Deploying smart technologies? Pay attention to privacy regulations!

All kinds of smart technology make it possible to collect and link a multitude of information. Think sensors and cameras as part of building maintenance and Wi-Fi tracking to map visitors. These kinds of techniques are being used more and more. But what about privacy regulations in this area?

When personal data is processed, it is subject to the General Data Protection Regulation (GDPR). This is often the case in the case of camera surveillance or Wi-Fi tracking. The processing of personal data is only permitted if there is a legal ground for doing so. In addition, it must always be considered whether the processing of personal data is necessary or whether less intrusive alternatives are also available to achieve the goal. Here a balance must be made between the interests in deploying a particular technique on the one hand and the interests of the persons involved on the other.

Camera surveillance

In the case of camera surveillance, individuals are almost naturally included in the picture. This means that personal data is being processed and the requirements of the AVG must be met. Cameras can, for example, be used to protect property or to map building maintenance. In that case, the basis of legitimate interest may possibly be invoked, provided that the deployment of cameras is actually necessary to serve this interest.

In addition, the interests of those who may be in view must be weighed against the interest in camera surveillance. For example, neighbors of business premises recently objected to the use of cameras. These cameras were partly aimed at the public road, so that neighborhood residents were in the picture several times a day. However, the Personal Data Authority ruled that the owner of the business premises was allowed to secure his property with cameras. According to the Personal Data Authority, the resulting infringement on the interests of local residents is not disproportionate. Of importance here is that the portion of the public road that was filmed was kept as limited as possible.

Wi-Fi tracking

In the case of Wi-Fi tracking, people are digitally tracked via their cell phone signal. This can be useful, for example, to see how many visitors are in a particular area, how long they stay and how often they come. Wi-Fi tracking often records data such as a phone's unique number, a serial number and a time of day. Using this data, it is possible to indirectly identify a person. Indeed, the data can be combined with each other, leading to a specific person. Only when the data have been anonymized to such an extent that the person can no longer be directly or indirectly identified, is it no longer personal data. If that is the case, the AVG does not apply.

The Personal Data Authority recently published standards that must be met in case digital tracking devices are deployed. It follows that Wi-Fi tracking is only allowed under strict conditions. For example, wifi tracking can be deployed if consent is given by those involved. However, this will often be difficult to achieve in practice. Another possibility is to use Wi-Fi tracking if there is a legitimate interest to do so. This basis can be invoked, for example, if WiFi tracking is used for security reasons. Even then, however, a balance of interests must be made and safeguards must be put in place to minimize the invasion of privacy.

Deploying smart techniques?

When personal data are processed by smart techniques, several requirements must be met. However, if sufficient attention is paid to this, there are all kinds of possibilities for using these techniques!