Block 6. Privacy and Compliance

1

Privacy by Design for Surveillance: The Overview

Why surveillance is a privacy product by default: data minimisation, the biometric gate (GDPR Art. 9), the DPIA, and the posture a serious system takes.

2

GDPR for Video Surveillance

How GDPR governs CCTV: the lawful basis and legitimate-interests test, the Article 9 biometric gate, signage, data-subject rights, retention, and DPIAs.

3

BIPA and US Biometric Privacy Law

How US biometric law governs surveillance: Illinois BIPA's private right of action, Texas CUBI and Washington, the consent gate, and per-person damages.

4

Consent and Notice for Surveillance and Biometrics

When does surveillance need consent, and when is a sign enough? How notice and consent differ under GDPR and BIPA — and why a CCTV sign is never consent.

5

Face Masking, Redaction, and Privacy-Preserving Analytics

Masking, redaction, and privacy-preserving analytics for video surveillance — why a reversible blur is pseudonymisation, not anonymisation, under GDPR.

6

Regional Regulation: A Map of Where the Rules Differ

How surveillance and biometric privacy laws differ by region — EU, UK, US states, China, and more — and how a cross-border product complies.

7

Retention Limits and Lawful Deletion

How long you can keep surveillance footage, the GDPR and BIPA retention limits, and how to delete video lawfully so it is provably and permanently gone.

8

The Surveillance Compliance Checklist

The ordered pre-deployment surveillance compliance checklist — lawful basis, DPIA, notice, the biometric gate, retention, access control, and rights.