SAFETY AND SECURITY track - Tuesday 28th "Video analytics offer a variety of possibilities from public safety and personalized advertising to quality control and management of manufacturing processes. This talk will focus on how video analytics is regulated in the EU, what future regulative actions there might be, and what should be taken into account when utilizing such technologies from the legal perspective." IDA KOSKINEN, Lawyer, Merkurius Attorneys Ltd Smart City Mindtrek 2020 – conference 28th-29th January Tampere, Finland www.mindtrek.org/2020/

1. VIDEOANALYTICS AND
EU LEGISLATION
Ida Koskinen, Merkurius Attorneys Ltd
28.1.2020

2. MERKURIUS

3. GET TO KNOW US
F O C U S
Business law
Plain and simple.
M I S S I O N
High-quality business law
– Smart solutions
T E A M
Ten experts, eight fully
dedicated and creative
lawyers

4. MEET THE
TEAM

5. STARTING POINTS

6. NO SPECIFIC
LEGISLATION FOR
VIDEO ANALYTICS

7. POSSIBLE
VIEWPOINTS
Privacy & Data
Protection
Liability & Damages
Law Enforcement
Intellectual Property
Rights & Data
Ownership

9. POSSIBLE
VIEWPOINTS
Privacy & Data
Protection
Liability & Damages
Law Enforcement
Intellectual Property
Rights & Data
Ownership

10. TERMINOLOGY
D IRECTIVE
A legislative act that sets out a goal that all member
states must achieve. The practical means are
decided by each member state in its national
legislation.
REGULATI O N
A biding legislative act. Applied uniformly across the
member states.

11. PRIVACY

12.  The EU General Data Protection
Regulation, “GDPR” (2016/679)
(2016/679)
 Law Enforcement Directive, “LED”
(2016/680)
 National legislation in each of the
member states
LEGISLATION

13. PERSONAL DATA
” N O R M A L ”
Any information relating to an
identified or identifiable natural
person.
S P E C I A L
C A T E G O R I E S
Personal data which reveals e.g.
racial/ethnic origin, political opinions,
religious beliefs, health, sexual orientation
and processing of biometric data for the
purpose of uniquely identifying a natural
person.

14. WHEN DOES GDPR
APPLY? • Rule of thumb: picture and video are personal data (if a natural person
is identifiable)
• So: GDPR does not apply to processing of data that has no reference
to a person directly or in directly:
• Fake cameras – does not apply
• Recordings from high altitude – generally does not apply
• Real-time monitoring – applies
• Private (household) cameras – depends

15. STEP-BY-STEP
APPROACH 1) Is video surveillance in compliance with
data protection legislation in the first
place?
2) Does the use of analytics create further
requirements?

16. TOP 3
REQUIREMENTS
1. There must be a legal basis for the processing
• In simple video surveillance “legitimate
interest” often works
• Mere “for safety” is not enough!
2. Data subjects must be notified
• Layered approach?
3. Data security

17. BIOMETRIC DATA
= personal data resulting from specific
technical processing relating to the physical,
physiological or behavioural characteristics
of a natural person, which allow or confirm
the unique identification of that natural
person, such as facial images or
dactyloscopic data
= processing of
special categories of
personal data
…which is prohibited
unless expressly
allowed in the GDPR
(Art. 9)

18. WHEN IS IT
ALLOWED?
 Options are listed in Article 9
 The most likely basis for such processing is the data
subject’s consent
 Requirements for a valid consent
 ”processing relates to personal data that the data subject
has manifestly made public”
 mere fact of entering into the range of the camera
does not imply that the data subject intends to make
public special categories of data relating to him or her

19. ”UNIQUELY IDENTIFY”
When the purpose of processing is, for example, to distinguish one
category of people from another but not to uniquely identify anyone 
Article 9 does not apply
EXAMPLE: A shop owner would like to customize its advertisement based on gender
and age characteristics of the customer captured by a video surveillance system. If that
system does not generate biometric templates in order to uniquely identify persons but
instead just detects those physical characteristics and consequently only classifies the
person, then the processing would not fall under Article 9.

20. LAW
ENFORCEMENT

21.  Restricted, who’s personal data the police may collect and
process
 Automatic comparing of facial images possible only for the
purpose of prevention, revelation and investigation of crimes
and only when it is necessary
 Material that can be used: personal descriptions already
collected for the purpose of preventing crimes (i.e. no
passport images etc.)
FINLAND:
FACIAL
RECOGNITION

22. RUMORS FROM
THE EU

23. CONCLUSIONS

24. No specific legislation (yet)
Several possible legal
viewpoints
Privacy is a key factor
Biometric data: is there
identification?
Law enforcement: national
laws
Future developments still
open

25. IDA KOSKINEN
ida.koskinen@merkuriuslaw.fi
040 840 9250
Merkurius Attorneys Ltd
Keskustori 5 | 33100 Tampere, Finland
050 571 7327
office@merkuriuslaw.fi
www.merkuriuslaw.fi