Legal aspects of CCTV data de-identification

Abstract

The paper aims at identifying and investigating legal issues surrounding de-identification of data streams generated by CCTV applications. As a basis for further discussions, the exact subject-matter of legal protection afforded to data (images and sounds) resulting from CCTV operations is pinpointed. Thereafter, legal consequences of de-identification are established. In connection with that, delineation of and delimitation between the terms ‘de-identification’ and ‘anonymization’ is carried out. Moreover, the legal relevance of de-identification’s irreversibility is explored, along with technological and legal requirements that the irreversible de-identification must meet, the associated risks and the examples of failed (supposedly irreversible) de-identification exercises from the past. Correspondingly, lessons for the future are drawn and recommendations for rendering de-identification efforts legally compliant are put forward.