The Seven Principles of Privacy by Design for Visual Data Collection
The size of the world’s global data footprint is increasing daily, with new technologies vowing to revolutionize multiple aspects of our daily lives. Meanwhile, the demand for adequate protection for individuals’ privacy is rising with many skeptical about how companies are handling data.
As a result, in 2018, the European Union General Data Protection Regulation (GDPR) was established as a mandatory measure for companies operating in the EU, or if they are processing data of citizens and residents in the EU, to guide data handling, processing, and management. From that point onwards, organizations began considering methods of integrating privacy measures in their everyday operations, with Article 25 of the GDPR requiring ‘data protection by design and default.’ In essence, this means compliance with data protection protocols is best achieved when privacy is considered at the beginning stages of technology development.
Seven Principles of Privacy by Design
Developed in the 90s, the Seven Principles of Privacy by Design promotes a framework that is widely accepted and incorporated into current privacy regulations, including the GDPR. Companies can choose to implement it in order to stay compliant with privacy regulations as well as promote public trust.
So, what are the seven principles of privacy by design?
- Proactive not Reactive, Preventative not Remedial
- Privacy by Design principles is characterized by its proactive approach. This means that organizations are encouraged to not wait until it’s too late to begin considering privacy measures — in short, “Privacy by Design comes before the fact, not after”
2. Privacy as the Default Setting
- Privacy should be the default setting within an organization — all IT systems should be equipped to ensure the users privacy.
3. Privacy embedded into the design
- Privacy should already be a key consideration in the first stages of product and/or service development. Therefore, organizations that implement this framework will fully integrate privacy into the design.
4. Full functionality — positive-sum, not zero-sum
- Privacy should come at a ‘win-win’ and should not sacrifice product quality, security or functionality at any stage. Privacy, security, and functionality should all work hand in hand.
5. End-to-end security, full lifecycle protection
- Having been implemented at the start, the privacy by design measures ensure that the products and/or services are protected for their entire lifecycle. This ‘cradle to grave’ approach ensures lifecycle management of the information collected by organizations.
6. Visibility and transparency
- Organizations must be open regarding the business practices and what technology is being used to achieve these objectives.
7. Respect for user privacy
- Above all, the user’s privacy must come first — the privacy measures that organizations implement must be user-centric.
What data is in scope?
Although traditionally, privacy concerns revolve around information regarding individuals’ numbers, email addresses, internet usage, etc., visual data is included in the scope of the GDPR. This is because visual data can include personal information markers, such as faces, bodies, gender, identities, as well as license plate information — all of which are personal information that usually requires the consent of the individuals before they can be used. In our data-driven world, organizations utilize sophisticated cameras and sensors in multiple use cases to collect the data they need. A great example of this being done in the real world is autonomous driving as well as smart city applications.
Real-World Applications
Autonomous Driving
As outlined in our previous blog, the automotive industry collects a considerable amount of data from the development, and validation to the deployment phases of the autonomous vehicle production cycle. As with most mass data collection, the data inevitably includes personal information. This includes face, body, and license plate information that is used for the development of ADAS and ADS. Storing and processing this data in its raw format is not permitted under the GDPR. Holding on to the data, in its raw format, is not permitted under GDPR.
By integrating privacy by design measures, automotive companies can avoid non-compliant data processing and hefty GDPR fines. Not only will this facilitate a smoother process for the deployment of the autonomous vehicles, but it also cuts costs and increases efficiency as OEMs, Tier 1s, and Tier 2s can be assured that the data being used has been anonymized, and therefore there will no be a hindrance during the process of utilizing the data.
Smart City
Cities and municipalities, like any other private organization, fall under the jurisdiction of GDPR regarding the personal information that they collect, including visual data. Smart cities can collect data through various methods, including smart sensors on vehicles through mobile mapping, and through surveillance footage from CCTV cameras mounted in various areas around the city. This data could be used to enhance infrastructure and optimize the daily operations of cities. As this data will include the personal information of citizens without their consent and getting consent from every citizen is an impossible task, integrating privacy by design measures will allow city authorities and municipalities to anonymize the personal data of citizens, thus improving public trust whilst not sacrificing the richness of the data that is collected.
It is important to note that should the data be used by official authorities to prevent crime or collect evidence, it is permissible to have access to the full raw data set.
Integrate Privacy by Design with NavInfo Europe
NavInfo Europe’s GDPR compliance service provides the infrastructure for GDPR-compliant data processing. This includes highly accurate, and resource-efficient AI-powered anonymization, where our anonymizer automatically detects and blurs personal information from raw visual data. Additionally, the package includes data management and pre-checkup, setting up the anonymization pipeline, and data validation and finalization for all types of visual data from various cameras and sensors, and in diverse weather conditions This way, organizations can take the first steps toward adopting a privacy by design framework, to anonymize visual data in an efficient and cost-effective manner.
We also offer consultation services to our customers to implement proactive, preventative technical measures and prepare GDPR-required documents and assessments to combat scenarios where data privacy is compromised, to ensure a safe and modern future for both the public and businesses.
If your organization performs large-scale visual data acquisition, then the data you collect might be under the scope of the GDPR.
As experienced data processers in this field, with over 10 million images anonymized with our GDPR compliance service, NavInfo Europe will act as your trusted partner to guide you on how to integrate privacy measures in your business processes. Test the anonymizer with our free demo tool, and reach out to us to discuss how we can help facilitate data protection for your organization.
