authority based on your location on the European Data Protection Board website. If the complaint relates to provisions of the UK GDPR, you can lodge such complaint with the Information Commissioner’s Office.
To exercise your privacy rights, please visit this web form.
We will acknowledge and coordinate these requests as timely as possible. Initially, we will respond to and fulfill any such requests within one month or in accordance with applicable laws, which may be slightly longer (e.g., 45 days for California). In case we cannot comply with a request or cannot fulfill a request within that timeframe, we will generally provide you with the reason for this. We may request specific information from you to help us confirm your identity and your rights. Applicable laws may allow or require us to refuse to provide you with access to some or all of the personal data that we hold about you, or we may have destroyed, erased, or made your personal data anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal data, we will generally inform you of the reasons why, subject to any legal or regulatory restrictions.
We will not discriminate against you for exercising any of your privacy rights.
7. CHANGES TO THIS NOTICE
We reserve the right to update this Notice at any time, and we will post the new Notice as soon as possible.
Last Updated: August 2, 2024
8. CONTACT US
If you have any questions or concerns about our processing of your personal data as described in this Notice or to exercise your privacy rights, please contact us as specified below based on your location:
- US/Other: By email at privacy@rivian.com, by telephone at (888) RIVIAN1 (748-4261), or by mail at Attn: Privacy Office, 14600 Myford Road, Irvine, CA 92606.
- Canada: Attn: Privacy Office and/or Quebec Privacy Officer, by email at privacy@rivian.com, by telephone at (844) RIVIAN1 (748-4261) or by mail at 1038 Homer Street, Vancouver, BC V6B 2W9.
- EU/UK: By email at privacy@rivian.com or dpo@rivian.com or by mail at Herengracht 433, Unit 2.01 and 2.02, 1017 BR Amsterdam, The Netherlands.
You may identify the applicable Data Controller that processes your personal data at this webpage.
