Video privacy by design: purpose, views and retention
Turn a lawful purpose into concrete camera and access settings.
Updated
Principle and limits
For EU deployments, establish the purpose and applicable legal basis before capture. Assess necessity, proportionality, information duties and whether a DPIA is required with the responsible privacy specialist. Not every face image is biometric special-category processing; processing for unique identification requires a distinct assessment. Consent is not a universal shortcut for surveillance. This is engineering guidance, not a legal determination for a particular site.
Worked example
If a camera covers an entrance and a neighboring window, change framing or apply a supported privacy mask. Test live view, recording, secondary streams and export: masking only the operator display may leave raw footage unmasked. Record where masking occurs and which privileged roles can disable it.
Installation and acceptance
Set retention from the documented purpose rather than available disk capacity. Test automatic expiry and any authorized evidence-hold exception. Review access logs, export recipients, processors and cross-border flows. Prefer aggregate reporting where individual identity is unnecessary, and distinguish a product’s privacy controls from the organization’s legal obligations.