Milestone Systems
GDPR Privacy Guide

| GDPR Privacy Guide

Version history
Document
versionReleaseComments

This version includes all considerations relevant to mobile servers andVersion 11

2024 R1

devices. It includes all changes from versions 5, 6, and 9, which are
specific to mobile.
Updates in this release include:lVersion 10

2023 R3

Recommendations to create a system configuration password
added to Additional safeguards on page 60.

l

Recommendations regarding images in alarm reports added toAdditional safeguards on page 60.

Updates in this release include:lVersion 9

Recommendations regarding alarm reports added to Additionalsafeguards on page 60.

2023 R2l

Recommendations on how to remove device registration data formobile devices added to Personal data and registered mobile
devices on page 69.

Updates in this release include:lVersion 8

2023 R1

Recommendations on how to handle SQL Server databasebackups added to Backup the SQL Server databases on page 57.

l

Do not use a managed SQL Server service added to Do not use amanaged SQL Server service on page 57.

Updates in this release include:
Version 7

2023 R1l

Safeguards for creating reports in XProtect Incident Manager
added to Additional safeguards on page 60.

Version 6

2 | Version history

2022 R3

Updates in the release include:

| GDPR Privacy Guide

Document
versionReleaseCommentsl

Recommendation to export from XProtect Smart Client rather
than from XProtect Web Client if privacy masking is required,added to Handling exported data on page 22.

lAdditional recommendations on how to safeguard mobile devices
and handle lost or stolen mobile devices added to Policies tosafeguard use of mobile devices on page 49.

lBiometric authentication with mobile clients described in Policies
to safeguard use of mobile devices on page 49.

Updates in this release include:lRecommendations concerning evidence lock added toConsiderations regarding evidence lock on page 24.

l

Recommendations concerning video push and body worn video
added to Considerations regarding video push on page 24.

l

Recommendation to encrypt investigations database on the
Mobile Server and to enable and use two-step verification added
to What should you do to ensure privacy by design? on page 42.

lVersion 5

Recommendations on how to safeguard mobile devices andhandle lost or stolen mobile devices added to Policies to2022 R2

safeguard use of mobile devices on page 49.
lXProtect Mobile Server, XProtect Mobile client, and XProtect Web
Client are included (Appendix: The Milestone XProtect VMS system
and GDPR on page 56).

l

Risk of violating GDPR described in Data collection and privacy
settings on page 57.

l

Recommendation on how to handle push notification added toAdditional safeguards on page 60.

l

New appendix added: Appendix: Data processing performed inexternal cloud services on page 70.

Version 4

3 | Version history

2022 R1

Updates in this release include:

| GDPR Privacy Guide

Document
versionReleaseCommentsl

Encryption for communication between all servers and clients
added to How XProtect reduces the impact on the interests or
fundamental rights and freedoms of the data subject on page 32.

l

Recommendations to enable encryption for all communication
between all servers and clients added to What should you do toensure privacy by design? on page 42.

l

Recommendations to enable encryption for all communication
between all servers and clients added to Protecting stored andtransmitted data on page 46.

lXProtect Rapid REVIEW added to Components and devices that are
not covered on page 56.

l

Recommendations removed from Additional safeguards on page
60 because Milestone XProtect VMS now supports encryption forcommunication between all servers and clients.

l

Added information about data sources as a result of the external
IDP to Personal data from the environment on page 67.

lAdded information to Personal data from the system on page 67
about how the IDP logs data and about the removal of personal
data in all VMS debug logs.

lUpdated Authentication and authorization data on page 68:l

GDPR support for Basic Usersl

Recommendations regarding external IDP

lEncryption of tokens, thereby no longer requiring extra
safeguards

Updates in this release include:
Version 3

2021 R2l

Safeguards against operating a VPN in split mode added toAdditional safeguards on page 60.

Version 2

4 | Version history

2021 R1

Updates in this release include:

| GDPR Privacy Guide

Document
versionReleaseCommentsl

Basic user type is now coverd (Appendix: The Milestone XProtect
VMS system and GDPR on page 56) and (Appendix: Data
processing in the Milestone XProtect VMS environment on page67).

lRecommendations added to Using geographic backgrounds in
XProtect Smart Client on page 59.

lData collection described in Integrations from registered partners
on page 59.

lAuthentication logging described in Personal data from thesystem on page 67.

Version 1

5 | Version history

2020 R3

This is the first release of this document.

| GDPR Privacy Guide

Contents
Version history

2

Copyright, trademarks, and disclaimer

8

GDPR compliance and Milestone XProtect VMS

9What is GDPR?

Who are the key stakeholders of GDPR as related to video surveillance?
Data subject

9

12
12

Data subject rights

12

Data subject request

14

What is personal data?

