Autonomous vehicles in Germany

A. Mergers and acquisitions

(i) General M&A trends in the automotive technology sector

The M&A landscape is highly driven by innovation and emerging technologies.⁴ Technology driven investments are constantly growing in all sectors and have increased by 60% since 2015.¹²⁹ The Autotech sector has also seen significant growth over the past years.⁵ Traditional vehicle makers and other companies in the automotive sector acquire or build partnerships with innovative technology startups and established technology companies to proactively embrace current trends in the ever-changing automotive market environment.⁶ The goal is to integrate intelligent technologies into the vehicles to connect them, make them smart and finally autonomous. Not surprisingly, sensors, radar and LIDAR, as well as software aimed at the processing and analysis of large data amounts, have become particular drivers for M&A activity in the automotive sector. In addition, with disruption in the automotive industry progressing rapidly, a significant number of M&A transactions is paving the way for the current products of many automotive manufacturers being transformed into service offerings of future mobility services providers.

While market data evidence that the deal volumes for M&A in mobility services have reached unprecedented levels (particularly through a number of megadeals in car sharing and ride hailing), the average deal volume of investments in autonomous driving technology has declined — while at the same time the number of deals, as well as the number of majority participations acquired by investors, has increased. This trend is a sign for more early-stage investments in autonomous driving technology as well as an increase in strategic investments.⁷

(ii). Investing in biometrics

M&A activities in the biometrics sector have many things in common with M&A activities in traditional technology sectors. Lessons learned from M&A in the biometrics sector highlight in particular the necessity to pursue a well-considered, holistic due diligence approach for a buyer to successfully complete an acquisition – be it in bilateral transactions or in transactions in from of an auction process.

Understanding the target company’s current economic and financial state of play as well as its technological offerings is of core importance for an investment to prosper. Investments concerning cutting-edge technologies such as biometrics require a potential buyer to ascertain at the earliest possible moment the technical sanity of the biometric technology to be acquired. Such technology assessment should be embedded in a thorough legal and financial due diligence – including, in particular, anticipating the future application cases for the respective biometric technology. To avoid siloed information, potential buyers have found it extremely helpful to have the legal due diligence include a legal technology consultancy element – which Norton Rose Fulbright provides, for instance, through its very own technology consultancy practice. The involvement of the technology consultancy practice can help to bridge the gap between the technical and legal assessment of an investment in biometrics – sometimes drilling down to legal and technical issues arising on the level of the coding and the programming of the software itself. Biometric technology used in the context of autonomous driving combines statistical methods with biometric data collected through vehicles and stationary infrastructure.⁸ For that reason, the legal due diligence needs to focus specifically on the compliance with data privacy laws as well as on the often challenging copyright and IP related issues. It is also essential to identify cyber risks and evaluate the effectiveness of countermeasures in connection with the use of biometrics in AVs. Legal issues may also arise from competition regulation as well as product liability and tort laws.

In the current competitive market environment, the time frame for such a holistic approach to due diligence in the course of an M&A transaction is often very tight. This narrow window frames the need for a potential buyer not to waste time and to instruct and involve qualified legal advisors already at an early stage in the M&A transaction. At such early stage, additional focus should be placed on the suitable acquisition structure, not only from a tax but also from a corporate governance perspective.

As far as the latter is concerned, the specific requirements may differ on a case-by-case basis. Strategic investors may seek to implement governance structures that allow them to integrate the target company fully into an existing corporate structure in order to benefit most from synergies within the own business ecosystem. Financial investors will often abstain from taking direct operational decisions – but will entrench their financial interests and exit expectations through various rights and instruments on the level of the rules of procedure, the articles of association and the investment agreement. The earlier such respective governance requirements are identified and articulated by a potential buyer, the less friction and delay will be experienced at later stages in the transaction timeline.

B. Data protection and security

An AV is typically recording and processing personal data, including inter alia biometric characteristics that could be considered biometric data under the EU privacy laws. The car is equipped with many sensors that record the driver (as long there is still one and the car has not reached level 5 with full autonomy) and the vehicle’s surroundings. Biometrics could be used to identify and authenticate the driver or car owner before unlocking the car, initiating the ride or detecting signs of sleepiness or drunkenness for safety purposes. This may happen with fingerprints, facial or behavioral recognition techniques – as already known by modern smartphones. The advantage is that these means of identification and authentication are easy to use and seem to be more secure. Regarding the vehicle’s surroundings, typically sensors and cameras scan public streets to allow the vehicle to predict and avoid possible accidents. Such recordings may be used live during the ride, to steer the vehicle, or may be recorded and transmitted to the operator to allow the artificial intelligence (AI) behind the AV to learn from new traffic situations and optimize the algorithms used. Theoretically, such recordings could also allow the operator to use face recognition techniques to re-identify traffic participants in different situations, allowing the AI to better predict their future behavior in traffic.

