Legal, Technical & Spatial Considerations
We have combined the Technical, Legal, and Spatial aspects of the OSCM toolkit in one STEP 3 as they are so closely interrelated. All these three elements need to work together and in parallel guided by an ethical framework to effectively address social values and privacy by design principles to insure digital rights.
3.0.1 – Dilemma Diagram
The Legal, Technical, and Spatial aspects of crowd monitoring projects are all interrelated and all require serious ethical considerations. In order to better understand this complexity, we have visualized these interrelations in a Venn diagram that places Ethics at the center.
3.0.2 – Applying an Ethical Framework
At this point, it is important to take a step back to get an overview of the ethical considerations involved to effectively address the social values involved in your crowd monitoring project and apply a methodology to measure strengths and weaknesses with key stakeholders.
TIP –> roll over icons for more information
Inclusive
Our digital city is inclusive. We take into account the differencesbetween individuals and groups, without losing sight of equality.
Control
Data and technology should contribute to the freedom of citizens. Data are meant to serve the people. To be used as seen fit by people to benefit their lives,
to gather information, develop knowledge and find room to organisethemselves. People stay in control over their data.
Tailored To The People
Data and technology should contribute to the freedom of citizens. Data are meant to serve the people. To be used as seen fit by people to benefit their lives,
to gather information, develop knowledge and find room to organisethemselves. People stay in control over their data.
Open and Transparent
What types of data are collected? For what purpose? And what are the outcomes and results? We are transparent about this.
Legitimate and Monitored
Citizens and users have control over the design of our digital city. The government, civil society organizations and companies facilitate this. They monitor the development and the social consequences.
From Everyone For Everyone
Data that the city, companies and other organizations generate from the city are held in common. Everyone can use them. Everyone can benefit from them. Together we make agreements about this.
3.0.3 – Measuring Ethical Principles
We suggest that at this stage you hold an ethics workshop to apply a methodology to measure ethical principles related to the Legal, Technical, and Spatial considerations of your project. In Amsterdam we have used the TADA principles and workshop with success, consider using this format or source a data ethics workshop in your city.
3.1.1 – Legal Compliance
In Europe, GDPR compliance guided by Privacy by Design principles are where to begin when you start gathering and understanding all the information you need to start a legally responsible crowd monitoring project.
General Data Protection Regulation (GDPR)
(AVG – Algemene Verordening Gegevensbescherming)
The GDPR is the umbrella reference for all EU member states regarding regulations for any organization that targets or collects data related to people. It’s very important to comply with the new EU law for data privacy in every way as the fines for violations can be very heavy. It’s complicated, but The Guide to GDPR Compliance is a good place to get familiar with regulations that you need to consider in the beginning phases of your OSCM camera vision project.
IMPORTANT: In order to make sure you are GDPR compliant you should complete the GDPR Compliance Checklist https://gdpr.eu/checklist/
Other Useful Links: https://gdpr.eu (English) and how-to-make-your-business-gdpr-compliant (English), privacy-en-persoonsgegeven (Dutch)
3.1.2 – Privacy By Design
The privacy by design framework is an engineering design approach which calls for privacy to be taken into account throughout the whole engineering process. The concept is an example of value sensitive design, i.e., to take human values into account in a well-defined manner throughout the whole process. In general it is a seven step process framework to guide the design process.
More Specifically, Privacy by Design is a key regulation in the GDPR as described in Article 25: Data Protection by Design and by Default.
For general information about Privacy by Design as a framework visit: https://en.wikipedia.org/wiki/Privacy_by_design
For specific information about Privacy by Design as a regulation in the GDPR visit:
https://gdpr-info.eu/art-25-gdpr/
Procurement Law (Aanbestedingwet)
This is a good place to start with any project. We need to make sure that local and regional procurement practices are being followed in such a way that we can create real impact, innovate and level the playing field. You should be aware of exceptions when there are not competitive vendors for a novel solution and/or the innovation is involved with stimulating the startup ecosystem, for instance. The tendering process differs based on city, country and region.
