Data Protection in the Age of Visual Monitoring in Transportation

I. Introduction

In the past few years, the transportation industry has witnessed a significant proliferation of visual monitoring technologies, such as monitoring cameras, specifically Closed-Circuit Television (CCTV) cameras and surveillance cameras. While monitoring offer enhanced security, it can also seriously interfere with the privacy of individuals. The approach to monitoring varies in many countries and regions, certainly in places where fundamental rights and freedoms of individuals are respected CCTV and cameras usage is surrounded by many restrictions.

This article explores the challenges and data protection implications in the era of visual surveillance in transportation, with a focus on General Data Protection Regulation (GDPR) compliance and the rights of data subjects (identified or identifiable natural persons). You can read more about Ensuring Privacy in Video Monitoring CCTV on our website in our other article.

II. The Proliferation of Visual Monitoring Technologies in Transportation Companies

Surveillance technologies are on the rise within transportation companies, playing a vital role in guaranteeing passenger safety, deterring criminal activities, and overseeing operational efficiency. CCTV cameras and surveillance systems are key players in these technologies, offering not only video capture but also real-time monitoring and recording.

Most commonly, CCTV and video monitoring are used to:

• Protect the health and safety of employees, customers and members of the public
• Protect property and other infrastructure
• Manage and investigate major incidents
• Prevent and detect crime and antisocial behaviour – also including fee evasion
• Monitor traffic
• Enforce traffic rules and regulations
• Support the effective management and operation of road and rail networks
• Exercise or defence of legal claims

Many cities and transport companies have extensive traffic-monitoring systems, using CCTV to detect traffic jams and spot accidents. CCTV cameras may also allow the driver to confirm that people are clear of doors before closing them and starting the vehicle. After the September 11 attacks, the use of video surveillance in public transportation became more common to deter future terrorist attacks. In 2017 London Underground had 13,596 station surveillance cameras. Another 2,795 cameras were deployed at stations for one person operation that covered the platform edge and provided a view of the train and platform to allow drivers to confirm the position of customers along the length of the train. There were also 7,500 cameras across the fleet of trains and 649 non station cameras. The images of millions of people are being recorded and processed every day, therefore general adoption of CCTV cameras requires a careful balancing of security and privacy concerns.

III. GDPR Compliance in Visual Monitoring: Balancing Security and Privacy

As transportation companies implement visual monitoring to strengthen security, it becomes necessary to navigate the complex landscape of data protection regulations, with the GDPR (and UK GDPR which is a twin version of GDPR for the UK) at the front line. The GDPR sets forth stringent requirements for the processing and handling of personal data, including video recordings captured by visual monitoring systems. Companies must ensure that their visual monitoring practices align with the principles of lawfulness, fairness, and transparency outlined in the GDPR. Transportation companies must implement robust policies and practices that comply with the above principles. If CCTV and video monitoring is used, a process must be implemented to operate and manage the recordings - compliant with both GDPR and UK GDPR (as well as other data protection laws aimed to protect the rights of individuals).

You may wonder why - it's because any time a recording or photo of a person is captured by video monitoring (which can be used to identify that person - directly or indirectly), this is considered personal data. Therefore, if you process such data (personal data), i.e. store, record, use, disclose and more - you fall under the GDPR and must comply with its requirements.

In an era where technological advancements are reshaping the landscape of surveillance and monitoring, the General Data Protection Regulation (GDPR) stands as a crucial framework ensuring the protection of individuals' privacy rights. This is especially important in the area of visual monitoring, where, for security and privacy reasons, it is important to take into consideration some fundamental aspects:

• Individuals should be informed about the monitoring's existence and its purposes (that's why monitoring labels are often visible along with links where more detailed information can be found)
• Transparency regarding the purpose and method of video monitoring is crucial, ensuring that passengers and pedestrians are aware of how their data will be used and for what purposes
• Visual monitoring systems should implement data minimization practices, capturing only the necessary information for the intended purpose
• Recordings can be stored for a minimum (required) period and then safely deleted - storage limitation
• Ensuring that video recordings are protected from unauthorized access and potential breaches is integral to compliance with the GDPR

GDPR compliance in visual monitoring is not just a legal requirement but a commitment to respect individuals' privacy rights. Balancing security and privacy requires thoughtful integration of technological safeguards and ethical practices. Incorporating privacy into visual monitoring provides an opportunity to build trust among data subjects and improve the organization's reputation as responsible data controllers. Therefore, it is worth ensuring compliance with regulations and best practices related to monitoring in transportation.

IV. Ensuring Anonymity and Securing Recorded Footage: Face Blurring and Video Anonymization

To protect the privacy of individuals captured by visual monitoring systems, transportation companies should consider implementing measures such as face blurring and video anonymization. Face blurring involves obscuring or pixelating the faces of individuals in recorded footage, rendering them unidentifiable. Video anonymization techniques, on the other hand, involve removing or modifying personally identifiable information from recordings. These measures balance security needs with individual privacy rights.