14

Data controller
Security officer (VMS supervisor)

17
19

User permissions management

19

Data protection training

20

VMS system administrator

21

VMS operator

21

Handling exported data

22

Handling exported data in notifications and email

23

Considerations regarding evidence lock24

Considerations regarding video push

24

Personal data breach

25

Data processor

Summary
For more information

Appendixes
Appendix: GDPR complianceDo you have a lawful basis for collecting data?
Conducting an impact assessment
Individual rights

25

26
27

29
29
29
33
34

Right to access

36

Right to be forgotten (Right to erasure)37

6 | Contents

| GDPR Privacy Guide

Right to restriction of processing
Privacy by design39
40

What should you do?

40

Requirements for privacy by design

40

Privacy by design and privacy by default

41

Setting up and configuring the video surveillance system

44

Who should have access to the VMS?

45

Protecting stored and transmitted data46

Accountability

47

Checklist for securing integrity and confidentiality

48

Policies to safeguard use of mobile devices

49

Appendix: On-the-spot notice51

Appendix: Video Surveillance Policy

51

Appendix: Data Protection Impact Assessment

53

Inherent risks with using VMS

54

Appendix: Data Processor Agreement

55

Appendix: The Milestone XProtect VMS system and GDPR

56

Additional safeguards

60

Appendix: Data processing in the Milestone XProtect VMS environment

67

Appendix: Data processing performed in external cloud services

70

Index

7 | Contents72

| GDPR Privacy Guide

Copyright, trademarks, and disclaimer
Copyright © 2024 Milestone Systems A/S

Trademarks
XProtect is a registered trademark of Milestone Systems A/S.
Microsoft and Windows are registered trademarks of Microsoft Corporation. App Store is a service mark ofApple Inc. Android is a trademark of Google Inc.
All other trademarks mentioned in this document are trademarks of their respective owners.

Disclaimer
This text is intended for general information purposes only, and due care has been taken in its preparation.
Any risk arising from the use of this information rests with the recipient, and nothing herein should beconstrued as constituting any kind of warranty.
Milestone Systems A/S reserves the right to make adjustments without prior notification.
All names of people and organizations used in the examples in this text are fictitious. Any resemblance to any
actual organization or person, living or dead, is purely coincidental and unintended.
This product may make use of third-party software for which specific terms and conditions may apply. Whenthat is the case, you can find more information in the file 3rd_party_software_terms_and_conditions.txt
located in your Milestone system installation folder.

8 | Copyright, trademarks, and disclaimer

| GDPR Privacy Guide

GDPR compliance and Milestone XProtect VMS
On May 25th, 2018, the European General Data Protection Regulation (GDPR) came into effect. The objective of
this regulation is to give individuals more control over how their personal data is collected, processed, andshared.
GDPR provides a structure for businesses that clarifies their roles and responsibilities and gives individuals theopportunity to control how their personal data is used.
This document gives you an overview of the requirements, and how you can work with GDPR compliance whenusing the XProtect video management system (VMS).
See Appendix: The Milestone XProtect VMS system and GDPR on page 56 for specific information on how a
Milestone XProtect VMS system can best be made compliant with GDPR.
Disclaimer: The information in this document and any recommendations are provided
as-is. Following this document does not implicitly mean that your system will be GDPR
compliant.

The Milestone XProtect VMS requires configuration. Any configuration or modification ofsettings must comply with EU data protection law. While the Appendix: The Milestone
XProtect VMS system and GDPR on page 56 and Additional safeguards on page 60
provide information on how to start a compliant setup, you must adhere to EU dataprotection laws when further configuring the system.

What is GDPR?
The General Data Protection Regulation (GDPR) is a set of rules that govern all forms of personal data that areheld by an organization. GDPR gives every individual ownership of their personal data, and, on theorganization’s side, introduces accountability at all stages of data processing and storage. GDPR achieves thisby providing a number of rights to individuals and putting corresponding obligations on the organizations thatprocess personal data.
GDPR harmonizes data privacy laws across the EU, and it complements existing national CCTV and video
surveillance regulations.

9 | GDPR compliance and Milestone XProtect VMS

| GDPR Privacy Guide

Although GDPR is an EU regulation, it affects many other parts of the world.
It applies to the processing of personal data by a controller or a processor in theEuropean Union, regardless of whether the processing takes place in the European
Union or not.
It applies to the processing of personal data by a controller or processor not establishedin the European Union, where the processing activities are related to the offering ofgoods or services to data subjects in the European Union; or the monitoring of their
behavior as far as their behavior takes place within the European Union.
Furthermore, many other parts of the world are applying similar privacy protection
regulations, based on the core principles of GDPR.

