This guideline explains how to inform visitors about data collection when using visitor counters, based on GDPR requirements and guidelines from the European Data Protection Board (EDPB) and The Swedish Authority for Privacy Protection (IMY). This obligation is the same for all visitor counters (2D and 3D cameras), not just Indivd.
Background
Article 12 of the GDPR:
- Controllers must provide clear, transparent and accessible information when processing personal data.
Article 13 of the GDPR:
- No exceptions: Always provide information when processing (collecting, deleting or anonymizing) personal data.
- Layered approach: Use signs for basic information (first layer) and detailed information online in your privacy policy (second layer).
Transparency Principle (Article 5 (1) (a)):
- Data processing must be lawful, fair, and transparent.
Applicability to People Counting Technology:
- Since all people counting (2D and 3D cameras) process (collect, delete or anonymize) personal data on a large scale, this obligation applies.
Impact Assessment:
- Indivd has been reviewed and approved by the Swedish Data Protection Authority in a Prior Consultation on June 26, 2020.
First Layer - Sign Information
Sign Placement:
- Eye level at entrances.
- Each entrance should have a sign.
Sign Content:
- Identity and contact details of the data controller and any representatives.
- Purpose of processing (e.g., analyzing and categorizing visitors' faces).
- Visitors' rights (access, objection, deletion of data).
- Special processing details (e.g., storage outside the EU, long storage times, real-time surveillance, sound recording).
- Reference to second layer information (QR code to your privacy policy, web link, brochure).
Example:
- A simple sign in Swedish with the necessary details.
Second Layer - Detailed Information
Brochure or Poster (optional):
- Available at information desks, reception, or checkout.
- The first layer must clearly refer to this second layer.
Digital and Non-Digital Access:
- Provide both digital (web page, QR code) and non-digital (brochure, phone number) access.
- Ensure information is accessible without entering the monitored area.
- Update the information in your privacy policy.
Required Information:
- Include all details specified in Article 13 of the GDPR.
Examples of Processing Purposes
These purposes have been assessed within the framework of the prior consultation with the Swedish Data Protection Authority. We therefore presuppose that these are correct.
- Understand how different objects in the store environment (shelves, aisles, furnishings, entrance, signage, lightings, etc.) attract interest (attention, integracts with, leads to conversion) from visitors to be able to make changes that lead to the store environment becoming more efficient and relevant to all visitors.
- Understand where and when queues are formed (e.g checkouts, dressing rooms, toilets, customer service counters) in order to be able to make changes that lead to a streamlining of store operations and minimization of queue formations.
- Understand how visitor flows take place in order to be able to make changes that lead to a streamlining of customer flows in the store.
- Streamline internal operations by understanding visitor flows and then adapting staffing at different locations / departments in the store.
- Understand how visitors navigate the store's planned visitor journey turns (i.e which paths visitors walk in the store) in order to implement changes that lead to increased efficiency and relevance of the visitor journey.
- Enable clearer comparisons and thereby understand differences between different stores, e.g the impact of our store environments, queuing, visitor flows, the attraction of objects, visitors 'navigation in the stores' planned visitor journeys, etc. to learn about the differences and make changes that lead to a streamlining of our organization's overall operations. We could, for example, make two separate investments in two stores with similar conditions. In one store we invest in education for the staff, and in the other store we invest in a new store interior. If the results of such a study would show that it is more favorable to provide our staff with more education, it could lead us to restructure our investments and increase the efficiency of our organization's overall operations.
- Enable clearer comparisons and thereby understand differences between different stores, e.g the impact of our store environments, queuing, visitor flows, the attraction of objects, visitors 'navigation in the stores' planned customer turns, etc. to streamline / adapt planned establishments, including identifying new cities / areas for establishment.
- Enable clearer comparisons and thereby understand differences between our stores and other stores over time, for example regarding the impact of store environments, the attraction of objects, queuing, visitor flows, visitors 'navigation in the stores', planned visitor journeys, etc. to get and try new ideas and offers, e.g by introducing a yoga studio or running club to increase innovation and strengthen our competitiveness. For example, insights that a large proportion of visitors are attracted to (pay attention to, interact with) sports products could lead us to temporarily try to launch a running club in the store. A recurring activity in the store could lead to visitors gathering to run and discuss running in order to strengthen the store's brand towards that target group. With an increased understanding of differences, the attractiveness of objects, visitor flows, etc. could lead to an increased understand about the investment's profitability if (i) more visitors visit us (ii) new target groups visit us (iii) it leads to increased attractiveness for other products (iii) we have an increased frequency of visits and an increased attractiveness in relation to benchmark data, which in itself leads to increased competitiveness.
Contact Us
For questions or concerns about visitor information, contact us at privacy@indivd.com.
Disclaimer
This document is for general information purposes and should not be considered legal advice. For legal advice, please consult a lawyer.