So your motor insurer is offering you a discount on your policy if you'll install a dash cam in your vehicle. This is great, right?
Well, apart from the fact that no normal human has any idea how insurance companies calculate their annual premium and could probably not tell if they were getting a "discount" anyway, the Data Protection Commission has issued guidance on dash cameras that might make some people think twice.
The regulator has said that people need to be aware that if they have such a device, they are “processing personal data”. Because the cameras are capturing footage from public areas involving the personal data of other people, dash cam users/owners are what is known as “data controllers”.
What does this mean?
It means you, as a motorist, are controlling the processing of people's personal data, such as images of identifiable individuals and their cars, and the purpose for which that personal data is processed.
The DPC says insurance companies incentivising the use of the cameras may find themselves to be “joint controllers” in relation to the footage and its use.
Did the insurers consider this before they started offering discounts?
There's a chance they did not.
Under EU law, any company planning to incentivise such a scheme should probably also have conducted what is known as a “data protection impact assessment” because the scheme involves their customers monitoring public areas on a large scale.
But if I take photos of people that doesn't make me a data controller?
Not typically, where they are for your own domestic purposes and for sharing with friends and family. This is known in EU law as the "domestic" or "household" exemption for processing personal data.
But the EU'S highest court, the Court of Justice of the European Union, has ruled in the case of a man named Rynes in the Czech Republic, who installed CCTV outside his home to deter break-ins, that he was not allowed to avail of this domestic exemption in the law. This was because his camera was not only capturing footage of his own property, but it was also capturing footage of the public roadway outside it.
What if I put footage from my dash cam on YouTube or another social media site?
The DPC says that if someone is using a dash cam for security or accident liability purposes, they should be aware that the publication of footage, for example on social media platforms, risks infringing the privacy rights of recorded individuals, and data protection law.
“Publication of personal data can be justified in certain circumstances for journalistic purposes but this must be carefully balanced with the privacy rights of the individuals concerned,” it says.
What does the DPC mean when it says I should put up signage telling people I'm recording?
Yes, it does sound a little impractical, doesn't it? And if you're travelling at 120km/h on a motorway nobody will be able to read your signs anyway unless you paint them on the side of your car.
But the DPC says personal data, which includes any images and audio captured by such cameras, must be processed “in a transparent manner”.
What does transparent mean?
Transparent is, well, transparent. There's a whole list of information in the General Data Protection Regulation that data controllers are required to provide to demonstrate they are being transparent about what they are doing.
So what should I do?
In the first instance, there should be a "clearly visible sign or sticker on and/or inside the vehicle, as applicable, to indicate that filming is taking place".
The DPC says drivers should have “a policy sheet detailing your contact details, the basis on which you are collecting the images and audio of others, the purposes of use of the data and how long you will retain it for”. (Think, for example, about whether there is any need to keep footage for weeks if you have not been involved in any incident.)
Crucially, the DPC says that before entering into an arrangement with an insurer to use a dash cam “you should ask them to outline their policies in relation to the personal data that you will record, and what responsibilities they will have as data controllers”.
Does this guidance apply to cyclists with helmet cameras?
The DPC guidance doesn't mention them, but it almost certainly does, yes.
What about taxi drivers?
Taxi drivers using cameras in their cars are also data controllers and they should definitely have prominent signage warning passengers about them and a written policy on their use.
Do I have to give people who request it a copy of my footage?
The DPC says that if it contains their personal data, yes you do.
This could cause some rows, couldn't it?
Yes.
What happens if someone makes a complaint about my recording to the DPC?
The regulator says if it receives a complaint from an individual in relation to a driver operating a dash cam, where for example the driver has refused to give access to the images when requested, or refused to give information about why they were collecting the data, it will "look into the issue".
“Where the DPC identifies infringements of data protection law in any sector or scenario, it has powers to sanction including to apply large administrative fines,” it says.
How much are these fines?
Under EU law the highest possible fines are up to €20 million, in circumstances where a data controller breaches someone's data protection rights.
It’s safe to say no individual is every going to face such a gigantic fine in relation to their use of a camera or a dash cam.
But in theory, road users could face fines if they breach data protection law?
Yes.
Could they appeal these?
Such fines would have to be confirmed by the Circuit Court after they were imposed. There is also the possibility of appealing a decision of the DPC in court. This is a whole new area of law in this State, so it remains to be seen how fines will play out.
Is this more Liveline-style "GDPR gone mad" stuff?
No. Technology is great. But it moves quickly and it now has almost infinite possibilities in terms of the damage the personal data it collects could potentially cause to individuals. And it's the law.
Some might say the DPC's guidance is aimed more at the insurers than it is at ordinary motorists and other road users?
You might say that. We could not possibly comment.