GDPR is enforced through domestic authorities.
There are hefty fines in case of violation:l

Up to 4% of the company's worldwide annual revenuelUp to €20 million per incident

Who is responsible for making sure a running XProtect Video Management System complies withGDPR?
The VMS owner is responsible for complying with the GDPR regulation, including:lActual installations and the applied usagel

Organizational processes and maturenessl

Data breach notification and reporting to authorities

GDPR does not apply to any specific products, but the combination of the product, the data it processes, andthe usage of the product and data all affect GDPR compliance.
GDPR has direct implications for installers, system integrators, and users of video surveillance technology.
The VMS owner is the data controller (see Data controller on page 17).
The data controller might outsource parts or the entire VMS operations to a data processor, for example asecurity company. If this is the case, the data controller and the data processor must have a Data Processor
Agreement in place. The Data Processor Agreement states what data is processed, how it is protected, and how
long the data is kept (see Data processor on page 25 and Appendix: Data Processor Agreement on page 55).

Are all video surveillance installations required to comply with GDPR?
GDPR applies to controllers and processors within the European Union, regardless of where the video is
processed.

10 | GDPR compliance and Milestone XProtect VMS

| GDPR Privacy Guide

Furthermore, GDPR protects the privacy of any resident of the geographical area of the EU, covers all forms ofvideo surveillance within the EU, and protects citizens of all countries who reside within the EU (Article 3,
GDPR).
For more information about GDPR, particularly as related to video surveillance, see Appendix: GDPR
compliance on page 29.

11 | GDPR compliance and Milestone XProtect VMS

| GDPR Privacy Guide

Who are the key stakeholders of GDPR as related to video
surveillance?
When it comes to the GDPR and video surveillance, there are three classes of stakeholders. This section of the
document defines each stakeholder and describes their respective responsibilities regarding GDPR.
l

Data subject on page 12lData controller on page 17lData processor on page 25

Data subject
A data subject is any person whose personal data is being collected, held, or processed.
Data subjects are the viewed objects of video surveillance, whether intentional or accidental.
Data subjects are also any registered person involved in the operation of the VMS, for example, operators or
named third-party guards.
The key objective of the GDPR is to safeguard the personal data of these data subjects.

Data subject rights
Articles 12 to 23 of the GDPR cover the rights of the data subject.

12 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guidel

Section 1: Transparency and modalitiesl

Article 12: Transparent information, communication, and modalities for the exercise of the rightsof the data subjectlSection 2: Information and access to personal datal

Article 13: Information to be provided where personal data are collected from the data subjectl

Article 14: Information to be provided where personal data have not been obtained from thedata subjectll

Article 15: Right to access from the data subject (see Right to access on page 36)

Section 3: Rectification and erasurel

Article 16: Right to rectificationl

Article 17: Right to be forgotten (Right to erasure) (see Right to be forgotten (Right to erasure) on
page 37)l

Article 18: Right to restriction of processing (see Right to restriction of processing on page 39)lArticle 19: Notification obligation regarding rectification or erasure of personal data or
restriction of processing

l

l

l

Article 20: Right to data portability

Section 4: Right to object and automated individual decision-makingl

Article 21: Right to objectl

Article 22: Automated individual decision-making, including profiling

Section 5: Restrictionsl

Article 23: Restrictions

Of these, the rights that are most relevant in the context of video surveillance are:

The right tobe informed(Articles 12 to
14 and 34,
GDPR)

The right ofaccess (Article
15, GDPR)

Article 12 deals with transparency and modalities, whereas Articles 13 and 14 deal withinformation and access to personal data. These articles provide the data subject with theability to be informed of what personal data is collected and how long it is retained. In
the VMS context, see Appendix: On-the-spot notice on page 51.
Article 34 provides the data subject with the right to be informed in case of a data
breach if it is likely to result in a high risk to the rights and freedoms of the data subject.

This right provides the data subject with the ability to get access to his or her personal
data that is being processed, for example, video recordings of the data subject.

13 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guide

The data subject is granted the right to ask a company for information about what
personal data (about him or her) is being processed and the rationale for suchprocessing.
The right toerasure ("rightto beforgotten")(Article 17,
GDPR)

This right provides the data subject with the ability to ask for the deletion of their data.
In the VMS context, the erasure upon the data subjects' requests is exceptional due tothe interests of the data controller and the short retention times. (See Appendix: Video
Surveillance Policy on page 51 and Deleting video recordings partially in Appendix: The
Milestone XProtect VMS system and GDPR on page 56).

This right provides the data subject with the ability to object to the processing of theirpersonal data. In the VMS context, other interests such as Legitimate interests (fraud
The right todetection, health, and safety), Legal obligation (bookkeeping, anti-money laundry), or

object (Article

even contractual fulfillment (employment contracts) may override the interests and21, GDPR)

rights of the data subject. In all cases, this must be fully transparent so the data subject
can know and object. If the data subject objects, the data controller must assess theobjection, or otherwise he might face a fine.

