What Is Machine Learning (ML)?

Machine Learning - Definition

Machine Learning (ML) is a set of methods that enable computer systems to learn patterns from data and make decisions without explicitly programmed rules. The international standard ISO/IEC 22989:2022 defines ML as an approach within artificial intelligence in which models improve performance on a given task through experience embedded in data (source: ISO/IEC 22989:2022). The NIST AI Risk Management Framework (AI RMF 1.0) highlights the lifecycle of AI systems, including ML components, covering data preparation, training, validation, deployment, and monitoring (source: NIST AI RMF 1.0, 2023).

In the context of image and video anonymization, machine learning is used for the automatic detection of objects that require masking. Most commonly, these include human faces and vehicle license plates. A model trained on labeled data identifies objects in image frames and returns their location along with a confidence score. The detection output is then used to generate blur or pixelation masks that reduce the risk of identifying individuals or vehicles in compliance with the GDPR and guidance from supervisory authorities (sources: EDPB 3/2019, WP29 05/2014, ISO/IEC 20889:2018).

The Role of Machine Learning in Image and Video Anonymization

Effective image anonymization requires reliable localization of sensitive elements. Rule-based heuristics are insufficient under variable lighting conditions, mobile camera footage, or partial occlusions. Machine learning - particularly deep learning - offers robustness to such variations by training on large reference datasets. To automate face blurring and license plate blurring, a detection model with appropriate sensitivity and precision must first be developed and then integrated into the media processing workflow.

A typical processing pipeline includes video decoding, object detection, optional frame-to-frame tracking, mask generation, and export. Gallio PRO automates detection and blurring exclusively for faces and license plates. The software does not automatically detect logos, tattoos, name badges, or screen content - these elements can be manually blurred in the editor. The tool operates in batch mode rather than real time. An on-premise deployment model enables processing within the organization’s infrastructure and limits data transfers. Gallio PRO does not collect detection logs containing personal or sensitive data.

ML Technologies and Architectures for Face and License Plate Detection

Object detection in images primarily relies on deep neural networks. In practice, architecture selection depends on the trade-off between accuracy and speed, as well as available computing resources (CPU, GPU). Models are trained in a supervised manner using datasets annotated with bounding boxes or segmentation masks.

• Convolutional detection networks - including Faster R-CNN, RetinaNet, YOLOv3, and newer YOLO families (e.g., YOLOv5-YOLOv8) - are efficient for face detection and license plate recognition tasks, commonly used where low latency is required (sources: Ren 2015; Lin 2017; Redmon 2018).
• Vision Transformers - such as DETR and its variants - simplify prediction matching at the cost of higher computational requirements; suitable for complex scenes (source: Carion 2020).
• Segmentation networks - used when irregular masks are required; for face and license plate blurring, rectangular bounding boxes are usually sufficient.
• Object tracking - stabilizes masks between frames and reduces flickering; typically applied as post-processing.
• Data preparation - datasets such as WIDER FACE and license plate benchmarks provide evaluation metrics and IoU standards (source: Yang 2016; benchmark practices).

Key Parameters and Metrics in ML-Based Anonymization

Model evaluation directly affects identity disclosure risk and operational costs. Below is a summary of core metrics used in object detection and inference. Definitions are based on standard literature and benchmark methodologies.

In practice, high recall is often more critical than precision in anonymization scenarios - missed detections pose a greater risk than excessive blurring. The chosen confidence threshold should be documented and justified in a risk assessment in line with ISO/IEC 23894:2023 and NIST AI RMF 1.0.

Challenges and Limitations

Models may exhibit lower recall in cases of occlusion, unusual camera angles, or low resolution. Balancing recall and precision requires careful threshold selection and potentially object tracking. Training data with geographic or hardware bias can reduce generalization performance - regular data reviews and cross-validation are essential. The absence of real-time processing requires batch scheduling and monitoring of GPU and I/O loads.

Legal considerations are context-dependent. In practice, the requirement to blur license plates depends on the purpose and legal basis of processing and whether, under specific circumstances, a plate enables identification of a person. There is no uniform EU-wide obligation mandating license plate anonymization in all use cases. In Poland, license plates may be considered personal data depending on context, and guidance from data protection authorities and CJEU case law supports a precautionary approach where identification risk exists.

Similarly, face anonymization is not automatically required under the GDPR in every situation; it depends on the legal basis and compliance with processing principles. Additionally, the publication of an image may be subject to civil law and copyright regulations. As a rule, copyright law requires consent for the dissemination of a person’s likeness, with typical exceptions: public figures performing public functions, individuals constituting only a minor detail of a larger scene (e.g., a crowd, landscape, public event), or situations where the individual received agreed compensation for posing. From a privacy perspective, minimizing detection logs and implementing on-premise deployments support privacy-by-design principles.

Use Cases of Machine Learning in Anonymization

Machine learning supports anonymization in CCTV footage, dashcam recordings, and mobile camera video when responding to GDPR data access requests, sharing evidence in legal proceedings, publishing public event materials, or archiving training resources. In each case, auditable performance metrics, detection threshold control, and manual editing capabilities are critical. In high-security environments, on-premise processing significantly reduces the risk surface.

Normative References and Sources

• ISO/IEC 22989:2022 - Artificial Intelligence - Concepts and terminology.
• ISO/IEC 23894:2023 - Artificial Intelligence - Risk management.
• ISO/IEC 20889:2018 - Privacy enhancing data de-identification - Terminology and classification of techniques.
• NIST AI Risk Management Framework 1.0, 2023.
• Regulation (EU) 2016/679 (GDPR) - Article 4 and recitals on personal data.
• European Data Protection Board, Guidelines 3/2019 on processing of personal data through video devices, Version 2.0, 2020.
• Article 29 Working Party, Opinion 05/2014 on Anonymisation Techniques, 2014.
• Lin et al., Microsoft COCO: Common Objects in Context, ECCV 2014 - AP and IoU definitions in detection.
• Yang et al., WIDER FACE: A Face Detection Benchmark, CVPR 2016 - face detection evaluation protocols.
• MLCommons, MLPerf Inference v3.0 Results and Rules - latency and throughput definitions, 2023.
• Ren et al., Faster R-CNN, NIPS 2015; Redmon et al., YOLOv3, 2018; Carion et al., DETR, ECCV 2020.