A sequence containing people is personal data before it is a corpus. That qualification precedes any technical consideration and it bounds what a project may do, where it may do it and for how long.
This article sets out that framework from the annotation point of view. It extends the article on occlusions and re-identification.
What makes a sequence personal
Four elements make a person identifiable in a video annotation corpus. The first alone is the one people think of. The face, the obvious criterion and the one most often handled. Distinctive attributes, silhouette, gait, a remarkable garment or a carried object. Context, a person filmed outside their home or workplace staying identifiable without their face. And ancillary elements, a number plate, a badge or a visible screen carrying information. One important practical consequence follows. Those four elements mean blurring faces does not make a sequence anonymous, which distinguishes pseudonymisation from anonymisation and entirely changes the regime applying to a video annotation project.Pseudonymising and anonymising
This legal distinction governs everything else. Pseudonymised data remains personal data, re-identification staying possible by reasonable means. Anonymised data ceases to be personal, re-identification no longer being possible by any reasonable means. Three consequences follow. Blurring generally belongs to the first category, the person staying recognisable to those who know them or by cross-referencing. The regulation’s full regime applies to pseudonymised data, purpose, retention and individual rights included. And genuine anonymisation is difficult in video, movement and context carrying part of the identifiability. One important observation follows. This distinction is regularly conflated in specifications, a client requesting anonymisation and obtaining pseudonymisation, which leaves a project under a regime it believed it had left.Purpose as a boundary
This requirement precedes every other in video annotation. It determines the annotation scope. The processing must pursue a specified, explicit and legitimate purpose. Three consequences follow for a video annotation project. What may be annotated is bounded by that purpose, an attribute unconnected to it having no basis for collection. A different later use presupposes a compatibility assessment, a corpus built for one purpose not automatically serving another. And the purpose must be established before processing, which precludes collecting first and deciding afterwards. One practical consequence follows. The first consequence is the one that touches annotation directly, a nomenclature having to be justifiable by the purpose rather than by what is describable.Minimisation applied to annotation
This principle translates directly into scope decisions. Only the data necessary to the purpose may be processed. Four concrete applications follow in video annotation. Restricting the zones handled, a camera covering a public way and windows having to exclude the latter. Reducing the rate retained, a flow measurement not requiring every frame. Limiting the annotated attributes to those the decision exploits. And deleting sequences of no interest rather than keeping them as a precaution. One important observation follows. Those four applications reduce the project’s cost at the same time as they satisfy an obligation, a rare convergence that makes this argument commercially comfortable in video annotation.Anonymising before or after
This sequencing choice has practical and legal consequences. Three configurations exist in practice. Anonymisation before annotation, which limits annotators’ exposure and degrades the data they see. Anonymisation after annotation, which preserves the quality of the work and exposes annotators to identifying data. And no anonymisation, framed by a legal basis and reinforced organisational measures. One important practical consequence follows. The first configuration is preferable and it produces a known difficulty, blurring removing a re-identification cue and making tracking harder, which requires anticipating it in the costing rather than discovering it in production.The anonymisation techniques
Four approaches occur in video annotation, and their robustness differs markedly. Zone blurring, which masks the face or the plate and leaves the rest intact. Replacement by a synthetic face, which preserves the scene’s plausibility and removes the identity. Silhouetting, which replaces the person with a uniform shape and destroys part of the useful information. And targeted resolution reduction, which lowers detail below the identification threshold. Three criteria permit arbitrating in video annotation. The information kept for the task, posture recognition surviving a face blur and not a silhouetting. Robustness to re-identification, a blurred zone sometimes being reconstructible. And temporal stability, a treatment applied frame by frame producing a flicker that hinders tracking. One important observation follows. The third criterion is specific to video and often neglected, an unstable blur making a track harder to follow than the original image, which adds a difficulty anonymisation was supposed not to create.What the processing location commits
This organisational question has direct legal consequences. A transfer of personal data outside the European area calls for a specific framework. Four elements compose that framework. The transfer mechanism adopted, an adequacy decision or standard contractual clauses. The transfer impact assessment, which examines the recipient country’s legal context. Supplementary measures, encryption and access control notably. And documentation of the whole, which a supervisory authority may require. One observation follows for a video annotation project. This framework is practicable and it requires preparation, which makes it a provider selection criterion rather than an obstacle, a provider having already put it in place answering in days where another would need months.The organisational measures expected
