Support road.cc

Like this site? Help us to make it better.

Is this the end for helmetcam footage? Right to privacy outweighs recording journeys in case of collision says EU data watchdog

Draft guidance opened to public consultation also says recording mustn't be continuous – raising possibility of challenges to admissibility of video evidence ...

Concerns over individuals’ right to privacy outweigh capturing footage by dashcam or helmet camera to provide evidence in the event of a road traffic collision, according to the independent body set up by the European Union last year to police the General Data Protection Regulation (GDPR).

That’s one of the draft guidelines adopted last week by the European Data Protection Board (EDPB) after it examined the “intensive use of video devices” whether for surveillance, marketing, monitoring employee performance or other purposes, warning that “data protection implications are massive.”

But writing on Twitter yesterday, Neil Brown, a telecoms, tech and internet lawyer who runs the law firm Decode Legal, warned that guidelines have profound implications for people using dashcams or action cameras, which have become hugely popular in recent years.

He wrote: “Got a dashcam or helmet cam, to collect evidence in case of an accident? According to new (draft) guidance, you must ensure it is “not constantly recording”. You also need to tell everyone who gets recorded that you are doing so. Good luck.”

He added to his tweet a screenshot of the following example given in the EDPB’s Guidelines 3/2019 on processing of personal data through video devices, adopted on 10 July 2019 and published as a “Version for public consultation.”

Example: If a dash cam is installed (eg for the purpose of collecting evidence in case of an accident), it is important to ensure that this camera is not constantly recording traffic, as well as persons who are near a road. Otherwise the interest in having video recordings as evidence in the more theoretical case of a road accident cannot justify this serious interference with data subject’s rights.

Helmet and handlebar mounted cameras have proven hugely popular with cyclists in recent years and often used not only to ensure that footage is captured in the event of a collision, but also to highlight instances of poor driving such as close passes, as our Near Miss of the Day series attests.

A number of police forces are willing to accept such video footage and often take action against the driver concerned including referring the case to prosecutors if deemed appropriate.

The EDPB is inviting comments on its draft guidelines, and its consultation is open until 9 September 2019.

While the draft guidelines do not have the force of law in themselves, the EDPB says they are designed to “clarify how the GDPR applies to the processing of personal data when using video devices and aim to ensure the consistent application of the GDPR in this regard.”

In other words, the draft guidelines are designed to sit alongside the GDPR, and if not adhered to could perhaps give rise to a legal challenge about the admissibility of evidence gathered on video by a private individual.

With the Metropolitan Police, for example, requiring that video evidence of, say, a close pass, show the recording from two minutes before to two minutes after the incident, would that fall foul of the stipulation not to record continuously, as well as failing to obtain consent from any people who could be identified in the footage (whether the alleged perpetrator or a passing pedestrian, for example)?

Likewise, there are strict guidelines on the use of and positioning of CCTV cameras.

Take the recent Swain’s Lane hit and run case, where a cyclist left seriously injured managed to track down footage of the incident and presented it to police, resulting in a successful prosecution; the camera angle, with the collision happening across the road from the premises the CCTV was protecting, appears to go beyond what is permitted by the guidelines. See the following example from the draft guidelines.

Example: A bookshop wants to protect its premises against vandalism. In general, cameras should only be filming the premises itself because it is not necessary to watch neighbouring premises or public areas in the surrounding of the bookshop premises for that purpose.

Ultimately, of course, the implications for people in the UK may depend on what happens with Brexit.

However, according to UK regulator the Information Commissioner’s Office (ICO), “As a European Regulation, [the GDPR] has direct effect in UK law and automatically applies in the UK until we leave the EU (or until the end of any agreed transition period, if we leave with a deal). After this date, it will form part of UK law under the European Union (Withdrawal) Act 2018, with some technical changes to make it work effectively in a UK context.”

The ICO adds that the Data Protection Act 2018, which like the GDPR came into effect on 25 May 2018 and replaced the Data Protection Act 1998, “sits alongside the GDPR, and tailors how the GDPR applies in the UK - for example by providing exemptions.

“It also sets out separate data protection rules for law enforcement authorities, extends data protection to some other areas such as national security and defence, and sets out the Information Commissioner’s functions and powers.”

Under the draft guidelines, uploading a video to the internet without obtaining the subject’s consent is also beyond the scope of what is permitted under the GDPR.

The draft guidelines do contain, however, a “household exemption,” giving the following example, among others.

Example: A downhill mountainbiker wants to record her descent with an actioncam. She is riding in a remote area and only plans to use the recordings for her personal entertainment at home. This would fall under the household exemption.

No need for every cyclist to consign their action camera to the attic just yet, then …

Simon joined road.cc as news editor in 2009 and is now the site’s community editor, acting as a link between the team producing the content and our readers. A law and languages graduate, published translator and former retail analyst, he has reported on issues as diverse as cycling-related court cases, anti-doping investigations, the latest developments in the bike industry and the sport’s biggest races. Now back in London full-time after 15 years living in Oxford and Cambridge, he loves cycling along the Thames but misses having his former riding buddy, Elodie the miniature schnauzer, in the basket in front of him.