Face Blurring

Effective facial blurring involves using advanced algorithms to detect and hide facial features in monitoring footage. The goal is to make individuals unrecognizable while enabling analysis of incidents and behaviours. The blurring process should be accurate and consistent, ensuring that all identifiable faces are obscured throughout the footage.

Video Anonymization

Video anonymization goes beyond facial blurring to cover a broader spectrum of techniques to protect an individual's privacy. Object tracking and blurring are integral components, allowing dynamic anonymization of various elements in a footage. This ensures that not only faces, but also other identifiable attributes, such as license plates or characteristic apparel, are obscured. The process involves mapping and tracking objects or people moving in the observation field. The algorithms then apply anonymization measures, such as pixelization or substitution, to hide these elements without compromising the overall integrity of the recorded data.

By anonymizing video recordings companies not only comply with GDPR (and UK GDPR) but also mitigate the risk of unauthorized access and misuse of personal data.

Using the right tools

The integration of advanced face blurring technologies and video anonymization algorithms is becoming crucial to reinforce people's trust while adhering to data protection principles.

Facial blurring and video anonymization are key elements in protecting the privacy of individuals in transport monitoring. While ensuring privacy may seem complicated, there are certainly ways to ensure compliance along with effective monitoring maintenance.

Transportation entities do not only have to implement these anonymization measures, but also maintain a transparent and responsible approach. Informing the public about the use of surveillance technology, the methods used for anonymization and the purposes of data collection is essential. Individuals have the right to know how their data is processed and should be assured that safeguards are in place to protect their privacy.

V. Responding to Incidents: Providing Video on Demand and Sharing Recordings while Maintaining GDPR Compliance

In the event of an incident or investigation, companies involved in or responsible for monitoring may be required to provide video footage to law enforcement agencies or other authorized parties, also natural persons. It is crucial to ensure that such sharing of recordings complies with GDPR requirements.

Access right

Companies should establish a process on how to respond to requests, ensuring that the sharing of recordings is limited to what is necessary and proportionate to the purpose. In the event of an incident, transportation entities must keep a delicate balance between maintaining public safety, complying with regulatory obligations and respecting individuals' privacy rights. When reacting to incidents, access to surveillance footage can be requested based on Article 15 of the GDPR - right of access by data subject. Transportation entities must be prepared to facilitate such requests quickly and transparently. Article 15 of the GDPR guarantees the right of access to the processed information to all concerned persons. It means that not only authorized offices, government bodies, and law enforcement agencies such as the police can request photos or recordings. Anyone who has been captured on photo or video can file for a copy of the material where they have been captured, subject to certain conditions - failure to comply with such obligations may result in severe fines (and an obligation to implement GDPR - compliant practices of course).

Article 15 grants individuals the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed as well as, the right to access that data/receive a copy if it is. In the context of transportation monitoring, this includes sharing recordings in which individuals may be identified. Access requests should be processed promptly (in one month), and the video provided should be redacted to exclude any information unrelated to the requester – this means that such a recording cannot violate the privacy rights of others. To achieve it may be necessary to use advanced anonymization techniques, such as face blurring and video anonymization - which are all essential to protect the identities of unrelated individuals.

Monitoring technology in transportation requires a proactive approach to GDPR compliance, with a special focus in incident response and providing video on demand.

Components of the data access process related to CCTV and video monitoring:

• Submission of requests: data subjects can submit access requests in writing/by email or through a designated online portal, providing sufficient details necessary for identification
• Verification: the transportation entity verifies the identity of the requester to prevent unauthorized access to personal data
• Processing: once verified, the request is processed promptly, and relevant video material is found and downloaded
• Editing: before disclosure, non-relevant information is edited to protect the privacy of non-affected individuals
• Disclosure: the processed video material, along with a summary of the editorial measures, is transmitted to the data subject in a secure manner
• Accountability: - the request is registered and noted (in order to be able to prove that such an event and disclosure took place)

It should be emphasized that if one decides to use video surveillance, then when creating and installing the system, one must simultaneously consider the appropriate process of sharing the recordings and compliance with the law.

VI. Conclusion:

As visual monitoring technologies continue to spread across the transportation industry, it is essential that companies prioritize data protection and privacy. By complying with GDPR, implementing measures such as facial blurring and video anonymization, and establishing solid process for sharing video recordings and footage transportation companies can achieve a balance between security and privacy concerns. The appropriate preparation of the recordings requires precise and specialized software enabling both face blurring and data anonymization.

Gallio provides you with a unique solution for privacy protection based on artificial intelligence. Algorithms blur faces making them virtually impossible to recognize while leaving image quality intact. Our professional tools meet the needs of transportation companies or those engaged in monitoring, allowing them to use an effective solution to ensure compliance with GDPR and best practices.

The free, demo version of Gallio.pro is available for download HERE.