Data subject request
Your company must have a process for handling data subject rights requests, for example execute the right ofaccess request. Such a request must be handled within a reasonable time frame. According to Article 12 (3) of
the GDPR, this is “without undue delay and in any event within one month of receipt of the request.” It is
recommended to use a Data Subject Request template to document such requests, since it may be vital in a
GDPR case with national data protection authorities. For a sample template of a Data Subject Request, see theMilestone Data Subject Request template.
The Video Surveillance Policy describes the data subject request (see Appendix: Video Surveillance Policy on
page 51).

What is personal data?
To be compliant with GDPR, you must know what personal data is, and limit the collection of that data to only
what is necessary.
According to the regulation, personal data is any information relating to an identified or identifiable person.
An identifiable person is someone who can be identified directly or indirectly, by reference to an identifier such as:

14 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guidel

A namel

An identification numberlLocation datal

Online identifier such as IP addresses or cookie identifierlUser datalVideo imagesl

Or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural orsocial identity of that person

Personal data is any type of information that directly or indirectly can be used to identify a natural person (datasubject). This is the data that can be used to identify the viewed objects of video surveillance, whether that datais collected intentionally or accidentally.
Personal data that is protected by GDPR is:l

Data that is processed by the IT product or IT-based service (for example, name and address of aperson, video image, payment data, health data).

l

Data that is incidentally produced when the product or service is used (for example, usage data, log
files, statistical data, data for authorization, configuration data). This data can be personal data of theusers of the service, personal data of the people operating the product or service (this may include bothstaff of the service provider and staff of the users of the product or service), or privacy-relevant
configuration data (see Data controller on page 17).

Personal data is defined as any information relating to an identified or identifiable natural person or data
subject, for example:lFull namel

Vehicle registration platelHome addresslDriver's license numberlEmail addresslCredit card numberslPhone numberlIdentifiable information, images, etc., suchl

Location datalDigital identity

as video recordings and still imageslUser activities, such as those found in log
filesThis data is not necessarily only a direct relation to the object. Personal data can also be a quasi-identifier.
Quasi-identifiers are pieces of information that are not of themselves unique identifiers but are sufficiently wellcorrelated with something so that they can be combined with other quasi-identifiers to create a unique
identifier. Quasi-identifiers are particularly important when it comes to special categories of personal data.

15 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guide

Special categories of personal data include data depicting racial and ethnic origin, political opinions, religiousor philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data
concerning sex life or sexual orientation, for example:llMedical historylGenetic informationl

Political opinions andBiometric data (including photos, videos,
fingerprints)l

Criminal recordlRacial or ethnic identity

engagementslReligious or philosophicalbeliefslSexual orientation andhistoryThis is the personal data that potentially is collected by a video surveillance system:

What types of personal data descriptions, stored by XProtect, fall within the scope of GDPR?
Personal data is any type of information that directly or indirectly can be used to identity a natural person (datasubject). This can be video surveillance streams, a single image or a video sequence combined with location
information from cameras and/or layered maps, an access control integration identifying a personal accesscard and combining it with a specific location, or data from License Place Recognition (LPR) with or without any
location data.
Special categories of personal data is when the video surveillance is near hospitals (related to healthinformation), jails (criminal convictions), political activity (union membership), religious activity, or images thatreveal sexual orientation (for example, gay bars).

16 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guide

Personal data also refers to user data (operator, supervisor, and administrator) activity and audit logging. This
includes XProtect Smart Client personal user logs, including log on/log off timestamps and audit logging ofaccessed video streams, audio or metadata, as well as playback and export of recordings.
See Inherent risks with using VMS on page 54 to make sure that you are not impinging on personal rights.

Data controller
In the context of video surveillance, data controllers own and operate the video surveillance systems. Data
controllers are the legal entity that collects, processes, and shares data about the data subject.

What are the responsibilities of the data controller?
Data controllers are required to respect data protection principles and fulfill certain specific obligations. The
data controller must implement appropriate technical and organizational measures to ensure and to be able todemonstrate that processing is performed in accordance with the GDPR. This also includes:lApplying and maintaining information security policies and procedures to protect personal data. Suchinternal policies and processes should be approved at the highest level within the organization andtherefore be binding for all staff members.

lMaintaining an overview of personal data records and processing flows, for example Record ofProcessing Activities (Article 30, GDPR) and a list of systems and archives that handle personal data (theXProtect VMS system and other systems that hold personal data such as staff records, data processor
agreements, etc., including information on how and where personal data flows). For a sample templateof a Record of Processing Activities, see the Record of Processing Activities template.

lPutting in place mechanisms that execute the internal policies and processes, including complaints
procedures, to make such policies effective in practice. This includes creating data protection
awareness, and training and instruction for staff. Awareness training is available athttps://www.milestonesys.com/solutions/services/learning-and-performance/.