Add new comment

44 comments

Avatar
HoarseMann replied to tom_w | 5 years ago
2 likes
tom_w wrote:

This is mostly a non-story. 

For most of us, the GDPR is irrelevant as it only applies to companies/organisations, so if you've got a helmet/dash cam on your private bike/car it doesn't apply at all (in the same way that you don't need to seek permission if recording a video or picture in public).

What I'd imagine the EDPB are seeking to stop here is dash cams that run non-stop so create huge logs of the locations of people captured on those films.  For companies with a fleet of vehicles, or more likely the providers of dashcams that have cloud backup that data could prove saleable/hackable and could be large scale privacy concern. 

The EDPB should be applauded for outlawing that sort of data capture, it's exactly the sort of thing the GDPR is supposed to do and speaks well of how the new regs have been drafted that they can be applied to this scenario without needing to be revised.

I imagine the 5 min looping of most dash cams will prove to be acceptable to the EDPB for allowing dash cams to be continued to be used by companies as that removes the collection of large, searchable sets of individual's locations - as long as those recordings aren't being cached and processed in the cloud.

I initially thought the same, as GDPR doesn’t apply to personal and household use. BUT they are severely restricting what this entails, basically to only video shot in your own private place, or for your own private use. Sharing helmet cam footage online, or having a cctv camera that captures a bit of the road as well as your drive, is now suddenly not ok.

I’m not sure this is workable. What about an outside news broadcast that captures people in the background?

Avatar
tom_w replied to HoarseMann | 5 years ago
5 likes
HoarseMann wrote:

Sharing helmet cam footage online, or having a cctv camera that captures a bit of the road as well as your drive, is now suddenly not ok. I’m not sure this is workable. What about an outside news broadcast that captures people in the background?

I agree, I can't see how that part will survive review without some amendment.  It's not just OBs, it's the billions of hours of public videos on YouTube with passers-by in.

At the end of the day this is a draft for public consultation that's being whipped up to give a bit of publicity to Mr Brown and for some clicks by road.cc

Avatar
Xenophon2 | 5 years ago
4 likes

What's required for the purpose of gathering evidence in case of accident is, simply, a device that only records and stores the last 5 minutes and continually overwrites the rest.  Can be set to permanently store a sequence at the push of a button or when speed drops to zero for a certain time.

ANPR cameras are operated by an official authority, there's a specific exemption in the GDPR for that type of processing.

But if big Boris has his way, it won't be an issue anymore for you guys come November 1 and your parliament can cook up whatever it desires.

Avatar
brooksby replied to Xenophon2 | 5 years ago
5 likes
Xenophon2 wrote:

What's required for the purpose of gathering evidence in case of accident is, simply, a device that only records and stores the last 5 minutes and continually overwrites the rest.  Can be set to permanently store a sequence at the push of a button or when speed drops to zero for a certain time.

ANPR cameras are operated by an official authority, there's a specific exemption in the GDPR for that type of processing.

But if big Boris has his way, it won't be an issue anymore for you guys come November 1 and your parliament can cook up whatever it desires.

"cook up"? I think you may have misspelled that...  3

Avatar
aegisdesign replied to Xenophon2 | 5 years ago
0 likes
Xenophon2 wrote:

But if big Boris has his way, it won't be an issue anymore for you guys come November 1 and your parliament can cook up whatever it desires.

I imagine he can try but GDPR rules apply to non-EU countries. The purpose of the GDPR regulations is to protect the rights of EU citizens. I could imagine a case where an EU citizen filmed in the UK objected to footage of them appearing online.

Avatar
llanero replied to aegisdesign | 5 years ago
0 likes
aegisdesign wrote:
Xenophon2 wrote:

But if big Boris has his way, it won't be an issue anymore for you guys come November 1 and your parliament can cook up whatever it desires.

I imagine he can try but GDPR rules apply to non-EU countries. The purpose of the GDPR regulations is to protect the rights of EU citizens. I could imagine a case where an EU citizen filmed in the UK objected to footage of them appearing online.

Correct. Boris can pass whatever law he fancies but unless he deportates the few million of EU citizens in the UK, the UK courts will still need to still consider GDPR as applicable

Avatar
Xenophon2 replied to llanero | 5 years ago
0 likes
llanero wrote:
aegisdesign wrote:
Xenophon2 wrote:

But if big Boris has his way, it won't be an issue anymore for you guys come November 1 and your parliament can cook up whatever it desires.

I imagine he can try but GDPR rules apply to non-EU countries. The purpose of the GDPR regulations is to protect the rights of EU citizens. I could imagine a case where an EU citizen filmed in the UK objected to footage of them appearing online.

