If you already have a people counting system in your stores or sites with 3D or 2D sensors or if you are about to purchase one, then you may not think about GDPR straight away. When talking to some of the suppliers, you can be forgiven if you get the impression that GDPR is irrelevant in this context.
Their arguments will be that "there's no need to worry about GDPR as no video recordings or personal data will be stored. Relax, they say - their business is GDPR certified and compliant. So, there's no reason what-so-ever for you to worry.
Is that so? Are they correct in their laid-back attitude? Does GDPR not apply in these situations? Are there some risks involved? And what is a GDPR certificate, really?
Indivd was founded in 2017 as a humanitarian, self-funded research project and is the first and only supplier of people counting systems that has been assessed and approved by the Swedish Authority for Privacy Protection. Based on the above, we fully understand that this all seems a bit complicated.
To help clarify things, this article addresses everything you need to know about GDPR in the context of people counters.
prior
We will explain the benefits of understanding GDPR prior to investing in a people counting system, why GDPR applies to people counters, what you ought to be across before you invest in a system, how you should act vis-a-vis your customers and how Indivd's system deals with the requirements under GDPR.
There are many significant reasons (and advantages) to deal with any GDPR matters before you buy a people counting system, including the following:
Before we explain why GDPR applies to people counting systems, we need to work out this certificate-matter.
Many suppliers claim they have been granted a GDPR certificate or are GDPR compliant.
It may sound like a great thing and that there's nothing to worry about. However, that's not quite how it works. There are no certificates that release a store or mall from their personal data responsibilities.
It is always you, as person data controller, who is responsible to ensure any personal data processing complies with GDPR, even if the supplier in fact is GDPR-compliant.
They may be correct when they claim they are compliant, but they can only talk for themselves and their business. What's happening in your business is your risk and your responsibility.
Most people counting systems use 3D or 2D sensors. This means the people counters and the supplier of your system will process personal data (images of visitors) for yo to be provide statistics and insights.
Many suppliers argue that GDPR does not apply because they do not store the images but delete them or only take images from above.
That's not correct, according to the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten). The authority has previously stated that deletion or anonymisation of personal data is in fact processing of personal data. Therefore, stores and sites need to take GDPR into consideration when deploying people counters.
The data processing carried out by suppliers of people counters, as described above, makes them so-called Personal Data Processors. Simply put, you assign them the right to process personal data (images) on your behalf and under identified situations. These situations shall be spelt out under a Personal Data Processor Agreement.
As Person Data Controller you are required to ensure your organisation complies with GDPR. This is usually done through an impact assessment, where risks and the legal basis are assessed.
The purpose of an impact assessment is to minimise risks, which does not mean that things become risk-free. The Authority for Privacy Protection can still be of the view that the risks are too high or that the processing is disproportionate.
To get some peace of mind, you can request a so-called Prior Consultation at the Authority for Privacy Protection. When a Prior Consultation is performed, the Authority spends several weeks reviewing and assessing whether the planned personal data processing is in breach of GDPR.
Indivd is the first and only supplier of people counters that has requested an assessment of its business, followed by an approved under Prior Consultation. Obtaining this approval was a logical step in our ongoing efforts to achieve our sustainability goals.
The first thing is to clearly define the purpose of the people counting.
In doing so, consider what type of personal data you're planning to process. Different people counters operate differently. That's why it's important to ask the supplier what personal data their system will collect and process.
Once you have established this ground, there are still many important questions to ask both the supplier and yourself. Some examples:
The answers give you an idea of the potential risks. Not until you feel completely satisfied and comfortable should you enter into a personal data processor agreement with the supplier. Only then can the installation be carried out.
These and many other questions have been addressed to us for many years. In fact, they are questions we constantly challenge ourselves with. They form the basis for our continuous efforts to ensure the highest degree of privacy.
If you after all these questions still have some matters to address, then we recommend you carry out a proper impact assessment. Please contact us on privacy@indivd.com for any questions on how such an assessment is performed.
Since people counting based on 3D or 2D sensors is seen as personal data processing, you have an obligation to inform your customers about the processing through something called first and second layer information.
For a store or mall, the first layer of information is usually provided at entrances, before customers enter the monitored area. You put out a sign clearly conveying important information e.g. Who the personal data controller is, how the data is processed, the purposes of processing and the customers'/data subjects' rights.
You provide the second layer of information, usually your Privacy Policy on your website, in a similar way. You explain the new processing (people counting) and follow your normal structure.
You can, as a suggestion, add a URL code on the first layer of information (the sign) to allow the visitors to easily access your second layer via the first layer. You can also add an information booklet about the processing on site.
We have already done the ground work and are more than happy to help our customers deal with these processes quickly and effortlessly. If you have any questions about the information obligations, please feel free to contact us via e-mail at privacy@indivd.com.
Indivd has developed a new type of people counter. It is not only more cost-effective than others on the market, but also more secure as it is based on Data Protection by Design.
Data Protection by Design means we have integrated data protection functionality from the beginning, which leads to better and more cost-effective privacy protection.
We have, as part of our development, been assessed by around 30 experts and introduced clear ethical and privacy policies that all employees must follow. We have, for example, developed an Anonymisation Policy and a safe and secure policy for AI development.
In addition, our people counter is the first and only that has been assessed by the Swedish Authority for Privacy Protection through a so-called Prior Consultation.
In a Prior Consultation, the Authority spends several weeks assessing and evaluating whether the planned personal data processing is GDPR-compliant.
In their findings, the Authority concluded that the processing is lawful and may be carried out subject to GDPR Article 6.1 (f).
Article 6.1 (f) refers to legitimate interests, which simply put means that, in the view of the Authority, Indivd's people counting method minimises the risks in an acceptable manner.
“In our view, the risk for Indivd was low”
Jennie Bård, former lawyer at the Swedish Authority for Privacy Protection and involved in the Prior Consultation for Indivd