Concerns over individuals’ right to privacy outweigh capturing footage by dashcam or helmet camera to provide evidence in the event of a road traffic collision, according to the independent body set up by the European Union last year to police the General Data Protection Regulation (GDPR).
That’s one of the draft guidelines adopted last week by the European Data Protection Board (EDPB) after it examined the “intensive use of video devices” whether for surveillance, marketing, monitoring employee performance or other purposes, warning that “data protection implications are massive.”
But writing on Twitter yesterday, Neil Brown, a telecoms, tech and internet lawyer who runs the law firm Decode Legal, warned that guidelines have profound implications for people using dashcams or action cameras, which have become hugely popular in recent years.
He wrote: “Got a dashcam or helmet cam, to collect evidence in case of an accident? According to new (draft) guidance, you must ensure it is “not constantly recording”. You also need to tell everyone who gets recorded that you are doing so. Good luck.”
He added to his tweet a screenshot of the following example given in the EDPB’s Guidelines 3/2019 on processing of personal data through video devices, adopted on 10 July 2019 and published as a “Version for public consultation.”
Example: If a dash cam is installed (eg for the purpose of collecting evidence in case of an accident), it is important to ensure that this camera is not constantly recording traffic, as well as persons who are near a road. Otherwise the interest in having video recordings as evidence in the more theoretical case of a road accident cannot justify this serious interference with data subject’s rights.
Helmet and handlebar mounted cameras have proven hugely popular with cyclists in recent years and often used not only to ensure that footage is captured in the event of a collision, but also to highlight instances of poor driving such as close passes, as our Near Miss of the Day series attests.
A number of police forces are willing to accept such video footage and often take action against the driver concerned including referring the case to prosecutors if deemed appropriate.
The EDPB is inviting comments on its draft guidelines, and its consultation is open until 9 September 2019.
While the draft guidelines do not have the force of law in themselves, the EDPB says they are designed to “clarify how the GDPR applies to the processing of personal data when using video devices and aim to ensure the consistent application of the GDPR in this regard.”
In other words, the draft guidelines are designed to sit alongside the GDPR, and if not adhered to could perhaps give rise to a legal challenge about the admissibility of evidence gathered on video by a private individual.
With the Metropolitan Police, for example, requiring that video evidence of, say, a close pass, show the recording from two minutes before to two minutes after the incident, would that fall foul of the stipulation not to record continuously, as well as failing to obtain consent from any people who could be identified in the footage (whether the alleged perpetrator or a passing pedestrian, for example)?
Likewise, there are strict guidelines on the use of and positioning of CCTV cameras.
Take the recent Swain’s Lane hit and run case, where a cyclist left seriously injured managed to track down footage of the incident and presented it to police, resulting in a successful prosecution; the camera angle, with the collision happening across the road from the premises the CCTV was protecting, appears to go beyond what is permitted by the guidelines. See the following example from the draft guidelines.
Example: A bookshop wants to protect its premises against vandalism. In general, cameras should only be filming the premises itself because it is not necessary to watch neighbouring premises or public areas in the surrounding of the bookshop premises for that purpose.
Ultimately, of course, the implications for people in the UK may depend on what happens with Brexit.
However, according to UK regulator the Information Commissioner’s Office (ICO), “As a European Regulation, [the GDPR] has direct effect in UK law and automatically applies in the UK until we leave the EU (or until the end of any agreed transition period, if we leave with a deal). After this date, it will form part of UK law under the European Union (Withdrawal) Act 2018, with some technical changes to make it work effectively in a UK context.”
The ICO adds that the Data Protection Act 2018, which like the GDPR came into effect on 25 May 2018 and replaced the Data Protection Act 1998, “sits alongside the GDPR, and tailors how the GDPR applies in the UK - for example by providing exemptions.
“It also sets out separate data protection rules for law enforcement authorities, extends data protection to some other areas such as national security and defence, and sets out the Information Commissioner’s functions and powers.”
Under the draft guidelines, uploading a video to the internet without obtaining the subject’s consent is also beyond the scope of what is permitted under the GDPR.
The draft guidelines do contain, however, a “household exemption,” giving the following example, among others.
Example: A downhill mountainbiker wants to record her descent with an actioncam. She is riding in a remote area and only plans to use the recordings for her personal entertainment at home. This would fall under the household exemption.
No need for every cyclist to consign their action camera to the attic just yet, then …
Add new comment
44 comments
I initially thought the same, as GDPR doesn’t apply to personal and household use. BUT they are severely restricting what this entails, basically to only video shot in your own private place, or for your own private use. Sharing helmet cam footage online, or having a cctv camera that captures a bit of the road as well as your drive, is now suddenly not ok.
