Public transport closed-circuit television (CCTV) is a system of cameras, recorders, networks, and viewing tools used to capture video in buses, trains, stations, platforms, depots, stops, and related transit property. Transit agencies use CCTV to investigate safety incidents, support operations, deter vandalism, document accidents, and respond to security events.
Footage may show identifiable passengers, employees, drivers, pedestrians, vehicle license plates, and bystanders. It can therefore be personal information or personally identifiable information (PII), depending on the applicable law and the context of use. The National Institute of Standards and Technology (NIST) defines PII as information that can distinguish or trace an individual’s identity, alone or when combined with other information.
Why public transport CCTV requires video redaction
Transit footage is often requested by police, insurers, lawyers, journalists, public-records requesters, or individuals involved in an incident. A copy that is relevant to the request may also contain unrelated people. Redaction reduces disclosure of those unrelated individuals while preserving the evidentiary part of the recording.
For video, redaction normally means applying an irreversible visual mask to selected frames. The usual targets are faces and license plates. A redacted export should be treated as a separate derivative file. The original recording should remain protected and available only to authorized personnel under the agency’s retention and evidence procedures.
- Face blurring: masks identifiable faces of passengers, operators, witnesses, and bystanders.
- License plate blurring: masks plates visible through vehicle windows, at stops, in parking areas, or in roadway footage.
- Manual redaction: may be needed for documents, monitor content, tattoos, name badges, or company logos. These items are not automatically detected by face and license plate detection systems.
- Audio review: may be required separately because visual redaction does not remove spoken names, addresses, or other personal information.
Retention and preservation of transit camera footage
There is no general United States federal rule that requires every public transport agency to retain CCTV footage for a fixed number of days. Retention periods usually result from state records laws, local records schedules, transit-agency policy, security requirements, insurance needs, collective bargaining obligations, and litigation preservation duties.
A routine deletion schedule must stop when the agency reasonably anticipates litigation, receives a preservation request, or identifies footage as evidence of an accident, crime, complaint, or other reportable event. In federal litigation, potentially relevant electronically stored information may be subject to preservation duties under Federal Rule of Civil Procedure 37(e).
Retention stage | Operational purpose | Privacy and security control
|
|---|---|---|
Routine recording | Supports ordinary safety and operational review. | Use role-based access, encrypted storage where appropriate, and scheduled deletion under an approved records schedule. |
Incident preservation | Preserves footage connected with a crash, complaint, assault, or claim. | Record the reason for preservation, custody, source camera, time range, and access history. |
External disclosure | Supplies relevant footage to an authorized requester. | Create and quality-check a redacted copy unless disclosure law, a court order, or another valid authority requires unredacted footage. |
Key technical controls for public transport CCTV redaction
Reliable redaction requires more than detecting a face in one frame. A person may turn away, become partially obscured, appear in reflections, or move between camera fields. The system must maintain a mask across the relevant sequence and allow an operator to correct missed or incorrectly masked objects.
Useful quality measures include the following:
- Detection recall: the proportion of faces or license plates that the system identifies. Lower recall creates a higher risk of unredacted disclosure.
- Precision: the proportion of detected objects that are actual faces or license plates. Low precision creates unnecessary masking and can reduce evidentiary value.
- Frame coverage: the percentage of frames in which a target remains masked during its visible appearance.
- Redaction review rate: the percentage of exported footage reviewed by a trained person before release.
- Chain-of-custody completeness: whether the agency can link an export to the original file, source camera, operator, processing date, and release authorization.
For a redacted export, a practical control is to review every scene transition, camera change, fast movement, reflection, and occlusion. Visual review is important because a face detection model can miss profiles, small faces, low-light images, or blurred footage.
Legal context in the United States
Public transport CCTV is governed primarily by state and local law rather than a single nationwide CCTV statute. A public transit agency may be subject to its state public-records law, state constitutional privacy protections, records-retention requirements, and rules governing disclosure to law enforcement. A private transit operator may also be subject to contractual requirements imposed by the public authority.
For federal agencies, the Privacy Act of 1974, 5 U.S.C. § 552a, regulates records maintained in a system of records. Federal Freedom of Information Act exemptions include protections for personal privacy in personnel, medical, and similar files and in certain law-enforcement records, under 5 U.S.C. § 552(b)(6) and § 552(b)(7)(C). These federal provisions do not automatically govern a municipal or state transit authority.
State rules differ. For example, the California Public Records Act permits withholding of certain personnel, medical, and similar files when disclosure would constitute an unwarranted invasion of personal privacy, under California Government Code § 7927.700. Illinois’ Biometric Information Privacy Act, 740 Illinois Compiled Statutes 14, generally applies to private entities and excludes state and local government agencies from its definition of a private entity. A private contractor operating transit services may therefore require a separate legal analysis.
Operational use of face and license plate blurring
Before releasing footage, the agency should define the requested time range, camera views, and incident-specific relevance. It should then preserve the original, create a working copy, redact unrelated faces and license plates, and document the review and approval decision.
Gallio PRO can support this workflow through automated face detection and license plate detection in recorded images and video. It does not perform real-time anonymization or video stream anonymization. Automatic processing covers faces and license plates only. Other visual information can be redacted manually with the built-in editor.
Standards and references
NIST Special Publication 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) (2010), provides a federal framework for identifying and protecting PII. NIST’s Artificial Intelligence Risk Management Framework 1.0 (2023) supports documentation, testing, and monitoring of artificial intelligence systems used in detection workflows. ISO/IEC 27001:2022 specifies requirements for an information security management system, including controls relevant to access management, retention, and secure handling of CCTV exports.