Six provisions characterise a compliant treatment in video annotation. They concern production more than law. Named authorisation, a restricted number of people accessing the sequences. Access logging, each consultation being attributable to a person and a moment. No local copy, images staying on a controlled infrastructure. A confidentiality undertaking from those involved, formalised and not implicit. A controlled working environment, with no screen capture and no personal device. And documented deletion at the end, with proof rather than a declaration. One practical consequence follows. Those six provisions belong to a certified organisation rather than to a contractual undertaking, and they in practice exclude providers without a suitable infrastructure.Subcontracting and its obligations
A contractual relationship frames engaging a video annotation provider. The client stays the controller and the provider acts as processor. Five elements compose the corresponding contract. The subject and duration of the processing, with the categories of data and of people concerned. The obligation to act on documented instructions, which precludes any use of the data for the provider’s own ends. The security measures, described and not merely invoked. The regime for onward subcontracting, a provider not being able to engage another without authorisation. And the fate of the data at the end, return or deletion with proof. One practical consequence follows. The third element is what distinguishes providers, a precise and verifiable description of the measures being worth more than a general clause, and an informed client asks for it before contracting.The retention period
This obligation conflicts with a corpus’s value. Data may not be kept beyond the duration necessary to the purpose. Three consequences follow for a video annotation project. A corpus built for a one-off training is not kept indefinitely on the grounds that it might serve again. The duration must be fixed at the outset and documented, rather than left open. And prolonged retention presupposes either genuine anonymisation or a purpose that justifies it. One important observation follows. This tension is real and it argues for robust anonymisation rather than minimal blurring, the additional investment turning a perishable corpus into a retainable asset.What individual rights imply
Four rights apply, and their exercise on a video annotation corpus poses practical difficulties. The right to information, which presupposes signage or prior notice to the people filmed. The right of access, whose exercise presupposes finding the sequences concerning one person. The right to erasure, which presupposes being able to delete those sequences and the associated annotations. And the right to object, whose scope depends on the legal basis adopted. One practical consequence follows. The second and third rights presuppose a capacity to search by person within the corpus, a capacity few arrangements provide and whose absence makes a request hard to honour.What anonymisation changes in the corpus
Four technical effects accompany this operation and they can be costed. Re-identification after occlusion degrades, the face being a continuity cue blurring removes. Some tasks become impossible, gaze direction and expression disappearing with the face. The treatment’s flicker introduces an appearance variation that did not exist in the source. And training happens on anonymised images, which presupposes that the deployed system works on images treated the same way. One important practical consequence follows for a video annotation project. The last effect is the most structuring and the least anticipated, a model trained on blurred faces and deployed on raw images meeting a distribution it has never seen, which requires applying the same treatment in production or abandoning that configuration.Data beyond people
One category escapes the regulation and nonetheless calls for protection. An industrial or commercial sequence contains information whose disclosure would harm the client. Four examples illustrate it clearly. A manufacturing process visible on a production line. A warehouse layout revealing a logistical organisation. A prototype or a product not yet on sale. And activity volumes deducible from a count. One observation follows for a video annotation provider. These sequences call for the same organisational measures as personal data without falling under the same framework, which means the arrangement built for compliance also serves industrial confidentiality, and makes that investment doubly profitable.The relation to the AI regulation
A second framework is added and it concerns different requirements. Where the first protects the people filmed, the second frames the systems built on that data. Three requirements concern a video annotation corpus directly. The quality and representativeness of datasets for high-risk systems. Examination of possible biases, which presupposes documenting the corpus composition. And traceability, which presupposes retaining the description of the training data. One important observation follows for a video annotation project. Those three requirements match exactly the documentation practices the preceding articles recommended for reuse reasons, which means a provider already applying them finds themselves compliant with no adaptation effort.What stays forbidden or strictly framed
Four treatments call for particular vigilance in video annotation. Remote biometric identification, whose use in public space is heavily restricted. Biometric categorisation founded on sensitive characteristics. Emotion recognition in certain contexts, work and education notably. And individual tracking between cameras, which constructs a path and changes the nature of the processing. One practical consequence follows. Those four treatments must be identified at scoping, a project containing them unknowingly committing its client and its provider on ground neither has examined.Documenting compliance
Five documents constitute the required record and they are produced during the project. The description of the processing, purpose, categories of data and duration. The processing contract, with the security measures described. The description of the anonymisation process and of when it is applied. The access logs, retained for a fixed period. And the deletion certificate at the end, dated and signed. One important observation follows for a video annotation project. Those five documents are produced as the project runs and cannot be reconstituted afterwards, which places them in the same category as the annotation conventions, and makes their absence an irreparable defect rather than a delay.What compliance costs