I’m not sure this is workable. What about an outside news broadcast that captures people in the background?
I agree, I can't see how that part will survive review without some amendment. It's not just OBs, it's the billions of hours of public videos on YouTube with passers-by in.
At the end of the day this is a draft for public consultation that's being whipped up to give a bit of publicity to Mr Brown and for some clicks by road.cc
What's required for the purpose of gathering evidence in case of accident is, simply, a device that only records and stores the last 5 minutes and continually overwrites the rest. Can be set to permanently store a sequence at the push of a button or when speed drops to zero for a certain time.
ANPR cameras are operated by an official authority, there's a specific exemption in the GDPR for that type of processing.
But if big Boris has his way, it won't be an issue anymore for you guys come November 1 and your parliament can cook up whatever it desires.
"cook up"? I think you may have misspelled that...
I imagine he can try but GDPR rules apply to non-EU countries. The purpose of the GDPR regulations is to protect the rights of EU citizens. I could imagine a case where an EU citizen filmed in the UK objected to footage of them appearing online.
Correct. Boris can pass whatever law he fancies but unless he deportates the few million of EU citizens in the UK, the UK courts will still need to still consider GDPR as applicable
Now, here's an interesting one: supposing the UK makes a 'hard Brexit', no agreement at all. What makes you think that GDPR (or any other EU legal norm for that matter) would still apply to EU citizens living or for that matter visiting the UK while they are on UK territory? Put otherwise, how could such a person invoke an EU legal norm before the UK judiciary and enforce its application even if it were to be contrary to UK legislation? Once the treaties no longer apply to the UK and in the absence of agreement, it seems to me that boat has sailed. Reasoning otherwise woud mean that you create 2 classes of persons in the UK: those to whom UK law applies and those who can invoke the primancy of...what exactly? One of the very few exceptions to that rule that I know of is the Vienna convention on diplomatic relations, but that's a multilateral instrument, agreed between all parties.
(full disclosure: I'm not a Brit, not living in the UK and certainly no fan of Farage, Boris J or their coterie of self-serving nonentities who imho are heading to the casino with the future of an entire nation).
I think they're approaching it the wrong way. The problem isn't so much the continuous recording but what happens to the footage afterwards. There's already exceptions in GDPR for when the data is retained for legal purposes and recording traffic incidents would should fall under that. As long as the camera operator doesn't keep non-incident related footage and simply deletes it after a reasonable period of time (e.g. when newer footage overwrites the old) then I don't see that anyone's privacy is infringed.
How is a persons's privacy infringed when they are in a public place and incidental to the purpose of the video? I keep video footage as probably most do, no particular incidents, just a ride out or a commute ride, I cannot see how this breaches someone's rights? How long would one be allowed to keep that footage in any case, what is reasonable, to whom?
All good questions and I don't know if there are clear answers to them all.
I think there's good reason to prevent "industrial" monitoring of public spaces as companies such as FarceBook would have enough resources to track individuals' movements and would sell that on to interested parties (advertisers, blackmailers, political canvassers etc). However, I don't see an issue with individuals having public footage for their own private use and even sharing/uploading it if there's some reasonable public interest in it.
Of course, if someone is going to keep a dashcam pointed at a brothel/sex-shop for the purpose of kink-shaming people then I see that as a problem, but I've not heard of anyone doing that, so I can't see it being a big problem.
How does this affect use of police ANPR cameras?, are they not always 'continously recording'?. Also what about the police use of facial recognition cameras, they also record continously don't they?.
Ridiculous.
There are millions of CCTV cameras across this country, which constantly record pubic property and without informing those who are featured. How is a dashcam or helmetcam any different?
The right to privacy in a public place is far reduced from that of a private space. As Burt says above safety and evidence of criminality far outweighs any privacy concerns. I'll keep my cameras running...
Someone's going to have to explain this one a bit more. "Not continuously recording"? So are you supposed to switch it on just before the collision?
Sorry bureaucrats, but my safety and the prosecution of dangerous drivers outweighs any privacy problems of passersby.
Maybe so. Easy enough to achieve, just use a small memory card, so only about 5 minutes' worth is recorded before it loops round and overwrites. Coupled with the facility to "lock" a recording on demand (button press) or automatically (sudden deceleration),and that should do for keeping evidence.
Next up it will be people wearing Google Glass type "head cams" - I have every sympathy with the EU squashing ever more pervasive video surveillance.
Pages