privacy (and other) issues with dashcams, bodycams and google glass (isaca privacy open forum...

Click to edit Master title styleOpen Forum PRIVACY

Tuesday, 10th of December 2013

Brussels, 10 December 2013 2

Agenda

1. 18:30 Welcome 2. 18:45 Cameras – Privacy Issues3. 19:30 Break 4. 19:50 Cameras – Privacy Issues5. 20:30 Close

Brussels, 10 December 2013 3

Close

Brussels, 10 December 2013

CAMERAS – PRIVACY (AND

OTHER) ISSUES WITH

DASHCAMS, BODYCAMS

AND GOOGLE GLASSJOHAN VANDENDRIESSCHE & MARC VAEL

4

Brussels, 10 December 2013

Proliferation of cameras

• Exponential growth of the number of cameras

• Technological advances (‘miniaturisation’)

• Decreased cost

• Multiplying possibilities

• Exact number of cameras is unknown

• Increase in notification is staggering

• Notifications relate to camera systems (no mention of number of cameras)

5

Brussels, 10 December 2013

Proliferation of cameras

• Purposes of cameras are diverse

• ‘Private’ use

• Newsgathering

• Surveillance in various forms

• Workfloor surveillance

• Traffic surveillance

• Crime detection and prevention (?)

• Object of camera footage / photos is diverse

• Objects vs. persons

6

Brussels, 10 December 2013

High level legal framework

• Act of 8 December 1992

• Processing of personal data

• Camera Surveillance Act 21 March 2007

• Camera surveillance (crime detection andprevention)

• Camera Surveillance Decree 10 February 2008 (Notification)

• Camera Surveillance Decree 2 July2008 (Declaration)

7

Brussels, 10 December 2013

High level legal framework

• CBA n°68 concerning workfloorcameras

• Workfloor privacy

• Copyright Act of 30 June 1994

• Reproduction of copyrighted materials

• Personality rights

• Specific legislation

• Police cameras, football stadium

• E.g. draft legislation on police cameras (‘bodycams’)

8

Brussels, 10 December 2013

Defining the applicable law

• Purpose of the camera system

• Surveillance

• Crime detection and prevention

• Nuisance detection and prevention

• Maintaining public order

• Workfloor surveillance

• Other purposes

• E.g. private purpose (video intercom, videophone, …)

9

Brussels, 10 December 2013

Defining the applicable law

• Content of camera footage/photos

• Personal data

• Content covered by personality rights

• Copyrighted materials

• Combination of purposes and content may lead to a multiplication of applicable laws

10

Brussels, 10 December 2013

Surveillance cameras

• Surveillance Camera

• Fixed or mobile observation system that collects, processes or stores images

• Surveillance purpose

• prevent, establish or detects crimes

• prevent, establish or detect public nuisance

• maintain public order

• Exceptions exist

• Workfloor surveillance (CBA n°68)

• Specific legislation

11

Brussels, 10 December 2013

Surveillance

• Location based regime

• Unenclosed area

• Enclosed area accessible to the public

• Enclosed area not accessible to the public

• Data controller

• Accountability principle

• Applies in a cumulative manner with data protection legislation (lex

specialis)

12

Brussels, 10 December 2013

Surveillance cameras

• Interdiction of covert cameras

• Implicit consent based on pictogram notification

• Access restrictions in relation to camera footage

• Only by or under the authority of the data controller

• Optional / compulsory communication to police authorities

• No violation of intimacy / sensitive data

13

Brussels, 10 December 2013

Surveillance cameras

• Unenclosed area

• Decision by data controller

• Prior positive advice from municipality who consults the Chief of Police

• Unified notification (Commission and Police)

• Pictogram warning

• Not specifically aimed at another area not covered by the decision

14

Brussels, 10 December 2013

Surveillance cameras

• Unenclosed area

• Restriction on real-time surveillance

• Only under police supervision

• Enable immediate intervention

• Purpose limitation in relation to recording

• Evidence gathering

• Storage restriction

• Maximum period 1 month

• Exception applies to footage that serves as evidence

15

Brussels, 10 December 2013

Surveillance cameras

• Enclosed area accessible to the public

• Decision by data controller

• Unified notification (Commission and Police)

• Pictogram warning

• Not specifically aimed at another area not covered by the decision

16

Brussels, 10 December 2013

Surveillance cameras

• Enclosed area accessible to the public

• Restriction on real-time surveillance

• Enable immediate intervention

• Purpose limitation in relation to recording

• Evidence gathering

• Storage restriction

• Maximum period 1 month

• Exception applies to footage that serves as evidence

17

Brussels, 10 December 2013

Surveillance cameras

• Enclosed area not accessible to the public

• Decision by data controller

• Unified notification (Commission and Police)