Art. 4 (14) GDPR defines biometric data as “personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allow or confirm the unique identification of that natural person such as facial images or dactyloscopic data.” According to this definition, only biometric characteristics that result from specific technical processing and could permit the unique identification of a person would be considered biometric data.

As automated vehicles use specific technical processing, the first requirement is easily met. Such data as age, height and gender are generally not considered biometric data under the GDPR, as they do not usually allow the unique identification of a person according to the Conference of the Data Protection Authorities in Germany (Die Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder)⁹. According to the German Data Protection Authorities, biometric samples, i.e. the analogue or digital representations of biometric characteristics prior to biometric characteristic extraction, as well as biometric characteristics, i.e. the numbers or distinctive features extracted from a biometric sample and that can be used for comparison purposes, could be classified as biometric data under the GDPR¹⁰.

Based on this definition, not all biometric characteristics used in automated vehicles can be regarded as biometric data. In particular, the information pertaining to bodily characteristics used to identify and verify the vehicle owner or driver, such as fingerprints and facial recognition, are clearly biometric data. The behavioral data used to control the vehicle falls under the definition only if it enables unique identification of the person. For example, the driver’s behavioral information generally indicating sleepiness or drunkenness would not be considered biometric data within the scope of the definition.

Biometrics is one of the “special categories of personal data” under Art 9 GDPR that broadly prohibits the processing of biometric data for the purpose of uniquely identifying a natural person, but it recognizes certain legal bases to justify its processing, chiefly, the explicit consent of the data subject, the performance of specific contracts or processing for certain specific purposes.

When the data relates to the driver or the vehicle’s owner, a solution to use his/her sensitive or biometric data could be an explicit consent. According to the German Data Protection Authorities the consent must explicitly refer to the use of the biometric data.¹¹ Therefore, there must be an explicit reference to the biometric data and its sensitivity in the consent. The German Data Protection Authorities stated in the Hambach Declaration on Artificial Intelligence¹² that decisions  (e.g. identification and verification) based on the use of AI systems must be transparent and comprehensible. It is not sufficient to provide an explanation with regard to the result; the data subject must also be able to understand the processes. Moreover, the algorithms involved must also be sufficiently explained.

Furthermore, the specific purpose of the data processing needs to be stated, e.g. unambiguous identification of the vehicle’s owner.¹³ Further, the EU privacy laws require such consent to be freely given. An operator of the service, therefore, cannot require the user/driver to necessarily give such consent. Practically, that means that the operator has to offer alternatives as to how the users/drivers can identify or authenticate themselves – so that the biometrics use is an option that only the individual can freely decide to use or not.

The information collected from the vehicle’s surrounding are not necessarily considered as biometric data or even personal data. If the vehicle only recognizes that the people (e.g. children) are on the road, such data does not allow individual identification of the data subject and therefore does not fall under the definition. If a unique identification could be possible, it would be more difficult to find a legal ground for processing of such biometric data. Typically it is not possible to receive consent from each person on the street. None of the other grounds under Art. 9 GDPR are easily applicable. Alternatively, the operator may argue that optimizing AI algorithms are a form of research and might therefore rely on the GDPR’s research exemptions. This is a tricky path, however, which might be available during development, but less easy in the later regular operation of the service.

Finally, the operator of the AV service would have to consider that biometric data require special technical and organizational measures that must be adequate to the risk exposure of such data. Biometric data especially is very demanding to secure – an attacker who misuses the fingerprint or facial recognition is a nightmare. Once this data is in public, how should the affected “owner” of the data react? He cannot just change his face or thumb like he would be able to change a password or user login. The damages that might occur by disclosing and misusing biometric data probably can never be fully mitigated again. The principal concern of the Article 29 Working Party, an advisory body made up of a representative from the EU data protection authorities (“WP29”) replaced by the European Data Protection Board, is the security and confidentiality of biometric data in order to prevent unlawful use. In this respect the WP 29 has made recommendations. The German Data Protection Authorities have not yet developed guidelines and recommendations on technical and organizational measures to implement a biometric authentication, and the development of such measures is the responsibility of industry and science.¹⁴

Following the recommendation of the WP29, service providers should generally avoid storing such data in the cloud, but only in a secure place in the vehicle itself. If the data is stored in the cloud, the data controller has to establish a detailed policy on how to control its contractors, such as unexpected inspections, and require guarantees regarding employees, procedures regarding individual’s rights, etc.¹⁵ Further, the entire fingerprint should not be saved, but only single reference points, allowing the right user to identify when the thumb is presented, but not allowing a third party to misuse such reference points only.