LINKS:
EU
About writing a GDPR compliant privacy notice (template included): https://gdpr.eu/privacy-notice/
Dutch
Amsterdam
Data Protection Impact Assessment
The DPIA process aims at providing assurance that controllers adequately address privacy and data protection risks of ‘risky’ processing operations. By providing a structured way of thinking about the risks to data subjects and how to mitigate them, DPIAs help organisations to comply with the requirement of ‘data protection by design’ where it is needed the most, i.e. for ‘risky’ processing operations. (text copied from EDPS website)
LINKS:
- European Data Protection Board https://edpb.europa.eu/edpb_en
- DPIA Information page from the European Data Protection Supervisor EDPS which is a good overview and will help determine if it is necessary to complete a DPIA. https://edps.europa.eu/data-protection/notre-rôle-en-tant-que-contrôleur/data-protection-impact-assessment-dpia_en
- Also related to what the EDPS describes as “accountability on the ground.” and includes other documented topics such as “privacy by design” and “necessity & proportionality.” https://edps.europa.eu/data-protection/our-work/publications/guidelines/accountability-ground-provisional-guidance_en
- Guidelines for determining if data processing is likely to result in “high risk” in which case registration and/or application with the EDPR is required (note: this is also related to assessing proportionality described in Step 1 “Use Case and Goals” resource library of this toolkit). https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611236
The Data Processing Agreement
A data processing agreement (DPA) is a legally binding document to be entered into between the controller and the processor in writing or in electronic form. It regulates the particularities of data processing – such as its scope and purpose – as well as the relationship between the controller and the processor. (text from Google search result about)
LINKS:
- Data Processing Agreement Basics https://gdpr.eu/what-is-data-processing-agreement/
- Data Processing Agreement (template) https://gdpr.eu/data-processing-agreement/
TADA Principles and Manifesto
At the core of any successful OSCM computer vision project are the ethics regarding data use and reuse. How you, as a government innovator, uphold data ethics in your project will ensure the public best interests are in mind and inform your team how to communicate your ethical data practices. Understanding how Data Ethics relates to the Technical, Legal and Spatial considerations for your project is also important in the beginning stages.
LINKS:
English: https://tada.city/en/home-en/
Dutch: https://tada.city
Dutch Public Access to Government Information Act ( Wet openbaarheid van bestuur- WOB)
Otherwise known as the Dutch Freedom of Information Act, the WOB is specific to the Netherlands rules and regulations for access to and reuse of public sector information including data. Unless there are valid legal reasons to withhold, citizens and organisations have the right to access or request any government information and/or data and reuse for commercial or non-commercial purposes including apps, visualizatoins and analysis.
English
https://business.gov.nl/regulation/freedom-of-information/
https://www.government.nl/topics/government-communications/organisation-of-government-communications
Dutch
https://wetten.overheid.nl/BWBR0005252/2018-07-28
The Reuse of Government Information (Wet hergebruik overheidsinformatie- WHO)
In European law this is also known as the Open Data Directive. This law provides a common legal framework for a European market for government-held data (public sector information). It is built around two key pillars of the internal market: transparency and fair competition. In the Netherlands the policy is “open by default” meaning that if there are no security, privacy, or copyright issues, government data must be open and accessible.
EU/English
https://ec.europa.eu/digital-single-market/en/european-legislation-reuse-public-sector-information
Dutch
https://www.open-overheid.nl/open-overheid/handleiding-wet-hergebruik-van-overheidsinformatie/
https://wetten.overheid.nl/BWBR0036795/2016-10-01
The Prohibition on State Aid and EU law (Het verbod op staatssteun staat en EU wetgeving)
State Aid is defined as an advantage in any form (not just funding) given to a selected undertaking by national public authorities. This is prohibited by European law when it distorts competition or may affect trade between EU member states. Make sure that when you are funding your Open Source Crowd Monitoring project or if you are granting funds for such a project that you are following transparency requirements and complying to fair competition policies.
EU/English
https://ec.europa.eu/competition/state_aid/overview/index_en.html
Dutch
https://ecer.minbuza.nl/ecer/dossiers/staatssteun/het-verbod-op-staatssteun.html
https://europadecentraal.nl/onderwerp/staatssteun/
Privacy Statement or Privacy Policy
Transparency and informing the public about how their data are being used are two basic goals of the GDPR. This article explains what is a privacy notice and offers a privacy notice template to help you comply with the law.
About writing a GDPR compliant privacy notice (template included): https://gdpr.eu/privacy-notice/
3.1.3 – Legal Compliance Overview
Among several laws, procedures, documents and ethical principles you must consider before moving forward you needed to make sure you are familiar with the specific legal aspects of crowd monitoring in public spaces in your country, region, and city. For OSCM projects in the EU and the Netherlands here is a list of items we know are important from our experience. For full details download the Legal Resource Library PDF.
