Unlock the Benefits of Computer Vision without Breaching GDPR: A Guide to Protecting Personal Data

People – including your workforce - expect their personal data to be protected in their domestic lives and at work. Although it originates in the EU, the General Data Protection Regulation (GDPR) affects organisations across the world which trade with, or hold data for EU countries. Following BREXIT, the UK has incorporated the EU GDPR principles into the UK GDPR, which has been accepted by the EU as “essentially equivalent”. Earlier data protection laws applied largely to computer records of textual information such as bank accounts and staff records. GDPR uses a broader definition of “data” as “any information relating to an identifiable living individual”. This includes still and moving images of people, such as the use of CCTV cameras, and any imagery captured from the CCTV by AI-assisted computer vision (CV) if individuals can be identified. This doesn’t mean you can’t get the benefits of CV without breaching GDPR. Here is how to apply the six data protection principles from GDPR to the use of CV.

Lawful, fair and transparent

Make it clear to people where the CCTV cameras are located, for example displaying signs. In the workplace you should back this up with briefings (for example, during induction) about who can see the live stream and any recordings made, and how these will be used. When you introduce CV to an existing CCTV system you need to tell people when still images or film clips might be captured, who will see these and how they can be used. The most transparent approach would be to show staff examples of the type of information collected. Remind people of their rights. If they are identifiable in any recorded video, under EU and UK law they have a right to see that video.

‍

Specified, explicit and legitimate purposes 

If you have existing CCTV cameras, you should already have a description of the legal basis for their use, balancing the legitimate interests of the organisation with the privacy rights of individuals. Adding CV changes the purpose of the cameras, and might impact the legal basis. Your aim might be to identify safety concerns with the working environment (such as lighting or layout). Or you might be looking for examples of behaviour to identify training or coaching needs. If later, you decide to use the technology to compare how long different individuals spend on a task, or as evidence in a disciplinary case, you will be breaching this principle - and the trust of your workforce.

Communicate new functions for CCTV to workers. Be clear that in the event of an accident you might have to identify people within the video, particularly where a regulator is involved in an investigation.

Data minimisation

Information collected should be limited to what is necessary for the task. If the aim is to see how many people are too close to vehicles at a location within a shift, you don’t need the individuals to be identifiable. CV systems that blur the faces of people within the video clips will help you to meet this principle. Recording the audio of personal conversations also breaches this principle. Limiting who can view or edit information is another aspect of this principle, so look for systems that allow you to manage access levels for different staff.

Storage limitation

While the faces are clear (as they might be in the original CCTV stream), people can be identified. Where the CV identifies which clips need to be kept, and blurs the faces before the retained clips are viewed by any people (such as the safety team or operations manager) this principle of storage limitation is met. There should be a written retention policy for any images stored. Your organisation needs to be able to justify how long the video is kept. For example, a month is probably long enough for a crime to be detected. If there is an accident in the workplace, relevant CCTV can be kept for longer if it might be needed for an investigation.

Accurate

Social media images show us that it’s untrue that “the camera never lies” but any CCTV images kept must be accurate. Time stamps and locations must be retained, and it should be obvious if any annotations have been made to the images. If people are identifiable in images, they have the right to challenge any labels assigned to those images. For example, don’t label a clip “worker being careless.” 

Integrity and confidentiality

Unless the circumstances are exceptional (such as a criminal investigation) CCTV cameras should not be located in areas such as changing rooms or toilets. Make sure there is a clear organisational policy about who can see original video, and who can see anonymised clips. The policy needs to be clear under what circumstances images can be passed to third parties (for example, the police or health and safety inspectors). Domestic CCTV systems connected to the Internet have given CCTV a bad reputation for breaches, but workplace CCTV and any recordings made must be protected by technical means from unauthorised access. Make sure that any technology you use provides the functionality you need to meet GDRP principles, and you can get the best out of CV while maintaining people’s rights.

‍

Want to stay ahead of the curve in data protection and revolutionize EHS management with Protex AI's GDPR compliant CV software? Schedule a call with one of our product experts today!