l

Defining the Video Surveillance Policy (see Appendix: Video Surveillance Policy on page 51). This policy
must refer to domestic laws regarding video surveillance.

l

Carrying out the Data Protection Impact Assessments, particularly for certain data processing
operations deemed to present specific risks to the rights and freedoms of data subjects, for example,
by virtue of their nature, their scope, or their purpose (see Appendix: Data Protection Impact
Assessment on page 53).

lEnsuring transparency of these adopted measures regarding data subjects and the public in general.
Transparency requirements contribute to the accountability of data controllers (for example,
publication of privacy policies on the internet, transparency regarding internal complaints procedures,and publication in annual reports).

17 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guidel

Publishing the right of information notice to the public (see Appendix: On-the-spot notice on page 51).
This notice informs individuals who are affected of the purpose of the surveillance, who keeps the datathat is collected (data controller), and the retention policy.

lAssigning responsibility for data protection to designated persons with direct responsibility for theirorganizations' compliance with data protection laws. In particular, appoint the Data Protection Officer(DPO).

Data Protection Officer (DPO)
Every organization must have an appointed DPO or at least an assigned person responsible for privacy.
From the start, the plans to install or update a video surveillance system should be communicated to the DPO.
The DPO should be consulted in all cases and in a timely manner in all issues which relate to the protection of
personal data that are processed when the service is provided or used.
The DPO should be involved in all stages of the decision-making.
The DPO's responsibilities include:lParticipating in defining the business purpose of the video surveillance, for example, crime prevention,
fraud detection, product quality verification or public health and safety, and so forth.

lCommenting on the organization's draft Video Surveillance Policy, including its attachments, (seeAppendix: Video Surveillance Policy on page 51), and correcting mistakes and suggesting improvementslAssisting in communications with the national or regional data protection authoritiesl

Checking agreements with third parties when sharing data. That is, maintaining and managing the Data
Processor Agreement (see Appendix: Data Processor Agreement on page 55)lDrafting compliance reports and carrying out audits to obtain third-party certification approving theinternal measures adopted to ensure compliance effectively manages, protects, and secures personal datalStore and make sure that the Record of Processing Activities and Data Protection Impact Assessments(see Appendix: Data Protection Impact Assessment on page 53) are updated every time data protection
relevant changes are made to the VMS. For a sample template of a Record of Processing Activities, see
the Record of Processing Activities template.

Data controller roles
The following sections describe the responsibilities of the respective data controllers:lSecurity officer (VMS supervisor) on page 19l

VMS system administrator on page 21l

VMS operator on page 21

18 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guide

Security officer (VMS supervisor)
Security officers or supervisors are responsible for enforcing the GDPR compliant environment. Security
officers must:lDefine user permissions (see User permissions management on page 19)l

Enforce awareness training of personnel (see Data protection training on page 20)lContact the Data Protection Officer (DPO) if GDPR non-compliance is suspected, for example, in the caseof data breach of video materials (see Appendix: GDPR compliance on page 29)lApply and maintain a high general security level. For more information on how to secure your XProtect
VMS installations against cyber-attacks, see the hardening guide.

User permissions management
Who should have access to the VMS resources?
Organizations must:l

Limit user access to a small number of clearly identified individuals on a need-to-know basis.

l

Maintain audit logs of user access and activities.

Access permissions must be limited to a small number of clearly identified individuals on a strictly need-toknow basis. Make sure that authorized users can access only the data to which their access permissions refer.
Access control policies should be defined following the principle of “least privilege”: access permission to users
should be granted to only those resources which are strictly necessary to carry out their tasks.
When sharing a computer, Milestone recommends that VMS operators do not share thelogin account to Windows. Each operator should have an individual account.

In addition, VMS operators should not select to remember their password when signingin to the VMS system.

Only the security officer, the system administrator, or other staff members specifically appointed by the
security officer for this purpose should be able to grant, alter or annul access permissions of any persons. Any
provision, alteration, or annulment of access permissions must be made in accordance with criteria
established in the Video Surveillance Policy (see Appendix: Video Surveillance Policy on page 51).
Those having access permissions must at all times be clearly identifiable individuals. For example, no genericor common user names and passwords should be allocated to an outsourced security company that employs
several people to work for the organization.