See below for more resources:
| Name | Useful Links | ||
|---|---|---|---|
| European Data Protection Officer (DPO) | /data-protection-officeer-en | ||
| The Dutch Data Protection Authority (DPA) | https://autoriteitpersoonsgegevens.nl/en | ||
| Right to Erasure Form (Part of GDPR) | https://gdpr.eu/right-to-erasure-request-form/ | ||
| IoT registration (Amsterdam) | https://slimmeapparaten.amsterdam.nl/about | ||
| Video Camera Registration (Amsterdam) | https://www.amsterdam.nl/privacy/camera’-sensoren/ | ||
| AI Register (Amsterdam) | https://algoritmeregister.amsterdam.nl/en/ai-register/ | ||
| Legally required signs and stickers (Amsterdam) | https://slimmeapparaten.amsterdam.nl/about/faq | ||
| Project Description | https://slimmeapparaten.amsterdam.nl/about/faq |
Additional General Legal considerations that will vary greatly by region and use case.
- Governance, ownership and responsibilities
- Contracts and liability
- Open Data publishing, use, and reuse compliance issues (EU)
3.2 – Technical
As technology grows, so does the number and complexity of sensors and devices that can be used to monitor public space. The technical choices you make will relate to decisions made in the previous steps when you established your goals, use case and planned your project accordingly. What is important in this step is that you first familiarise yourself with the different options available and then take a closer look at the Degrees of Invasiveness to help guide a responsible and ethical decision.
Computer Vision
Current computer-vision systems do a decent job at classifying images and localizing objects in photos, when they’re trained on enough samples but it takes a lot of work to achieve a high level of accuracy. Computer vision applications include facial and object recognition, also biometrics which can be very invasive.
More about Computer_vision
CCTV
An acronym for Closed Circuit Television, CCTV has been around for a while and is used mostly for security purposes. It’s all about recording video footage of people either in public or private spaces and can be applied to computer vision applications but not necessarily. Also known as video surveillance, it is perhaps the most invasive technology you can use.
More about Closed-circuit_television
Sound Sensors
These come in all shapes and sizes. They can record sound or just detect it. They can be highly accurate and measure volume (dbl), tone, pitch, and/or frequency or simply detect the existence sound above a certain threshold. They all use microphones but not all deliver insights related to the nature of sound or sound identification which is enabled by using existing libraries or training using machine learning.
More about sound-sensor
Thermal
Or Thermal Imaging Cameras used for crowd monitoring use infrared technology to measure object radiation and vary greatly in range and accuracy, from detecting the existence of a person at night at long range to a fairly accurate temperature reading at close range.
Mobile App
Convenient because almost everybody has a Smart Phone with them wherever they go but also problematic depending on what you want to achieve. Geolocation services, Bluetooth, Wifi, and/or Mobile Data must be on for instance depending on the application.
More about Mobile App data
Motion Sensors
Or Motion Detectors can be one of several technologies including Passive Infrared (PIR), Microwave, Sonar, and Ultrasonic. Although this technology is useful to detect single object presence, iit is not effective for multiple objects or crowds in large spaces.
More about Motion_detectors
Millimeter Wave
Or high resolution radar uses an ultra high frequency radio wave to detect, locate, and track moving targets with a very high level of accuracy but with a limited distance. This technology is also used for security screening to detect weapons and other dangerous objects under clothing.
More about Millimeter Wave
WiFi Sniffer
Also known as a packet sniffer. This technology detects smart phones on Wifi mode searching for networks. The sniffer intercepts probe requests and the MAC address of the device making it useful to track an individual in a large space but also potentially invasive.
More about WiFi_Sniffers
3-D Sensors
A depth sensing technology that uses three different techniques to detect and image map objects: stereoscopic vision, structured light pattern, or time of flight (ToF). All capture or produce 3-D images which are anonymous and trackable in crowded spaces with a high level of accuracy.
More about 3-D sensors
3.2.1 Technical – Degrees of Invasiveness
Different crowd monitoring technologies have their own degree of invasiveness depending on how they are used and where. You should be aware of how different sensors and devices can compromise privacy and compare them to others to understand your options.
3.2.2 Technical – Invasiveness Matrix
A quick guide to the various kinds of data that different crowd monitoring technologies generate. The Invasiveness Matrix will tell you what solutions will create biometric data versus anonymous data, location data and more.
3.3 Spatial
Different spaces have different requirements when designing and implementing a sensor project. We have crated a simple example with six spatial categories and specific considerations. Below you will find these considerations and some important questions you need to ask yourself and your team.
