Definition
An image in which a person can be recognised is personal data, so video monitoring falls under data protection law. Vision analytics does not change that principle, but its scope and processing method affect the risk assessment and the employer's obligations.
What changes without identification
A system recognising events without establishing identity processes images but does not build profiles of specific people. That materially lowers the risk to employees' rights and simplifies the impact assessment.
It does not mean the rules stop applying. The image still allows a person to be recognised, so the legal basis, retention period and access scope must be defined just the same.
The duties that remain
Informing employees about the monitoring and its scope, marking the area, defining the purpose and retention period, restricting access to the material, and the internal agreements required by employment rules.
Where behaviour is analysed it is worth deciding up front whether the data may be used to assess an employee. Separating prevention from discipline is often a condition of the crew accepting the system.
Frequently asked questions
Is employee consent required?
Consent is usually not the appropriate legal basis in an employment relationship. The basis and scope should be settled with the person responsible for data protection.
How long may recordings be kept?
As long as the stated purpose requires. For event analysis a short retention of evidence usually suffices, rather than continuous recording of everything.
Is facial recognition allowed?
It is a separate processing category subject to considerably stricter requirements. Workplace safety systems usually do not need it.