19 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guide

The Video Surveillance Policy must clearly specify and document the technical architecture of the video
surveillance system, who has access to the surveillance video, and for what purpose, and what those accesspermissions consist of. In particular, you must specify who has the permission to:lView or access the video in real-timel

Export recordings and audit trailslOperate the pan-tilt-and-zoom (PTZ)lDelete or remove devices (cameras) and delete any

cameraslView or access the recorded video

recordingsl

Alter any data after initial configuration

In addition, you must ensure that only those needing access to the following VMS features get these
permissions:llAdministrate the VMS
Create / edit / view / delete bookmarkslCreate / edit / view / delete evidence lockslLift Privacy maskslExport to defined paths (for example, only export XProtect
format with encryption to a shared drive)l

Read audit logslStart/stop recordinglCreate / edit / delete / activate/ lock / release PTZ presetslCreate / edit / delete / start /stop PTZ patrolling schemeslAudio, metadata, I/O andevent permissions

Data protection training
All personnel with access permissions, including outsourced personnel carrying out the day-to-day CCTV
operations or the maintenance of the system, should be given data protection training and should be familiar
with the provisions of GDPR to the extent that they are relevant to their tasks. The training should pay special
attention to the need to prevent the disclosure of surveillance video to anyone other than authorizedindividuals.
Training of personnel is mandatory and must include:lCybersecuritylExport of VMS datalVideo push

20 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guide

Training should be held when a new system is installed, when significant modifications are made to thesystem, when a new person joins the organization, as well as periodically afterward at regular intervals. For
existing systems, initial training should be held during the transitory period and periodically afterwards atregular intervals.
For more information about GDPR for the VMS operator, see the Milestone GDPR Privacy Guide for VMS
Operators and the Milestone GDPR e-learning for VMS Operators.

VMS system administrator
System administrators are responsible for setting up the GDPR compliant system environment. Systemadministrators do amongst the following:l

Apply and maintain a high general security level. For more information on how to secure your XProtect
VMS installations against cyber-attacks, see the hardening guide.

l

Apply a secure password policylConduct security auditslEnsure devices record according to the defined purpose – for example, on event, motion, always-on,
and so forthlEnsure recording and audit log retention time is set according to local law and the defined purpose of
the VMSl

Ensure user management (add and remove users)l

Ensure cameras follow privacy laws and do not record areas that should not be recorded – mask out
areas that should not be recordedlContact the Data Protection Officer (DPO) if GDPR non-compliance is suspected, for example, in the caseof a data breach of video materials (see Appendix: GDPR compliance on page 29)

VMS operator
VMS operators must follow processes and work instructions when accessing data in the system, for example,
when viewing video or exporting video, and so forth.
To be GDPR compliant, operators must have the following:

21 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guidel

A general understanding of GDPR and the rules for data exportlTraining in GDPR
Operators should have adequate training of the video surveillance system to ensure that the privacy
and other fundamental rights of the data subjects caught on the cameras are not intruded upon. They
must be taught what the Video Surveillance Policies define (for example, video evidence handout
procedures), who to contact if in doubt (escalation point persons such as the supervisor or Data
Protection Officer), and so forth (see Security officer (VMS supervisor) on page 19).
For more information about GDPR for the VMS operator, see the Milestone GDPR Privacy Guide for VMS
Operators and the Milestone GDPR e-learning for VMS Operators.

Handling exported data
Exporting is done when there has been an incident that requires sharing evidence with authorities. If you havethe user permissions to export evidence, you have the responsibility when handling it. The reason why it's
sensitive is both due to the contents and the fact that the data leaves the surveillance system. Most likely, there
has been an incident that may involve criminal activity. There may also be sensitive private details in theevidence. When you export it, it is usually stored on a removable storage of some kind (USB drive, optical disc,etc.).
If that data ends up in the wrong hands, the privacy of the data subjects in the evidence would be lost.
You should have a clear process for exporting evidence, which covers:l

Who can export evidence?

l

Where is the evidence stored until handed to authorities?

l

Who has access to it?

lWhat format(s) should be used?

l

Whether encryption should be applied (highly recommended)?

lWhen is the evidence destroyed?

Data controllers must take technical and organizational measures to protect data that leaves the Milestone
XProtect VMS. Such measures could be:lLimit the permission to export videos and audit logs to special personnel onlylConsider encrypting the data before or after it is being exportedlApply privacy masks before exporting video data, where appropriatelPhysically protect removable media with personal data on itlEstablish policies that ensure that personal data is deleted from media according to the retention time

22 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guidel

Keep a register of removable media – who exported what data to the media? To whom has it been
forwarded and for what purpose? Is the recipient informed to destroy the media or to return it after the
purpose has been reached? Etc.

l

Use Windows group policies to disable USB ports or media access on the client PCslMonitor the audit logs for unauthorized export eventslCommit employees to the data protection policylProperly sanitize the media or physically delete it if sanitization is not possible (for example, DVDs)

If it is necessary to mask out parts of a camera view from a video sequence that will be shared with third
parties, the VMS operator should use the export functionality from Smart Client rather than from XProtect Web
Client because XProtect Web Client does not support privacy masking.
See the Milestone GDPR e-learning for VMS Operators for more information on handling data exports.

