What Is Privacy-Preserving Surveillance?

Privacy-Preserving Surveillance - Definition
The Role of Privacy-Preserving Surveillance in Photo and Video Anonymization
Technologies Used in Privacy-Preserving Surveillance
Key Parameters and Metrics in Privacy-Preserving Surveillance
Challenges and Limitations of Privacy-Preserving Surveillance
Normative References and Compliance Practice
See Also

Privacy-Preserving Surveillance - Definition

Privacy-preserving surveillance refers to the design and operation of video surveillance in a way that limits interference with privacy to the minimum necessary to achieve a specific purpose. In practice, this means selecting the CCTV system architecture, retention rules, access permissions, and image-processing methods so that the identification of individuals is restricted from the system design stage onward. For photos and video recordings, the primary technical safeguard is image anonymization or pseudonymization, most commonly through the automatic blurring or masking of faces and license plates.

This concept stems from the general principles of data protection rather than from a single standalone statutory definition. The key provisions are Article 5(1)(c) GDPR - data minimization, Article 25 GDPR - data protection by design and by default, and Article 32 GDPR - security of processing. In the context of video surveillance, this means the controller should be able to demonstrate that the scope of the recorded image, the recording quality, the retention period, and the disclosure method are proportionate to the purpose. If that purpose can be achieved using anonymized footage, then fully identifiable footage should not be widely disclosed.

In smart city and CCTV systems, privacy-preserving surveillance is often understood as the operational implementation of the privacy by design principle. In its Guidelines 3/2019 on the processing of personal data through video devices, the European Data Protection Board states that technical measures limiting identification, such as area masking or reducing the field of view, should be considered as early as the system selection stage. The European Data Protection Supervisor, in its work on video surveillance, and the EN 62676 series of standards for video surveillance systems both emphasize the link between a system's purpose and the technical parameters of the image.

The Role of Privacy-Preserving Surveillance in Photo and Video Anonymization

When it comes to visual materials, privacy-preserving surveillance does not mean giving up surveillance altogether. It means changing how surveillance is used. The key point is to separate the security function from the identification function. Not every system user needs access to the full, non-anonymized image. In many processes, footage with faces and license plates concealed is entirely sufficient.

This approach is particularly relevant when publishing recordings, sharing them with third parties, handling requests, conducting training, carrying out audits, and analyzing incidents. In this model, the source material remains under the controller's control, while the working or exported version is stripped of direct visual identifiers.

faces are treated as personal data if they allow the identification of a natural person
license plates are treated in many legal frameworks and supervisory practices as personal data or as information enabling indirect identification
anonymization of audiovisual material should be irreversible in the copy being disclosed if the goal is to eliminate the possibility of identification
if the process is reversible or there is a key that allows a person to be re-linked to the recording, this is generally pseudonymization rather than anonymization

In Poland, the status of license plates remains disputed. From a compliance perspective, two positions should be noted. On the one hand, data protection authority guidance and broader European practice tend to favor protecting them. On the other hand, some administrative court rulings take the view that a license plate does not always constitute personal data in itself. Under a risk-averse approach to CCTV and the publication of video materials, blurring license plates is generally treated as a measure that reduces regulatory risk.

Technologies Used in Privacy-Preserving Surveillance

In modern implementations, image anonymization relies primarily on object detection and object tracking across consecutive frames. Machine learning models, most often based on deep learning, are used to detect faces and license plates. This is an important distinction: blurring itself is not an intelligent technology, but rather the end result. The AI component is the model that first locates the face or license plate in the image, after which the masking algorithm is applied.

An AI model requires prior training on properly prepared datasets. The quality of later masking depends on annotation quality, the diversity of the training data, lighting conditions, camera angle, resolution, and inference parameters. In systems that process footage after recording, manual correction mechanisms are also important, because even high detection accuracy does not eliminate errors entirely.

Layer

Function

Privacy Significance

Object detection

Detecting faces and license plates

A prerequisite for applying masking correctly

Tracking

Following an object across frames

Reduces the risk of missed detections in motion

Masking

Blur, pixelation, fill, blackout

Hides visual identifiers

Manual validation

Manual correction of detections

Reduces the risk of false negatives

Access control

Permissions for the source and anonymized versions

Limits unauthorized data disclosure

Precision matters in this area. Gallio PRO automatically blurs only faces and license plates. It does not automatically detect logos, tattoos, name badges, documents, or images displayed on monitor screens. Such elements can be concealed manually using the built-in editor. The software operates in an on-premises model and does not perform real-time anonymization or video stream anonymization.

Key Parameters and Metrics in Privacy-Preserving Surveillance

For the Data Protection Officer and technical teams, it is important to be able to assess the effectiveness of privacy protection based on measurable parameters. A simple declaration that AI is being used does not, in itself, determine whether the process is compliant.

detection recall - the percentage of faces or license plates detected by the model; in anonymization, this is usually more important than precision alone, because missing an object creates a risk of data disclosure
detection precision - the percentage of correct detections among all detections; this affects the number of unnecessary masks
false negative rate - the share of undetected objects; this is one of the key risk indicators
file processing latency - the time needed to analyze and render the material, usually measured for a specified recording length or as processing throughput
frame-to-frame coverage - continuity of masking across frames
retention of source and anonymized footage - the number of days or months for which the material is stored

In practice, a simple anonymization coverage metric can be used:

Coverage = number of correctly masked objects / total number of objects requiring masking

For compliance processes, documenting the test method is critical: sample size, scene type, image quality, and acceptance criteria. Without this, comparing results across systems is unreliable.

Challenges and Limitations of Privacy-Preserving Surveillance

The privacy protection model in video surveillance has both technical and legal limitations. First, detection effectiveness depends on footage quality. Low resolution, heavy compression, obscured faces, camera movement, glass reflections, and nighttime lighting all reduce model accuracy. Second, the line between anonymization and pseudonymization depends on whether re-identification is possible using additional information.

Not every use of video surveillance requires the same level of image detail. EN 62676-4:2015 describes how to select image parameters according to the purpose of observation, recognition, and identification. From a privacy by design perspective, this has practical importance: if the goal is general area monitoring, using parameters suitable for identification may be disproportionate.

Normative References and Compliance Practice

The assessment of privacy-preserving surveillance systems is based on legal acts and guidelines that should be read together. They do not create a single, closed technical specification, but they do establish the compliance standard.

GDPR - Regulation (EU) 2016/679, in particular Articles 5, 25, and 32
EDPB, Guidelines 3/2019 on processing personal data through video devices, version adopted after consultation in 2020
EN 62676 - the series of standards for video surveillance systems, including Part 4:2015 on applications
ISO/IEC 27001:2022 - information security management system, useful for organizing access control and retention

In compliance practice, this means carrying out a proportionality test, determining the legal basis, documenting the retention period, separating access to the source and anonymized copies, and ensuring that system logs do not themselves become a source of new personal data. In this context, it is important that Gallio PRO does not collect logs containing face or license plate detection data, or any other logs containing personal data or special categories of data.