In today's digital world, data protection is critical, particularly when using computer vision (CV) technology. This article will detail how to apply the six data protection principles of the General Data Protection Regulation (GDPR) to CV use, including transparency, specified purposes, data minimization, storage limitation, accuracy, and integrity and confidentiality.
People expect their personal data to be safeguarded in both their personal and professional lives, and the GDPR's principles, originally established in the EU, affect organizations worldwide that trade with or hold data for EU countries. The UK GDPR, which incorporates the EU GDPR principles, has been accepted by the EU as "essentially equivalent" since Brexit. Unlike previous data protection laws that focused primarily on textual information such as bank accounts and staff records, GDPR defines data as "any information relating to an identifiable living individual," including images of people captured through CCTV and AI-assisted CV technology.
Notify individuals of the location of CCTV cameras and ensure transparency by displaying signs. In the workplace, back up these signs with briefings and inform workers when still images or film clips might be captured, who will see these, and how they can be used. The most transparent approach would be to show staff examples of the type of information collected, reminding them of their rights. Under EU and UK law, if individuals are identifiable in any recorded video, they have the right to see that video.
Ensure that the legal basis for the use of existing CCTV cameras, balancing the legitimate interests of the organization with the privacy rights of individuals, is documented. Adding CV technology changes the purpose of the cameras and might impact the legal basis. Communicate new functions for CCTV to workers and clarify that in the event of an accident, individuals might have to be identified within the video.
Limit information collection to what is necessary for the task, blurring faces of people within video clips to avoid identification when unnecessary. Recording the audio of personal conversations breaches this principle. Look for systems that limit access levels for different staff to meet this principle.
Identify which clips need to be retained, and blur faces before the safety team or operations manager views them to meet this principle. A written retention policy for any images stored should be in place, and the organization must justify how long the video is kept.
Any CCTV images kept must be accurate, retaining timestamps and locations, and it should be evident if any annotations have been made. Individuals identifiable in images have the right to challenge any labels assigned to them.
Avoid placing CCTV cameras in areas such as changing rooms or toilets unless circumstances are exceptional, such as during a criminal investigation. The organizational policy must clearly state who can see original video and who can see anonymized clips. The policy also needs to specify under what circumstances images can be passed to third parties. Ensure that any technology used provides the functionality needed to meet GDPR principles and protects workplace CCTV and recordings made from unauthorized access.
By following these guidelines, organizations can ensure that they can benefit from CV technology while maintaining people's rights and meeting GDPR's six data protection principles.
Automated supervision, monitoring and risk prediction in areas of safety, quality and productivity.