Handling exported data in notifications and email
In addition to exports, data can also be extracted from the VMS by means of attachments to notifications.
Notifications are emails that are sent to a specified email address. When creating a notification, theadministrator can choose to include a set of snapshots or an AVI of a sequence. Because the attachedsnapshots and AVI sequences in notifications leave the VMS, they are outside the control of the VMS for user
access and retention. It is recommended not to attach images or AVI sequences to email notifications. If theattachments are necessary, then you must at least ensure that there are organizational procedures andcontrols for who receives the emails and how they are handled.
VMS operators who are using a mobile device must be aware that media galleries on their device may be
automatically backed up to Google or Apple servers, if this is configured on the device. In this case, if there areimages of identifiable natural persons, this might lead to an unlawful data transfer to a third country.
To manage this, you should enforce privacy and security policies with Mobile Device Management (MDM)
software, and establish safeguards such as those listed in Policies to safeguard use of mobile devices on page 49.
Further, you should have a clear process, which covers:lWhere is the data stored?
Ensure that the sending and receiving email servers are under the control of the organization that is thedata controller / data processor of the video surveillance. In particular, recipients should not be email
accounts on free mail accounts such as Gmail or Hotmail, and so forth.

l

Who has access to it?

lWhat format(s) should be used?

23 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guidel

Whether SMTP encryption should be applied?
Use an SMTP/SMTPS mail server. You must encrypt the connection between the VMS and the outgoing
mail servers, as well as between the sending and receiving SMTP servers.

lWhen is the data destroyed?
Milestone recommends that the retention time of video data in the outgoing and incoming mailboxes
should be aligned with the retention time of the media database or with the retention time of alarmsthat may be triggered by the same events that caused the notification.
Retention time in the mailboxes needs to be limited to a boundary that is reasonable for the purpose
behind the notification process.
Milestone recommends to only use mailboxes of the data controller / data processor and to configure
automatic deletion of the emails after the defined retention time has been reached.
Data controllers / data processors should make sure that these mailboxes are not automaticallyarchived by the email system.

Considerations regarding evidence lockWith the evidence lock functionality, client operators can protect video sequences, including audio and otherdata, from deletion if required, for example, while an investigation or trial is ongoing.
When protected, the data cannot be deleted, neither automatically by the system after the system's default
retention time or in other situations nor manually by the client users. The system or a user cannot delete thedata until a user with sufficient user permissions unlocks the evidence.
You must only keep recordings locked as long as there is a valid reason to keep the recordings, for example an
ongoing investigation. Keeping recordings indefinitely is not in compliance with GDPR.

Considerations regarding video pushVideo push enables the operator to stream live video from a smartphone to the VMS.
Video push is likely to be more intrusive than the more standard, stationary surveillance systems because of its
mobility.
Before you decide to use a system with this functionality, it is important that you justify its use and consider
whether or not it is proportionate, necessary and addresses a pressing social need. It is recommended thatyou undertake a data protection impact assessment to demonstrate that this is the case. See Appendix: Data
Protection Impact Assessment on page 53.
When using devices with video push capability, it is important to know when and when not to record. It is also
important to use these devices only within the defined premises of your video surveillance installation, that is,
the area that you have covered with signage. It is therefore important that clear signage is displayed, forexample on an individual’s uniform, to show that recording is taking place.

24 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guide

Operators using these devices should be provided training about where this feature may be used and how torespect the privacy of people being recorded with video push, such as not recording people in private orvulnerable situations. See Data protection training on page 20.

Personal data breach
GDPR defines a "personal data breach" as "a breach of security leading to the accidental or unlawfuldestruction, loss, alteration, unauthorized disclosure of -- or access to -- personal data transmitted, stored orotherwise processed."In the case of a security breach, the DPO must determine whether to notify the Data Protection Authority andthe data subjects involved, according to Articles 33 and 34 of the GDPR.
According to Article 33 (1) of the GDPR:
In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than
72 hours after having become aware of it, notify the personal data breach to the supervisory authority competentin accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights andfreedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it
shall be accompanied by reasons for the delay.
If deemed necessary, the controller must post the Data Breach Notification within 72 hours of being madeaware of the breach (see Personal data breach on page 25). For a sample template of a Data Breach
Notification, see Milestone Data Breach Notification template. Data subjects also must be notified if the personal
data breach "is likely to result in a high risk to the rights and freedoms of individuals."
Data processors experiencing a personal data breach must notify the data controller, but otherwise have noother notification or reporting obligation under the GDPR.
For information about the other responsibilities of the DPO, see Data controller on page 17.

