Internet of Things Stack Exchange is a question and answer site for builders and users of networked sensors and control devices in the contexts of smart homes, industry automation, or environmental sensors. It only takes a minute to sign up.
Sign up to join this community
I recently came across the EU General Data Protection Regulation (GDPR) meant for data privacy regulation. The final Version of GDPR was released December/2015.
Any surveillance camera or devices that are known to be fully GDPR compliant? Are there compliance/certification programs that have been derived out of the EUGDPR guideline?
I am not able to understand how the EU may be planning to ensure/enforce GDPR is being taken for the devices being sold?
Adding to Simon's answer, the GDPR is more about processes than IT systems if you look at it in more detail. Sure, there are some technical things in there (mostly encryption and pseudonymization) but for the bigger part it dictates what you are allowed to do with data at all. Keep in mind for everything following, that I'm not a lawyer—just someone who's some experience making his stuff GDPR ready.
TL;DR: Devices itself cannot be compliant or non-compliant on themselves. Cameras can be tricky though. Regarding your certification question, the answer seems to be not yet.
First of all it defines a specific opt-in mechanism for customer's data. This means as data processing legal entity you'll need to keep a record of the customer giving that consent and that consent has to specify which data you'll use and what purposes you are using it for. See Wiki sections 2.4 & 2.5.
Secondly it gives the user the expressed right to get all the data that the company has stored about him or her. That means every data in every system that can be tied to the specific user has to be provided. You can imagine that in bigger companies where all sorts of systems hold data that's somehow connected to a user that is kind of a hassle. I guess Netflix has some fun with that if you look at their systems:
The following articles go on to give the right to rectify incorrect data and erase it completely—of course only if no other law requires you to keep the data (e.g. tax or auditing laws for bills).
Of course, there are tons of pitfalls in the other forty-something articles of the first fifty that define your responsibilities and consumer rights that I haven't even mentioned. Like not being able to put the data anywhere where the EU standards aren't met—which if you read the thing seems to be everywhere, certainly not the US.
Another interesting thing that might affect a device is article 32—"security of processing"—which is a bit fuzzy but if your camera is in front of a medical building it might be argued that you need end-to-end encryption with encryption of all data at rest on the camera too.
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:
(a) the pseudonymisation and encryption of personal data;
(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
(c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
(d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
Since after EU law the picture of a person is (thankfully) considered personal data you are likely required to either pseudonymize or encrypt the pictures or video.
I haven't been able to find any that are based on the regulation itself. There's of course a bunch of people who sell you GDPR-sounding "certifications" but none (that I could find) seem to fulfill the requirements of the regulation as of today.
Taking into account the ...... ... ... .. ... (sic) The lawyers are going to have a field day. At least the guys in my company who are doing internal consulting on GDPR for the devs etc. are looking at the coming months with interest, and are having their hands full. That said, for cameras, surely putting the camera into a locked box together with its router acting as a VPN endpoint, or using a WIFI/cell camera with integrated VPN should be pretty easy and sufficient.
It's not possible to make any device GDPR compliant, as it is the rest of the system that is responsible for complying with GDPR.
A camera could, or couldn't, marketed as GDPR compliant, but it makes little difference either way. A camera could be connected to a system that deletes data within seconds (as may be used for people counting) and is therefore fairly simple to be GDPR compliant. The exact same camera could be used in a system that does facial recognition and shares the data with other systems, which may never be GDPR compliant.
Would a PC manufacturer, such as Dell, ever say that a laptop is GDPR compliant? If you use that laptop to login to Facebook, GDPR is a Facebook problem, not a Dell one.
You need to look at the entire system, GDPR is not solely a devices problem.
You may want to get a device supplier to attest that they are not sending any data elsewhere, as they may send data to their own services for diagnostics or logging. That probably is important in GDPR, but is also important and necessary for security and privacy in general.
Don't make any assumptions, and be careful with advice from strangers on the Internet. If it is critical, seek professional legal advice. For example, although I aggressively promote device security, end-to-end encryption may not be required under GDPR. 'Appropriate technical measures' may not extend to the costly (in terms of processors, battery, etc) provision of end-to-end encryption on a private network. For websites, yes, add SSL, even if it is not needed, the cost is negligible. Devices are more complex. As you suggest, certifiable devices may not exist, so is it appropriate for you to build a custom device, just to satisfy an unclear GDPR requirement?
