‘Safe City’ facial recognition CCTV for Paceville triggers privacy scare

Plans for a system of facial recognition CCTV in places like Paceville might have to be scaled back, after data protection concerns were triggered by a MaltaToday report last week.

The director of Safe City Malta, Joe Cuschieri, had to meet the Information and Data Protection Commissioner to explain the plans for a Huawei-sponsored ‘safe city’ that can link up facial recognition CCTV cameras to identity databases.

MaltaToday first reported that government company Safe City Malta was preparing to issue an order for the technological equipment of high definition CCTVs and prepare a proof-of-concept for areas like Paceville to be monitored by the advanced system.

The system can recognise people as they enter an area monitored by the ‘safe city’ system, a concept that Chinese multinational Huawei is deploying in several cities worldwide and is also seeking an EU opening.

But since then, the United Nations’ High Commission for Human Rights special rapporteur on privacy, Prof. Joseph Cannataci, has held a meeting with Cuschieri, to flag serious privacy concerns over the concept.

“The article has generated unnecessary concern because one could easily arrive to the wrong conclusions based on what was said and written,” Cuschieri has now said in a letter to MaltaToday, after having told this newspaper that the technology could be used for “nationwide deployment”.

In his letter, Cuschieri confirmed that while it was possible to install video surveillance technology with wide-scale biometric facial recognition, the operation would have to be in line with data protection and privacy laws.

“For a proof-of-concept public CCTV operation to be put into practice, a stakeholder that will take the responsibility of carrying out video surveillance needs to be roped in to the project,” Cuschieri said.

Safe City Malta will act as the technology enabler, in collaboration with Huawei, but will not carry out video surveillance itself.

Cuschieri said that the stakeholder that would carry out the surveillance is then obliged to carry out a Privacy Impact Assessment, especially since public CCTV surveillance falls under the category of “high-risk data” because of lack of consent from data subjects and the potential mass accumulation of data.

Under EU General Data Protection Regulations, the data processor would have significant obligations at law, which must be satisfied before any data processing operation can start.

That means that any surveillance must guarantee data protection not just when the system is in operation, but also in its design as a concept. “Even on a proof-of-concept basis, the final solution design according to the approved requirements of the planned operation must tick all the boxes from a data protection and privacy standpoint,” Cuschieri said.

The coming months will see Safe City Malta commissioning the hardware and software, so that technical training at an engineering level can follow.

But once the company ropes in a “stakeholder” to carry out the video surveillance “In a locality such as Paceville”, the process would have to start once all data protection guidelines and regulations are met.

“Malta is a technologically advanced nation. This project is a key opportunity for Malta to showcase how state-of-the-art video surveillance can be put to good use while fully meeting privacy regulations and respecting human rights,” Cuschieri said.