Main points

The purpose of this sandbox project is to explore some of the most relevant regulatory challenges that arise in connection with the use of intelligent video analytics.

1. Legal basis for intelligent video analytics

   In the sandbox, we have explored legal issues associated with three different areas of application for Doorkeeper’s solution. These issues are transferable to other enterprises that are developing similar solutions. One key point is that intelligent video analytics, which are designed to make the processing of personal data less invasive, may affect the legality of the processing pursuant to data protection legislation.

2. Alternative solution designs

   Doorkeeper has two alternative designs for the use of intelligent video analytics. The analysis and censoring either takes place inside the camera body, or on an external platform. The choice of design impacts how personal data is processed in the solution. In this report, we discuss how this may have consequences for how invasive the monitoring is for the individuals recorded in the video feed.

3. Data minimisation

   This report demonstrates that it is possible to implement data minimisation measures in intelligent video analytics. Such measures may be implemented by configuring the solution to limit the amount of personal data collected and processed to what is necessary for the purpose. The presence of functions in monitoring systems that make processing of personal data less invasive will also require enterprises in the security industry to assess, to a greater extent, the types of personal data they need to be processing to achieve the purpose of the monitoring.

4. Disclosure of personal data

   Doorkeeper’s solution is designed to store less personal data that may be disclosed, compared to cameras that make continuous recordings. This could make it easier for enterprises like Doorkeeper to comply with requests for access, as the enterprise will store fewer recordings that may be relevant. The rules for disclosure of personal data, however, will be the same for Doorkeeper as for all other data controllers.

5. Security issues

   In the sandbox, we have discussed how Doorkeeper must ensure to maintain security within the solution. This entails that security must remain up-to-date with technological developments, that any vulnerabilities must be addressed and handled immediately, and that data must be deleted once the purpose has been achieved.

Going forward

In the sandbox, Doorkeeper has explored questions they have had in the development of intelligent video analytics, with potential functionality that enhances data protection. Doorkeeper may use the discussion in this report to better comply with requirements of data protection legislation and ensure better data protection within the solution. The Data Protection Authority also hopes the discussion can be useful for other enterprises developing similar technology.

Through these sandbox activities, the Data Protection Authority has also learned a great deal about the possibilities inherent in intelligent video analytics. We will use this new knowledge to further improve our informational work.