In Amsterdam it is compulsory for all data gathering devices or sensors to be registered. Make sure you follow the requirements in your city. For more information in Dutch: https://www.amsterdam.nl/nieuws/nieuwsoverzicht/meldplicht-dataverzamelaars/
Signage:
Does your project area have signage, boards, or flags to inform public that they are in a monitoring zone?
Privacy:
Does your project area provide the public the right to be invisible or anonymous? How so?
Permission:
Do you need permission from property or facility manager? In public space, you’ll need specific permissions or exceptions from the municipality.
Agreements:
Do you need data processing agreement, data protection or any other regulatory requirements?
Registration:
Should the cameras, project documents or FAQ’s need to be registered?
In this example we are using the Marineterrein Amsterdam Living Lab – Inner-city test ground for a sustainable living environment. This 1/2 square mile district is a wonderful microcosm of any city space, function or activity. For more info: https://www.living-lab.nl
Private Property
Cities are mostly made up of private properties. Owners of these properties control access and can only collect data from visitors for security reasons.
| Considerations | |
|---|---|
| Permission | |
| Agreements | |
| Registration | |
| Signage | |
| Privacy |
Public Parks
City parks are owned or managed by the local municipality. You’ll need special permission from authorities to collect data from these areas.
| Considerations | |
|---|---|
| Permission | ✔︎ |
| Agreements | ✔︎ |
| Registration | ✔︎ |
| Signage | ✔︎ |
| Privacy | ✔︎ |
Waterfronts & Harbors
Mixed management between the city, water authorities and sometimes private boating clubs or marinas. Collecting data needs to be approved by every stakeholder
| Considerations | |
|---|---|
| Permission | ✔︎ |
| Agreements | ✔︎ |
| Registration | ✔︎ |
| Signage | ✔︎ |
| Privacy | ✔︎ |
Campus & Business Parks
Hospitals, universities, commercial or industrial properties are mostly private. Collecting data is usually permitted by facility management or the owner.
| Considerations | |
|---|---|
| Permission | ✔︎ |
| Agreements | |
| Registration | |
| Signage | |
| Privacy |
Hotels, Bars & Restaurants
Cafes, courtyards and terraces are usually private property. Owners of these properties can collect data of their customers with consent.
| Considerations | |
|---|---|
| Permission | ✔︎ |
| Agreements | |
| Registration | |
| Signage | ✔︎ |
| Privacy | ✔︎ |
Sports Grounds & Recreation
Clubs, pitches, playgrounds or stadiums can be mixed between private and public ownerships. Collecting data of guests should be for legitimate safety reasons.
| Considerations | |
|---|---|
| Permission | ✔︎ |
| Agreements | ✔︎ |
| Registration | ✔︎ |
| Signage | ✔︎ |
| Privacy | ✔︎ |
3.4 Video Library
The expert interviews are a quick way for you to get some great advice. Before moving on to Step 4: Public Engagement and Communication, please take a few minutes to learn from personal experience and insights that will help you think about Legal, Technical, and Spatial Considerations for your crowd monitoring project.
All expert interviews ask these three questions:
What are the biggest challenges for crowd monitoring in public spaces?
What are some approaches to address these challenges?
What advice can you give innovators thinking about crowd monitoring?
Douwe Schmidt
Data Ethicist & Lead TADA
TADA is all about the ethical and responsible use of data. As the lead for TADA Douwe is concerned with informing the public properly and ensuring they benefit from crowd monitoring. He suggests involving the people we are monitoring but you should always ask “is this the right solution to the problem?”
Beryl Dreijer
Privacy Officer, City of Amsterdam, Information Safety & Privacy, Space and Economy
Beryl provides valuable insights about why we should develop crowd monitoring projects in open, inclusive and transparent ways. GDPR compliance is important but so is informing the public about what sensors are doing, why they are there, and where they can complain helps people feel safe about your project.
Maarten Sukel
AI Lead City Of Amsterdam
As the AI architect behind the Object Detection Toolkit www.odk.ai Marten shares his experience specific technical aspects of Computer Vision as a crowd monitoring tool. Regardless of the techniques used, we should always use sensors for the benefit of the public and using Living Labs to test your solution will avoid many problems.
Tom van Arman
Future City Maker and Founder of TAPP.NL
Tom is an architect & urban planner using open data, api’s & IoT solutions to create more social, sustainable & resilient cities. He tells us why ethics is at the heart of good design practice in public space and how using the data to make informed decisions creates value for future cities.