Going forward

Through these sandbox activities, the Data Protection Authority has also learned a great deal about the possibilities inherent in intelligent video analytics. We will use this new knowledge to further improve our informational work.

A more privacy-friendly form of monitoring?

In this report, we show that it is possible to implement data minimisation measures in intelligent video analytics. Such measures can be implemented by configuring the solution to limit the quantity of personal data that is collected and processed to what is necessary for achieving the purpose. In purely practical terms, this can be achieved by performing real-time analysis of the data – without storing permanent recordings – and by continuously removing identifiable data from the video feed.

In this report, the Data Protection Authority has also discussed that Doorkeeper’s video monitoring solution could – in some situations – potentially mean an expansion of the types of situations where video monitoring may be used. This will primarily be relevant in situations where cameras are used as sensors, where all human shapes are censored at all stages, and where no recordings at all are made.

The discussions nevertheless show that potential “privacy-friendly” solutions will not normally change where it is possible to use video monitoring of people – e.g. on a public street. The option of data-minimising measures would not lower the threshold of what is considered legal video monitoring in cases where the enterprise does not have a legitimate interest to pursue or a legitimate purpose for monitoring.

The presence of functions in monitoring systems that make processing of personal data less invasive will also require enterprises in the security industry to assess, to a greater extent, the types of personal data they need to be processing to achieve the purpose of the monitoring.

Increased complexity – increased vulnerability?

The security issues we have discussed in this report are not exhaustive. Intelligent video analytics could lead to more complex solutions than more traditional alternatives. This could, in turn, lead to greater threats against the security of the solution and increased risk to data protection. The complexity that intelligent video analytics may involve would indicate that enterprises wishing to transition to such solutions must increase their information security expertise.

In this sandbox project, Doorkeeper has discussed how they can incorporate security in the development, design, configuration and use of the solutions they offer. It will be essential for Doorkeeper to have an effective strategy for maintaining this focus in the future. For example, handling more customers and a wider range of configurations, will demand more resources and maintenance of a larger infrastructure.

New security threats will likely also emerge in step with the technological development. The Data Protection Authority recommends that both the enterprise and the Authority monitor the prevailing threat situation in the security industry.

Which developments should be monitored extra closely?

In the context of discussions in the sandbox, the Data Protection Authority would make particular note of the fact that edge computing – which in video monitoring entails that more of the video processing takes place within the camera body – is a field that may alter how personal data is processed in monitoring systems in the years to come. Among other things, it could lead to less personal data being stored by monitoring systems and that – in normal operating conditions – less data will be available to operators.

As intelligent video analytics is becoming more widespread, it is reasonable to expect more discussion of what societal consequences these technologically advanced monitoring systems will bring with them. This is not a focus of discussion in this report, but should be the topic of a wider debate.