GDPR & CCTV; what do I have to redact?

In our previous article, What do the GDPR rules mean in relation to CCTV?, we looked at what the new 2018 GDPR rules mean in the context of CCTV and data access requests.

Fast forwards 10 months later, what are we seeing in the market?

There is a still a lot of confusion. Indeed according to a study by the Irish government, 66% of organsiations are unaware of the regulations imposed by GDPR in relation to their CCTV.

Firstly, a lot of organisations do not realise their obligations in respondin to requests, namely that they have to provide CCTV to people who request it (provided that they appear in it). People have a right to their own data, including the right to obtain a copy and the right to request that this data be deleted.

If seems to be a common misconception that if an individual wants CCTV of themselves, they have to make a request to the police first. This is not the case. They can request it directly and the organisation has 30 days to respond.

Secondly, If you do have a data access request for CCTV, it is mandatory you to redact, blur, darken or pixilate (yes there are a lot of terms used to describe this process!) other parties who appear in the video. The feedback we get from organisations is that they are unaware that they need to protect the privacy of others in the video.

Even when organisations are aware of their obligations and have processes and practices in place, there is one common question we get. What and how much do we have redact? (or blur, darken, pixilate).

So what is the answer to this question? There are no hard and fast rules. We have not seen any legislation on this but the general guidelines are as follows:

Generally, if the CCTV footage is low quality, blurring only the faces is sufficient. As, in the below Image 1 the faces of individuals are not clear, hence it is enough to only blur the faces of those visible.

But if the CCTV footage is high quality, then you need to blur the whole person. As, people can be easily identified from their clothes e.g. logos etc.

For example, in Image 2, the CCTV footage is high quality and you can clearly see the faces of people, so we need to blur out the individuals completely.

Instead of individually blurring each person in a video, it is possible to completely or partially blur out the background of the video, as in Image 3. But this should only be done if it does not affect the context of the video i.e. showing how someone came to slip and fall.

At Kinesense we provide both redaction services and software to enable you to do it yourself. Get in touch info@kinesense.com to find out more.