A customer walks into a supermarket. A camera captures their image, software counts visitors, and the system analyzes how long they spend in different areas. At an office, an employee looks at a terminal to clock in using facial recognition.
These applications can improve operations and user experiences. But when images are used to identify individuals, track behavior, or connect with customer profiles, the scope extends well beyond installing cameras.
Your business is managing an entire flow of personal data.
The same camera, different purposes**
Recording footage to protect assets, counting visitors, and recognizing returning customers involve different data processing requirements. Biometric recognition may also generate facial templates for identity matching, rather than simply storing video.
For example, if a supermarket only needs to identify peak hours to plan staffing, it should consider aggregated analytics that limit individual identification. It should also check whether the system retains original images or individual tracking identifiers.
A dashboard that displays only numbers does not, by itself, mean the entire system is anonymous.
A CCTV in Operatio sign does not answer every question
Knowing that they are being recorded does not mean customers have agreed to every form of analysis, advertising, or individual profiling.
In Vietnam, the use of camera data must be assessed against the specific processing purpose and applicable legal basis. Current regulations distinguish recording in certain permitted circumstances from using footage for commercial purposes, behavioral analysis, or automated facial recognition to create individual profiles.
Before enabling an additional AI feature, businesses should therefore reassess the data involved and the conditions governing its use.
Five steps to take before deployment
- Define the business need: Is the objective security, shorter queues, or access control? Select features and data collection levels accordingly.
- Trace the data flow: Are images processed on the device, on company servers, or in the cloud? What access do vendors and maintenance providers have?
- Be transparent with the people involved: Explain recording activities, processing purposes, and the contact point for requests. Establish a consent mechanism where required.
- Control data use: Separate permissions for live viewing, playback, downloading, and sharing. Log activities and revoke access when employees change roles.
- Manage the data lifecycle: Set retention periods for video, extracted images, and facial templates. Verify that deletion works in practice, including copies held by service providers.
These measures should form part of solution selection requirements and acceptance criteria from the outset. ICO guidance also emphasizes considering less intrusive alternatives and assessing whether surveillance is necessary and proportionate.
Metatek connects operational needs with personal data protection
Metatek helps businesses review AI camera use cases, map data flows, assess risks, and define controls suited to the solution.
The goal is to help organizations gain value from technology while maintaining clear oversight of customer and employee data.
