Is this the end for helmetcam footage? Right to privacy outweighs recording journeys in case of collision says EU data watchdog

Concerns over individuals’ right to privacy outweigh capturing footage by dashcam or helmet camera to provide evidence in the event of a road traffic collision, according to the independent body set up by the European Union last year to police the General Data Protection Regulation (GDPR).

That’s one of the draft guidelines adopted last week by the European Data Protection Board (EDPB) after it examined the “intensive use of video devices” whether for surveillance, marketing, monitoring employee performance or other purposes, warning that “data protection implications are massive.”

But writing on Twitter yesterday, Neil Brown, a telecoms, tech and internet lawyer who runs the law firm Decode Legal, warned that guidelines have profound implications for people using dashcams or action cameras, which have become hugely popular in recent years.

He wrote: “Got a dashcam or helmet cam, to collect evidence in case of an accident? According to new (draft) guidance, you must ensure it is “not constantly recording”. You also need to tell everyone who gets recorded that you are doing so. Good luck.”

Got a dashcam or helmet cam, to collect evidence in case of an accident?

According to new (draft) guidance, you must ensure it is “not constantly recording”.

You also need to tell everyone who gets recorded that you are doing so.

Good luck.https://t.co/w9hyzUxEwG pic.twitter.com/So7nq1pdpz

— Neil Brown (@neil_neilzone) July 16, 2019

He added to his tweet a screenshot of the following example given in the EDPB’s Guidelines 3/2019 on processing of personal data through video devices, adopted on 10 July 2019 and published as a “Version for public consultation.”

Example: If a dash cam is installed (eg for the purpose of collecting evidence in case of an accident), it is important to ensure that this camera is not constantly recording traffic, as well as persons who are near a road. Otherwise the interest in having video recordings as evidence in the more theoretical case of a road accident cannot justify this serious interference with data subject’s rights.

Helmet and handlebar mounted cameras have proven hugely popular with cyclists in recent years and often used not only to ensure that footage is captured in the event of a collision, but also to highlight instances of poor driving such as close passes, as our Near Miss of the Day series attests.

A number of police forces are willing to accept such video footage and often take action against the driver concerned including referring the case to prosecutors if deemed appropriate.

The EDPB is inviting comments on its draft guidelines, and its consultation is open until 9 September 2019.

While the draft guidelines do not have the force of law in themselves, the EDPB says they are designed to “clarify how the GDPR applies to the processing of personal data when using video devices and aim to ensure the consistent application of the GDPR in this regard.”

In other words, the draft guidelines are designed to sit alongside the GDPR, and if not adhered to could perhaps give rise to a legal challenge about the admissibility of evidence gathered on video by a private individual.

With the Metropolitan Police, for example, requiring that video evidence of, say, a close pass, show the recording from two minutes before to two minutes after the incident, would that fall foul of the stipulation not to record continuously, as well as failing to obtain consent from any people who could be identified in the footage (whether the alleged perpetrator or a passing pedestrian, for example)?

Likewise, there are strict guidelines on the use of and positioning of CCTV cameras.

Take the recent Swain’s Lane hit and run case, where a cyclist left seriously injured managed to track down footage of the incident and presented it to police, resulting in a successful prosecution; the camera angle, with the collision happening across the road from the premises the CCTV was protecting, appears to go beyond what is permitted by the guidelines. See the following example from the draft guidelines.

Example: A bookshop wants to protect its premises against vandalism. In general, cameras should only be filming the premises itself because it is not necessary to watch neighbouring premises or public areas in the surrounding of the bookshop premises for that purpose.

Ultimately, of course, the implications for people in the UK may depend on what happens with Brexit.

However, according to UK regulator the Information Commissioner’s Office (ICO), “As a European Regulation, [the GDPR] has direct effect in UK law and automatically applies in the UK until we leave the EU (or until the end of any agreed transition period, if we leave with a deal). After this date, it will form part of UK law under the European Union (Withdrawal) Act 2018, with some technical changes to make it work effectively in a UK context.”

The ICO adds that the Data Protection Act 2018, which like the GDPR came into effect on 25 May 2018 and replaced the Data Protection Act 1998, “sits alongside the GDPR, and tailors how the GDPR applies in the UK - for example by providing exemptions.

“It also sets out separate data protection rules for law enforcement authorities, extends data protection to some other areas such as national security and defence, and sets out the Information Commissioner’s functions and powers.”

Under the draft guidelines, uploading a video to the internet without obtaining the subject’s consent is also beyond the scope of what is permitted under the GDPR.

The draft guidelines do contain, however, a “household exemption,” giving the following example, among others.

Example: A downhill mountainbiker wants to record her descent with an actioncam. She is riding in a remote area and only plans to use the recordings for her personal entertainment at home. This would fall under the household exemption.

No need for every cyclist to consign their action camera to the attic just yet, then …