• No notification in case of personal or household use

• Pictogram warning

• Not specifically aimed at another area not covered by the decision

• If private entry, measures to strictly limit surveillance of other areas

18

Brussels, 10 December 2013

Surveillance cameras

• Enclosed area not accessible to the public

• No limitation on real-time surveillance

• Storage restriction

• Maximum period 1 month

• Exception applies to footage that serves as evidence

19

Brussels, 10 December 2013

Surveillance cameras

• Mobile surveillance cameras

• Specific to police forces

• Mass meetings

• Specific legislation applies to some kinds of mobile police cameras

• Draft legislation in relation to mobile surveillance cameras outside mass meetings (‘bodycams’)

20

Brussels, 10 December 2013

Other cameras

• Camera

• Fixed or mobile observation system that collects, processes or stores images

• No surveillance purpose

• Not covered by specific laws or by CBA n°68

• Usually covered by data protection law

• Processing of personal data

21

Brussels, 10 December 2013

Other cameras

• Limitations in relation to the processing of personal data

• Very large legal interpretation to the concept of personal data

• Not necessarily sensitive information (although stricter rules apply to special categories of personal data)

• Camera footage / photos may be personal data

• Processing: “any operation or set of

operations which is performed upon

personal data […]”

22

Brussels, 10 December 2013

Other cameras

• The data processing must comply with specific principles

• Proportionality

• Purpose limitation

• Limited in time

• (Individual and collective) Transparency

• Data quality

• Data security

23

Brussels, 10 December 2013

Other cameras

• Personality rights

• Prohibit the making, distributing and publishing of portrait of a person

• Personal right

• No absolute right

• Public persons acting in their public capacity or during a public activity

• Photo of a public area without aiming at a specific person (the person is accessory to the picture)

24

Brussels, 10 December 2013

Other cameras

• Copyrighted content

• Copyright = exclusive right on exploitation of copyrighted materials

• Exception: private use

• Camera footage / photos for personal use: in principle no problem

• Commercial exploitation: consent from copyright holder is required

25

Brussels, 10 December 2013

Workfloor cameras

• Camera system on the workfloor

• Specific CBA to balance employers’ rights and employees’ (privacy) rights

• Purpose limitation

• Health and safety

• Protection of company property

• Supervision of the production process

• Supervision of the work of the employee

• Purposes must be explicitly defined

26

Brussels, 10 December 2013

Workfloor cameras

• Full-time surveillance

• Health and safety

• Protection of company property

• Supervision of the production process (machines only)

• Time-limited surveillance

• Supervision of the production process (employees and machines)

• Supervision of the work of the employee

27

Brussels, 10 December 2013

Workfloor cameras

• Principles

• Proportionality

• No intrusion in the employee’s privacy (not absolute)

• Collective and individual information

• Purpose

• Storage of the footage/images

• The number and location of the cameras

• Activity periods of the cameras

28

Brussels, 10 December 2013

Workfloor cameras

• Principles

• Good faith processing of the footage/images

• Data protection law applies if personal data is being processed

• Scope of CBA n°68 is larger

• Access and rectification rights continue to apply

29

Brussels, 10 December 2013

Workfloor cameras

• Sanctions / Immediate dismissal based evidence obtained through a camera system

• Sanctions need to be included in the Work Regulations

• Two main legal issues

• Reason for immediate dismissal?

• Evidence?

• Admissibility of evidence

• Probative value of evidence

30

Brussels, 10 December 2013

Practical application

• Bodycam / dashcam / Google Glass

• Purpose?

• Surveillance

• Newsgathering

• Workfloor surveillance

• Surveillance Cameras

• Use of mobile cameras is restricted

• Prohibition of hidden cameras

31

Brussels, 10 December 2013

Practical application

• Bodycam / dashcam / Google Glass

• Data protection law applicable?

• Exemption for personal and household activities

• Partial exemption for purposes of journalism

• Personality rights

• Individuals main focus of footage/image?

• Copyright issues

• Copyrighted materials?

• Personal use?

• Commercial re-use?

32

Brussels, 10 December 2013 33

Contact details

Johan Vandendriessche

Partner

crosslaw CVBA

Mobile Phone +32 486 36 62 34

E-mail j.vandendriessche@crosslaw.be

Website www.crosslaw.be

Marc Vael

International Vice President

ISACA

Mobile Phone +32 473 99 30 31

E-mail marc@vael.net

Website www.isaca.org

Brussels, 10 December 2013 34

ISACA BELGIUM