C. Biometrics and insurance

The use of biometric data may bring significant advantages to the insurance industry. However, it remains to be seen to what extent the following will actually occur, due to restrictions by data protection law (e.g. special protection of biometric data for the purpose of uniquely identifying a natural person and of data concerning health as special categories of personal data).¹⁶

(i) More tailored insurance programs

With the use of biometric data and the availability of ever more accurate data comes the chance for more focused underwriting decisions and more sophisticated tailoring of insurance programs. Insurers already make use of voluntary self-tracking data as a basis for the premium calculation.¹⁷ Such data are currently available from telematics products (“Pay how you drive” (PHYD) and “Pay as you drive” (PAYD)). While “Pay how you drive” only relates to vehicles with drivers “Pay as you drive” also relates to AVs. In Germany “Pay how you drive” products are offered by several insurers. ¹⁸

The use of biometric data, in conjunction with telematics, enables a very thorough representation of the insured risk by building a more personal picture of the driver.¹⁹ While “Pay as you drive” is tailored in a static way to an individual vehicle with a fixed number of drivers, insurance programs for AVs may be tailored to an individual policyholder in a dynamic usage based way. In particular, this makes it possible to tailor the insurance program to the frequency of use of a certain vehicle by a certain driver, which can be monitored due to respective technology. This personal picture of the driver is especially useful when a policyholder uses several vehicles (e.g. car sharing). Biometrics technology and data can also integrate further value-added services such as user authentication and camera systems directed at the driver to detect fatigue or drowsiness, resulting in alerts.²⁰ Insurers may bind such value-added services as an option to existing auto insurance.²¹

Biometric data being available is expected to have a positive impact on underwriting and determination of the insurance premium.²² Biometric data also creates an opportunity for insurers to provide more personalized insurance policies with flexible insurance rates specific to drivers.²³This driver-specific insurance is currently already discussed for highly automated vehicles where a reduction of the premium might be considered by an insurer if a policyholder often allows the automated systems to take over instead of driving himself.²⁴

(ii) Claims handling

Use of biometric data is expected to have an impact with regard to claims handling relating to AV accidents. AVs are already generally expected to be involved in fewer accidents than vehicles with drivers, even though such accidents will be more expensive due to highly sophisticated in-vehicle systems, including biometrics technology. In addition to this general advantage of AVs, more accurate data being available, such as driver identification data, will likely decrease the amount of fraudulent claims.²⁵ If biometric data can be used by claims handlers in real-time this would speed up the claims process even further.

(iii) Cybersecurity

Since AVs are connected to the infrastructure and services, and are becoming more and more like IT machines, their vulnerability to possible cyber attacks and the need for cybersecurity increases accordingly. There continues to be concern that hackers might intentionally cause accidents or perpetrate theft of AVs. While recognition systems (e.g. fingerprint or smartwatch) or monitoring by geolocation services may decrease the risk of the vehicle being stolen,²⁶ a risk remains that the security might be bypassed even if the technology and software is constantly updated and further developed. In order to mitigate the risks for safety, security and data privacy insurers may, for example, insist that different biometrics modalities²⁷ multi-factor authentication identifying an authorized driver might be installed in the car for accessing the car and starting the engine. Insurers of cyber risks will also consider which technology is used to reduce the risk of cyber attacks on databases store biometric data and how potential consequences are mitigated. With regard to fingerprints there is, for example, already technology available which ensures that even if the database is hacked only algorithms are available and not pictures of the fingerprint, to ensure that hacked data cannot be used for identification purposes.²⁸

D. Patent landscape – analysis for Germany and Europe

(i) Development of the autonomous driving patent landscape in Germany

Over the last years, the numbers of patent applications and granted patents in the autonomous driving sector have significantly increased in Germany. According to an analysis conducted in February 2018 by the German Patent and Trademark Office (DPMA), the number of patent applications in Germany regarding autonomous driving increased from around 1,000 applications in the year 2008 to far more than 2,500 applications in the year 2017.²⁹ This development of the total patent application numbers in the field of autonomous driving per year is demonstrated in the following chart.

