How To Comply With Privacy in Retail Businesses

Surveillance and Privacy Compliance

There are many benefits to having a surveillance system in retail business locations. The cameras deter crime, help catch thieves, protect the business and employees, build a level of trust for both consumers and employees alike and surveillance systems even lower the overall cost of insurance premiums. Today, most retail establishments have some surveillance equipment.

When making decisions regarding installing a new surveillance system, the first thing to address is a privacy compliance checklist. It is even recommended that a walk-through with a privacy specialist help with the placement of cameras, understanding video data, and developing comprehensive policies to protect consumer privacy.

Is Surveillance Right For You?

To help understand a variety of concerns, the following list of questions can help your company make the right decisions and protect your company’s valuable reputation.

• Is a surveillance system right for your business? There are many solutions to developing a secure retail establishment, and not all of them include a surveillance system. As a business owner or decision-maker, can you express how a surveillance system pertains to your business’s function and operation? When you can define the benefits of a surveillance system to the retail industry’s activities, can you show how the system will work to achieve your goals? If you believe that the system will protect your establishment as a form of security, can you define the locations that will benefit you? If only being used for protection, do you have other less expensive or even better security options? It may be reasonable to use a combination of security measures such as a camera system and a security guard better meet the needs of maintaining a safe establishment.
• During the installation of the security system, is it being installed in such a way that it will meet your needs? Security cameras have a wide variety of uses in retail. They can help improve the customer experience and assist with layouts and product placement. Are these features important to you, or is it merely a security measure? When installing the cameras, the arrangement of camera angles must be positioned to only record data that is relevant to the purposes for which the system will be used. Does the cameras’ position avoid any extra sensitive data such as angles that could include exterior businesses? It is also essential to determine the size and quality of the images required to meet the system’s purposes. Finding out this information first will help save the costs of installing the wrong type of camera and realizing the mistake later.
• How do you inform your customers that surveillance is on the premises? Typically, regulations require that signage be posted in a place where consumers can easily see it and read it. Signage should also make it clear who owns and operates the system. Do you provide easy access to the community to review footage that includes them? You must give the consumers and other citizens an easy way to find further information regarding how you handle personal information collected by your surveillance. If requested, you should allow access to footage that contains them for review. You should also be able to explain the policies regarding holding personal information as data.
• How will you manage to secure the data from your surveillance system? It is vital to develop safeguards that will protect the data in the footage that is stored. Video surveillance that contains PII can also be lost during a data breach. As a company, you are responsible for preventing the loss and are subject to heavy local, state, and federal privacy policies when a breach occurs. It is also necessary to have a standardized video editing policy before releasing any footage to a third party.
• How will storing data in the cloud impact data privacy? The first thing to understand is that regardless of where you store the data, you are the one responsible for it and will be financially on the line for legal penalties in the instance of a data breach. What are your video redacting (blurring) and editing policies before storing the data so that you will protect both consumer privacy and your company’s reputation? Where are the cloud servers located? Many cloud servers are located in various parts of the world in other countries. The privacy laws of that nation will impact your data and any other privacy laws that your company is legally required for compliance purposes.
• When to destroy video data. When video data is no longer needed for use by your organization, having strong policies regarding the disposal of such data is required to maintain protection against the risk of a data breach. When installing the surveillance system, it is necessary to decide how data will be saved and how it will be removed. Some surveillance footage is regularly overwritten, and the data is destroyed. When making these decisions regarding data retention and disposal, this policy must be communicated to the community and consumers. Also, be sure to share if asked how video data will be used and how it impacts compliance with local, state, federal, and even international privacy legislation.
• Policies regarding disclosure of data. When considering the policies and procedures for handling data from your cameras, when and how the data is released to third parties should be given specific release conditions. These policies can include detailed actions for law enforcement, FOIA or Freedom of Information Act requests, or other legal matters. Included in these decisions, you will need to set parameters regarding how individuals can request access to their images’ footage. You will need to make the information publicly available on how a consumer could ask for their data. It will also be necessary to provide documented disclosures regarding how your video footage is passed on to law enforcement agencies. A record of all disclosures should be kept.
• Outsourcing surveillance needs. There is always the option of having a third party or vendor handle all your video surveillance needs for you. This option may come with additional costs or a monthly service charge. It is critical to follow the above guidance, with signage of use and disclosure of information. Your company and the provider will need to set specific parameters for the protection and concealment of personally identifiable information contained in the video. There will also be guidelines set for any PII exchanged between your company and the service provider. While working over your new security details with a privacy professional, you will also need to take all reasonable steps to contractually bind the contracted service provider to comply with all privacy legislation.

Redaction and PII

Any data that will be stored for any given period will have to be protected. CaseGuard offers an intelligent automated redaction system that can redact (blackout) data in real-time. Keeping this data in its edited version helps protect personally identifiable information regarding your consumers from being lost, even during a data breach. Though criminals usually create a violation of company data, as a retailer, you are ultimately responsible for any loss. Loss of the personal data of your consumers can carry hefty penalties from various government agencies at state and federal levels—penalties for failing to protect the data and for leaking the information to known or unknown sources.

Protecting your company’s reputation is the number one priority. It is far easier to keep your customers’ trust than to repair a problem that caused them to lose faith in your business. Redacting (blurring) video data is an easy solution to protecting everyone. For law enforcement, some methods and applications can reverse the redaction or encryption if necessary.

Choose Your System Wisely

On top of keeping your company’s reputation intact and protected, the CaseGuard redaction software includes additional built-in features that will make streamlining privacy controls of all your data and documents easy.

It is crucial when considering your surveillance solutions to have a quality data redaction system like CaseGuard. Protecting your company’s integrity is priceless. Having an easy-to-use solution that works across all your digital files and helps to expand the reach of your business opportunities is an invaluable asset. Be sure to walk through all decisions regarding the installation of your surveillance system with a privacy professional. The privacy professional can also help explain redaction processes and help you choose the appropriate design, applications, and setup. Make a choice to include CaseGuard as part of your reputation and privacy management.