Video analytics and data protection: applying privacy by design

Why privacy belongs in the design phase

Privacy by design means building data protection into the technical choices of a project from the outset, rather than bolting on fixes afterwards. It is especially relevant to video analytics: cameras inevitably capture images of people, while most business questions are about flows, durations and occupancy.

The good news is that the goals of video analytics and data protection often point in the same direction. To know when the queue gets long or how many tables are taken, you do not need to know who anyone is. A well-designed project can deliver useful indicators while greatly reducing exposure of personal data.

This article sets out the principles we apply. It is not legal advice: in Morocco, Law 09-08 and the guidance published by the CNDP remain the reference, and your legal adviser is the right person to consult.

Aggregated indicators, not individual data

The first principle is to define exactly what the system should produce. In the vast majority of cases, that means aggregated results: entries per hour, average occupancy, median waiting time, alerts per zone.

In practice, privacy-friendly analysis relies on detecting human shapes or vehicles, without trying to recognise faces or identify individuals. Any temporary IDs used to follow movement across a camera's field of view are not meant to be stored or linked to an identity. VIDEO.MA does not offer facial recognition or biometric identification.

This has a practical consequence: the question "what does the dashboard contain?" should have a simple, documented answer, for example counts and durations by zone and time slot, with no images and no names.

On-site processing and image minimisation

The second principle is to keep images from travelling. With an Edge AI architecture, video streams are analysed on a unit installed on site, close to the cameras. Only the results, meaning numbers and events, are sent to the dashboard.

This reduces the number of places where images exist, and with it the risk of unauthorised access or leaks. In most cases it also avoids transferring images off site, or outside Morocco, which could trigger specific formalities. Minimisation applies to configuration too:

• only analyse the cameras needed for the defined purpose;
• use a stream resolution suited to the task, without oversizing;
• do not record additional footage for analytics purposes unless it is genuinely needed;
• if clips are needed to validate accuracy during a pilot, keep their number, retention period and the people who can access them to a minimum.

Privacy masks and minimal retention

Privacy masks exclude irrelevant parts of the scene from analysis, or from the image altogether: the street, neighbouring shopfronts, fixed workstations, screens showing confidential information. They are configured camera by camera and should be reviewed whenever a camera is moved or the layout changes.

Private spaces such as toilets, changing rooms and staff rest areas must never be filmed. That is not a setting; it is a rule.

On retention, two kinds of data need to be kept apart. CCTV footage, where it is recorded, is kept for a period set by the data controller, limited to what is strictly necessary and enforced by automatic deletion. Aggregated indicators, which cannot identify anyone, can be kept longer for trend analysis, as long as they remain aggregated.

Access control and logging

A system that looks sound on paper can be undermined by careless access management. The basics are well known but need to be applied consistently:

• change default credentials on cameras, recorders and edge units, and keep firmware up to date;
• separate the video network from the rest of the corporate network, for example with a dedicated VLAN;
• assign role-based permissions: a store manager sees their own indicators, an administrator manages configuration, and very few people can access footage;
• log logins and views, and review the list of active accounts regularly;
• encrypt communications between the site and the dashboard.

What a solution cannot do on the data controller's behalf

Privacy-conscious technology makes compliance easier, but it cannot guarantee it on its own. The business that decides to deploy cameras and sets their purposes is the data controller. It is up to that business to define and document the purposes, complete the applicable CNDP formalities, inform customers, visitors and staff through appropriate signage, set retention periods and handle requests from people exercising their rights.

The provider, for its part, must implement the agreed security measures and act within the scope set by its client, which the contract should spell out. At VIDEO.MA, we document for each project the cameras used, the masked zones, the data produced and the planned access rights, so our clients have what they need for their own compliance work.

Privacy by design is also not a one-off exercise. Layouts change, cameras get moved, new purposes are suggested, new users ask for access. A short periodic review, checking masks, active accounts, retention settings and whether each analysis still matches a documented purpose, keeps the system aligned with what was originally decided and declared.

To find out more, see our Video surveillance & data protection page and our Technology page, or get in touch to review your project from this angle as part of the feasibility study.