Patent applications for Germany

Notably, the patent applications regarding autonomous driving started to rise substantially and steadily from the year 2012 onwards. The patent applications for Germany which are included in these figures are national patent applications and PCT applications in the national phase. The analysis conducted by the DPMA was based on a selection of several relevant IPC classes. The IPC is an international system which subdivides the whole sector of technology into classes ordered in a hierarchical structure, so that all patent documents worldwide can be assigned to certain fields of technology. For the mentioned analysis, the DPMA identified the IPC classes which are related to autonomous driving. This group includes IPC classes as to autonomous driving course control, assistance systems for drive control, traffic control, vehicle electronics in general, navigation, sensor technology and environment sensor systems. Unfortunately, none of the IPC classes deals exclusively with autonomous driving. The problem therefore is that a clear distinction from other technical areas is not possible. There is no generally valid definition which would allow the integral and conclusive assignment of patent documents to the field of AVs. Thus, an analysis based on IPC classes is rather a more or less accurate approximation to the current status of patents regarding autonomous driving. The same is true for the even more specific field of biometrics technology in the field of autonomous driving (see further below). Notwithstanding, a clear upwards trend is visible for patent applications in the IPC classes relevant to autonomous driving according to the DPMA figures.

The DPMA also assessed the nationality of the patent holders, in order to identify the origin of the increasing numbers of patent applications. The DPMA analyzed the patents that are valid and in effect in Germany until the end of the year 2017, including German national patents granted by the DPMA and European patents granted by the European Patent Office (EPO). The top patent holders with most patents granted with effect in Germany in 2017 are national but also international companies. The top three are Audi AG, Toyota Jidosha K.K. and Volkswagen AG. Notably, the largest amount of patents is owned by German entities, i.e. 42% share of all patents considered. The second largest group of patent holders is from

Japan, with a large 28% share. Followed by US patent holders with only 11% of shares, as well as patent holders from France, the Republic of Korea and further states. The following chart and the respective table represent the situation in 2017:

Patents valid in Germany at the end of 2017

Patents valid in Germany at the end of 2017[1]

[2]country of the first patent holder at the end of 2017

Among the German patent holders, the following companies were identified to be the top holders of autonomous driving patents:

Top patent holders from Germany[1]

The German car manufacturers Audi AG and Volkswagen AG are ranking among the top three patent holders. However, in the German market they are dominated by Robert Bosch GmbH with more than double the number of patents of VW AG. Among the top patent holders also listed are the German car manufacturers BMW AG and Daimler AG, but with significantly fewer patents.

(ii) Biometrics patents for automobile and autonomous driving in Germany and Europe

The advantages of the use of biometric modalities in automobiles are recognized more and more by the automobile manufactures and OEMs. Starting from the demand for better protection against car thefts, along with measuring the body dimensions of the driver³⁰ for adapting and optimizing the configuration of the driver cabin, up to monitoring the attention of the driver,³¹ a huge amount of different fields of use of biometric systems in automobiles is available and conceivable.

The IPC class system has, as a matter of principle, no specific classes for biometrics, neither with regard to their particular use in automobiles nor in AVs. As explained above, the consequence is that an analysis on the basis of IPC classes does not guarantee a full and exhaustive picture of the patent activity, but it nevertheless allows to identification of certain overall industry trends. For this purpose, we conducted an analysis of the European patent applications for three exemplary IPC classes which have a relation to biometrics in automobiles and AVs, and noticed a clear upwards trend in the time period from 2008 to 2018.

Notably, one exception to the general rule is the specific IPC class concerning “fittings or systems for preventing or indicating use or theft of vehicles by using biometry” (IPC class B60R 25/25). This IPC class has a very particular scope regarding locking systems for vehicles by using biometry. Therefore the number of European patents applied for is quite low. Since 2008 only around 40 European patent applications were published or European patents granted. It is noteworthy that the patent applicants for this kind of patents are mainly automobile manufacturers and automobile equipment suppliers. Among the applicants, for example are German and international automobile manufacturers Volkswagen AG, Audi AG, Toyota Co Ltd., Jaguar Land Rover Ltd and Ford Motor Company Group. Furthermore, automobile supplier Robert Bosch GmbH, as well as international suppliers, like the French Valeo Group, have filed such patent applications.

Beyond this specific IPC class, all technical inventions using biometrics, even though they are not specifically claimed for application in automobiles, are usually also fit for use in AVs. For example, if the patent protects an invention relating to a heartbeat scan, the respective invention may not only be used within a sports watch, but also for stopping an automobile in case of a detected heart attack of the driver. Therefore, the analysis of biometrics usable in automobiles or AVs must be extended to a further patent class regarding “security arrangements for protecting computers, or components thereof, (…) against unauthorized activity by using biometric data, e.g. fingerprints, iris scans or voiceprints” (IPC class G06F 21/32).