Correct. Boris can pass whatever law he fancies but unless he deportates the few million of EU citizens in the UK, the UK courts will still need to still consider GDPR as applicable

 

Now, here's an interesting one:  supposing the UK makes a 'hard Brexit', no agreement at all.  What makes you think that GDPR (or any other EU legal norm for that matter) would still apply to EU citizens living or for that matter visiting the UK while they are on UK territory?  Put otherwise, how could such a person invoke an EU legal norm before the UK judiciary and enforce its application even if it were to be contrary to UK legislation?  Once the treaties no longer apply to the UK and in the absence of agreement, it seems to me that boat has sailed.  Reasoning otherwise woud mean that you create 2 classes of persons in the UK:  those to whom UK law applies and those who can invoke the primancy of...what exactly?  One of the very few exceptions to that rule that I know of is the Vienna convention on diplomatic relations, but that's a multilateral instrument, agreed between all parties.

(full disclosure: I'm not a Brit, not living in the UK and certainly no fan of Farage, Boris J or their coterie of self-serving nonentities who imho are heading to the casino with the future of an entire nation).

Avatar
hawkinspeter | 5 years ago
12 likes

I think they're approaching it the wrong way. The problem isn't so much the continuous recording but what happens to the footage afterwards. There's already exceptions in GDPR for when the data is retained for legal purposes and recording traffic incidents would should fall under that. As long as the camera operator doesn't keep non-incident related footage and simply deletes it after a reasonable period of time (e.g. when newer footage overwrites the old) then I don't see that anyone's privacy is infringed.

Avatar
BehindTheBikesheds replied to hawkinspeter | 5 years ago
1 like
hawkinspeter wrote:

I think they're approaching it the wrong way. The problem isn't so much the continuous recording but what happens to the footage afterwards. There's already exceptions in GDPR for when the data is retained for legal purposes and recording traffic incidents would should fall under that. As long as the camera operator doesn't keep non-incident related footage and simply deletes it after a reasonable period of time (e.g. when newer footage overwrites the old) then I don't see that anyone's privacy is infringed.

How is a persons's privacy infringed when they are in a public place and incidental to the purpose of the video? I keep video footage as probably most do, no particular incidents, just a ride out or a commute ride, I cannot see how this breaches someone's rights? How long would one be allowed to keep that footage in any case, what is reasonable, to whom?

Avatar
hawkinspeter replied to BehindTheBikesheds | 5 years ago
0 likes
BehindTheBikesheds wrote:
hawkinspeter wrote:

I think they're approaching it the wrong way. The problem isn't so much the continuous recording but what happens to the footage afterwards. There's already exceptions in GDPR for when the data is retained for legal purposes and recording traffic incidents would should fall under that. As long as the camera operator doesn't keep non-incident related footage and simply deletes it after a reasonable period of time (e.g. when newer footage overwrites the old) then I don't see that anyone's privacy is infringed.

How is a persons's privacy infringed when they are in a public place and incidental to the purpose of the video? I keep video footage as probably most do, no particular incidents, just a ride out or a commute ride, I cannot see how this breaches someone's rights? How long would one be allowed to keep that footage in any case, what is reasonable, to whom?

All good questions and I don't know if there are clear answers to them all.

I think there's good reason to prevent "industrial" monitoring of public spaces as companies such as FarceBook would have enough resources to track individuals' movements and would sell that on to interested parties (advertisers, blackmailers, political canvassers etc). However, I don't see an issue with individuals having public footage for their own private use and even sharing/uploading it if there's some reasonable public interest in it.

Of course, if someone is going to keep a dashcam pointed at a brothel/sex-shop for the purpose of kink-shaming people then I see that as a problem, but I've not heard of anyone doing that, so I can't see it being a big problem.

Avatar
schlepcycling | 5 years ago
8 likes

How does this affect use of police ANPR cameras?, are they not always 'continously recording'?.  Also what about the police use of facial recognition cameras, they also record continously don't they?.

Avatar
jasecd | 5 years ago
12 likes

Ridiculous.

There are millions of CCTV cameras across this country, which constantly record pubic property and without informing those who are featured. How is a dashcam or helmetcam any different?

The right to privacy in a public place is far reduced from that of a private space. As Burt says above safety and evidence of criminality far outweighs any privacy concerns. I'll keep my cameras running...

Avatar
burtthebike | 5 years ago
12 likes

Someone's going to have to explain this one a bit more.  "Not continuously recording"?  So are you supposed to switch it on just before the collision?  sad

Sorry bureaucrats, but my safety and the prosecution of dangerous drivers outweighs any privacy problems of passersby.

Avatar
Sriracha replied to burtthebike | 5 years ago
2 likes
burtthebike wrote:

Someone's going to have to explain this one a bit more.  "Not continuously recording"?  So are you supposed to switch it on just before the collision?  sad

Maybe so. Easy enough to achieve, just use a small memory card, so only about 5 minutes' worth is recorded before it loops round and overwrites. Coupled with the facility to "lock" a recording on demand (button press) or automatically (sudden deceleration),and that should do for keeping evidence.
Next up it will be people wearing Google Glass type "head cams" - I have every sympathy with the EU squashing ever more pervasive video surveillance.

Pages

Latest Comments