Four lines are added to a project under these constraints. The anonymisation processing, a distinct line preceding annotation and costed by volume. The controlled infrastructure, whose cost is in setup and spreads across several projects. The annotation surcharge from the degradation, re-identification becoming harder on treated images. And documentation, a few hours spread over the project’s duration. One practical consequence follows for a video annotation project. The second line is the only significant one and it does not repeat, which makes a first compliant project more expensive than the following ones and makes that investment a barrier to entry rather than a recurring charge.Bringing a request into the simplest regime
Four reformulations reduce the constraint without reducing the usefulness and they are proposed at scoping. Replacing an identification with a count where the decision concerns a volume. Replacing individual tracking with a flow measurement where the decision concerns circulation. Restricting the field handled to the zones the purpose concerns. And abandoning the attributes the decision does not exploit. One observation follows for a video annotation provider. Those four reformulations simultaneously reduce the cost, the risk and the time to compliance, which makes them the most useful proposal a provider can make when scoping a sensitive project.The questions a client should be able to ask
Six questions permit assessing a provider on this ground and they require no legal competence. Where are the sequences physically stored and processed. Who accesses the images and how is that access traced. Can annotators download or capture an image. At what point does anonymisation occur in the chain. What proof of deletion will be supplied at the end. And is onward subcontracting contemplated and to whom. One observation follows. Those six questions are asked in five minutes, a precise answer to each characterises a prepared organisation, and an evasive answer to the third or the sixth signals an arrangement the contract will not repair.Approaching the compliance of a video project
Five questions scope the compliance of a video annotation project. The first precedes all the others. What purpose is declared. That answer bounds the annotation scope. Are the sequences anonymised or pseudonymised. That answer determines the applicable regime. Does anonymisation happen before annotation. A negative answer exposes the annotators. May processing take place outside the European area. That answer conditions how production is organised. And what retention period is planned. Its absence leaves an obligation unmet. Those five answers determine the legal feasibility. Asking them before starting avoids a corpus technically complete and legally unusable.The question to ask first
One question determines the applicable regime before any technical discussion. Can a person be recognised in the sequences, by any means whatever. A negative answer, established and documented, places the project outside the regulation’s scope and removes most of the constraints set out. A positive answer, including after blurring, maintains the full regime and requires each question in this chapter to be addressed. That question is asked before the technical scoping, it calls for an honest examination rather than a reassuring answer, and an error at that stage propagates to every subsequent decision.Three decisions before the first frame
Three decisions condition a project’s compliance and they cannot be recovered. Writing the purpose, which bounds the annotation scope and without which nothing justifies what is collected. Fixing when anonymisation happens, placed before annotation in the chain rather than after. And settling the retention period, whose absence leaves an open obligation the project’s closure does not close. Those three decisions cost one meeting, they precede any acquisition, and their absence produces a project whose technical value does not compensate for its legal unusability.What this chapter teaches
One cross-cutting observation deserves closing this examination. Legal obligations and good annotation practice converge more than they conflict. Three findings compose it. Minimisation reduces the scope and therefore the cost, which makes an obligation coincide with a saving lever. The documentation required for traceability matches what reusing a corpus requires. And the organisational measures expected are those a serious production puts in place independently of any obligation. That finding matches the one the preceding series established in other regulated domains: an external constraint formalises practices that were already rational, and a provider having adopted them by method finds themselves compliant with no transition.A note on scope and on advice
One qualification belongs at the close of a chapter of this kind. What precedes describes how these obligations shape an annotation project, not what the law requires in a given case. Three reasons make that distinction worth stating. The regime varies with the sector, the country and the nature of the deployment, and a general account cannot settle a particular situation. Supervisory practice evolves, guidance and decisions refining what a text leaves open. And the assessment of whether a person can be recognised is a judgement about a specific corpus rather than a rule that can be stated in advance. One practical consequence follows for a video annotation project. A provider’s role is to raise these questions at scoping and to build an arrangement that answers them, not to give the legal assessment, which belongs to the client’s own counsel and is better sought before the corpus exists than after.Common mistakes
These failures recur often enough that naming them is usually enough to avoid them.- Conflating pseudonymisation and anonymisation in a specification.
- Assuming that blurring faces makes a sequence anonymous.
- Starting annotation before the declared purpose is established.
- Anonymising after annotation rather than before.
- Annotating attributes unconnected to the purpose pursued.
- Neglecting number plates, which are personal data.
- Omitting to fix a retention period at the outset.
- Not providing a capacity to search by person within the corpus.
- Treating cross-camera tracking as a technical extension with no legal examination.
- Discovering the processing location question after committing to production.