What is striking when reviewing the list of applicants for this category of patents is that these essentially include companies from the electronics industry. Overall, the number of published European patent applications and the granted patents in the time period from 2008 to 2018 amount to nearly 1000 documents. Significantly, the top three applicants are Samsung Electronics Co. Ltd., Fujitsu Ltd. and Intel Corp. Surprisingly, the automobile manufacturers are totally absent from the list of applicants for this patent class.

In general, the patenting activity shows an increasing focus on biometric systems for automobiles and AVs in the past years, as can be seen from the following chart depicting the numbers of the granted European patents and European patent applications for the IPC classes G06F 21/32 and B60R 25/25:

Granted EP and published EP applications

Obviously, the numbers of European patent applications and grants for this field of growing interest has increased dramatically since 2013.

The same trend can be observed with similar patent categories. For example the IPC class covering “methods or arrangements for reading or recognizing printed or written characters or for recognizing patterns, e.g. fingerprints” (IPC class G06K 9/00) may also be relevant for biometrics in automobiles. An exemplary patent application for the IPC class G06K 9/00 is a method for identifying an individual by recognizing the eye position of the respective individual by a camera, which is protected by a European patent application (EP 3 158 499) filed by Robert Bosch GmbH. The number of granted European patents and published patent applications in the IPC class G06K 9/00 has significantly increased over the last ten years. Starting from year 2008 with nearly 400 patents and patent applications, the number per year has steadily increased to reach triple that amount with over 1200 patents and patent applications in 2018. The ranking of granted patents and published patent applications over the last 10 years in this category is again predominantly led by international electronics companies like Samsung Electronics Co. Ltd., Fujitsu Ltd. and Sony Corp., as well as software and telecommunication companies such as Microsoft or Qualcomm Inc. Nevertheless, automobile manufactures and automobile suppliers are active in this field and still hold a certain number of granted patents and published patent applications. Among the top applicants are, for example, Honda Motor Co. Ltd, Toyota Motor Co. Ltd., Saab AB and Nissan Motor. The German company Audi AG has been granted and filed 34 patents in the last 10 years. Bosch GmbH, as the world’s largest automobile supplier, holds 105 patents and patent applications for the IPC class G06K 9/00 in the analyzed time period between 2008 and 2018.

With the growing importance of the technologies of biometrics in automobiles and autonomous driving, various established companies from different backgrounds, in both automobile and non-automobile sectors, as well as specialized startups are getting more and more active and emerging in the market.

Yet, when comparing the patenting strategy of several leading companies established in the US, it seems that their focus lies in the US market rather than in Europe. Comparing the overall patent numbers, it appears that some of the leading US entities are not proactively applying for patents in the member states of Europe. For example, specialized startup companies like Veniam Inc., Digimarc, Intelligent Technologies International Inc., Z Advanced Computing Inc., Nio USA Inc. and SmartDrive Inc., with a particular focus on essential AVs technology, do not yet seem to seek to cover the European market. The respective companies have roughly 440 issued patents and pending patent applications in the US, whereas in the EU the total number solely amounts to 70.

Taking a closer look at Veniam Inc. as the leading company in the specific field of biometrics in AVs, the divergent numbers are striking. Veniam Inc. filed 16 US patent applications and currently owns 67 US patents in the respective field. However, in the European Union, Veniam Inc.’s only activity over the last 10 years was the filing of 10 patent applications at the European Patent Office in the year 2018. Digimarc, as one of the most active of the abovementioned companies, applied for nearly 40 patents in the European Union, but the gap to the US with around 190 patent applications is still significant.

Furthermore, start-up companies like Intelligent Technologies International Inc., Z Advanced Computing Inc. and Nio USA Inc. did not appear to have any noticeable activity on the European patent landscape over the past years, unlike in the US In view of these findings, one may wonder about the reasons for these discrepancies and whether the strategies followed by these companies specialized in AV technology are not focusing on the importance of the European market.

The same is true for non-practicing entity Liberty Peak Ventures LLC and American Vehicular Sciences LLC which have not yet established a patent portfolio for the European market.

Considering that the market for biometrics technology in autonomous driving systems is determined by the presence of various players from extremely different backgrounds - ranging from automobile manufacturers, their suppliers and specialized startups to worldwide operating electronics, telecommunication and software companies - a change of the automobile industry as it existed is inevitable. Thus, it is likely that the risks of future patent enforcement and patent litigation regarding biometrics systems in AVs will be increasing for the automobile manufacturers.