Tackling video DSARs in the transport sector: a simple guide using Secure Redact
In the transport sector, video recordings play a critical role in ensuring safety and security. Typical video incidents may include:
Crime, vandalism, and public altercations: video evidence may be requested for legal proceedings or investigations.
Accidents: footage may be used to assess incidents and determine liability.
Insurance claims: videos can support claims by providing factual evidence of events.
With the increasing awareness of data subject rights under GDPR, handling Data Subject Access Requests (DSARs) within the mandated 30 days has become a significant task across the transport sector.
Emerging challenges across the transport industry
Managing DSARs in the transport industry is becoming increasingly complex due to several factors. For one, there are now far more ways that visual data is collected across networks: across CCTV, body-worn, and dashboard cameras, and the list continues to grow. As many of these cameras are not fixed, they capture extensive, dynamic data sets, further complicating managing DSARs.
For example, London United Busways operate 1,100 bus routes across London, all equipped with anywhere between 8-20 internal and external cameras. This extensive coverage means that an individual can be captured multiple times across different camera streams during the same journey.
Similarly, train operators have multiple cameras across platforms, car parks, stations, and trains. Visual data of both commuters and workers is collected across numerous points. Additionally, the increase in high-way surveillance to monitor traffic and enforce rules (e.g. ULEZ cameras across London) means more sensitive data such as license plates and faces, is collected across roads.
Facial Recognition Technology (FRT) and Automated Number Plate Recognition (ANPR) are also now commonplace across various transport networks, capturing extensive data daily. This integration into the transport infrastructure means that more data is being collected, but it is also more granular and sensitive. For example, FRT can track an individual's movements across multiple locations, while ANPR can monitor vehicle movements in detail. Each piece of data potentially contains personally identifiable information which, if mishandled, could lead to severe privacy breaches.
Handling DSARs amidst increasing data complexity
In the UK, the Data Protection Act 2018 and UK GDPR provide stringent guidelines for handling personal data, including video footage. The Network and Information Systems Regulations 2018 also call for robust cybersecurity measures to protect infrastructure and data integrity of network and information systems critical for providing essential services - including transport. Similarly, in the US, The Department of Transportation and the Department of Homeland Security outline risk and management frameworks and practices.
Transport companies often need help with the scale of data and the need to redact sensitive information, constrained by resources, time, and suitable privacy-enhancing tools. For example, major train providers like C2C Rail have found themselves overwhelmed with the scale of data to redact and stringent requirements for data protection.
Having proper systems in place to manage DSARs is not just a legal obligation but also a way to build trust with the public.
Our platform, Secure Redact, offers advanced object recognition and tracking, making it an ideal solution for complex environments like railways, buses, and tubes where multiple subjects may be present. The platform ensures redactions are precise and consistent, anonymizing license plates, faces and other sensitive data at the click of a button.
How to complete a Transport CCTV DSAR with Secure Redact
To help streamline your DSAR management process, here is a step-by-step guide to handling video DSARs using Secure Redact:
Step 1: Log the request
Record the DSAR in your system and notify relevant departments, e.g. security and operations. Note the time and date to ensure you meet the 30-day deadline.
Step 2: Verify identity
Verify the identity of the requester. Check the provided ID and, if applicable, verify the authority for third-party requests.
Step 3: Locate the footage
Retrieve the relevant video footage by identifying the date, time, and location. This data may need to be pulled from different surveillance sources, depending on the request, e.g. CCTV and body-worn cameras (BWCs).
Step 4: Upload to Secure Redact
Upload the identified footage to Secure Redact. Our platform supports easy sign-up and API integrations for seamless uploading. If working across a team, our Enterprise account allows multiple users to work on different projects to ensure easy collaboration.
Step 7: Download redacted video
Download the redacted video once it meets all privacy requirements.
Step 5: Automated redaction
Secure Redact will automatically detect and anonymize faces, license plates, and other personal data. This step ensures that third-party information is protected.
Step 8: Respond to the requester
Provide the requester with the redacted video. Ensure your response includes any necessary explanations for partial or non-disclosure.
Step 6: Review and tailor the redaction to your specific needs
Carefully review the automatic redactions. Ensure that all personal data except the requester’s has been anonymized. Uncheck tracks where the requester appears to ensure their visibility in the final video.
Step 9: Close the request
Inform the requester of the completion of their DSAR. Log the request as complete, noting any relevant details for future reference.
Our platform, Secure Redact, offers advanced object detection, tracking and redaction - the ideal solution for complex environments like railways, buses, and tubes where multiple subjects may be present. The platform ensures redactions are precise and consistent, anonymizing license plates, faces and other sensitive data at the click of a button.