Data processor
If an organization out-sources all or part of its video surveillance activities to a third party (a data processor), it
remains liable for compliance with GDPR as a data controller. For example, security guards monitoring live
surveillance video in the reception area of an organization working for a private company to whom theorganization outsourced the task of live monitoring. In this case, the organization must ensure that the
security guards carry out their activities in compliance with the GDPR.
To be compliant with GDPR, third-party data processors (excluding law enforcement) must:lFulfill the same requirements as the operator (see VMS operator on page 21)lSign and comply with a Data Processor Agreement (see Appendix: Data Processor Agreement on page 55).

25 | Who are the key stakeholders of GDPR as related to video surveillance?

| GDPR Privacy Guide

Summary
GDPR is a regulation that is already influencing how organizations handle data, including video data.
As a minimum, each organization that processes personal data needs one or more designated persons
responsible for making sure that the organization handles personal data in line with GDPR and company policy(the number of man-hours allocated for this will depend on the size of the organization and the amount of
personal data collected and processed). In addition, for some organizations, GDPR will require theappointment of a formal Data Protection Officer (DPO) to perform these tasks.
There will also be changes in the administrative process. Under GDPR, organizations need to keep detailed andaccurate Record of Data Processing Activities. For a sample template of a Record of Processing Activities, see theRecord of Processing Activities template. There’s a range of details that must be recorded, including but notlimited to:lWhat category of individuals the processed personal data relate to (for example, customers, employees,
store visitors, and so forth.)l

For what purposes the personal data is usedl

Whether the personal data is going to be transferred – to other companies and/or outside the EUl

How long the personal data will be storedlMeasures taken by the organization, in relation to each separate data processing activity, to ensure
GDPR compliance

All of this is relevant when it comes to stored surveillance video, and defined in the Video Surveillance Policy (seeAppendix: Video Surveillance Policy on page 51).
Organizations are obligated to explain why a video camera is in a particular place, what is being filmed andwhy. In the case of video surveillance, appropriate signage in and around the area where the video
surveillance is being used should be used to provide information about this.
The data controller may be obliged to carry out a Data Protection Impact Assessment (see Appendix: Data
Protection Impact Assessment on page 53) when it comes to setting up a camera in a public place. An impact
assessment should include:lA systematic description of the intended processing operations and processing purposesl

An assessment of the necessity and proportionality of the processing operations in terms of purpose(This may require external assistance)l

Risk assessment for individuals’ rights and freedomslPlanned measures to address these risks, including safeguards and mechanisms to ensure theprotection of personal data and compliance with GDPR (this should consider the rights and legitimate
interests of individuals and other affected persons)

26 | Summary

| GDPR Privacy Guide

One of the key features of the GDPR is that those who are being monitored need to be fully informed about
what data is being held on them and how it’s being used. The right of information notice informs individuals
who are affected of: the purpose of the surveillance, who keeps the data that is collected (data controller / dataprocessor), and the retention policy. For a sample template of an on-the-spot notice, see the Milestone On-thespot notice template.
Organizations storing video have clear responsibilities when it comes to storing personal data and must put
into place robust measures to prevent unauthorized access. This means that it’s important to set out, inwriting, who will have access to the cameras and recordings.
Organizations should also have a procedure in place for when an individual chooses to exercise their right ofaccess to personal data or request its deletion. This is so that they can stay within the prescribed month-longwindow within which they must comply with these requests under GDPR. When making such a request, it isreasonable to expect the inquirer to provide adequate information to locate this data – for example anapproximate time frame, and the location where the video was captured. That is, the subject should provide
official identity papers proving who they are, and the organization should make a record of the recordings
being shown or provided to the individual. Furthermore, other people in the video should be masked out,using third-party tools.
Organizations should use strong measures to prevent unauthorized access to the personal data that they arestoring. The tactics used by each organization will be unique to the challenges they face. However, in all
instances, organizations must employ robust security controls, stay up-to-date with cybersecurity bestpractices, and ensure that they are working with trusted partners who provide secure hardware, software, andthorough aftercare.

Personal data handling
When handling personal data, adhere to these principles:l

Assess: Know what personal information you have in your files and on your computers.

lReduce: Keep only what you need for your business.

lProtect: Protect the information that you keep.

lEliminate: Properly dispose of what you no longer need.

lRespond: Immediately report all actual or suspected security breaches.

For more informationl

For the full-text version of the General Data Protection Regulationl

For more information about GDPR for the VMS operator, see the Milestone GDPR Privacy Guide for VMS
Operators and the Milestone GDPR e-learning for VMS Operators.

l

To stay current and learn more about GDPR developments, visit the European Commission website on
Data Protection

27 | Summary

| GDPR Privacy Guidel

For a guide to the GDPR to help organizations comply with its requirements, see the Information
Commissioner's Office guide to the UK General Data Protection Regulationl

For a list of key facts about GDPR, see Key facts on the General Data Protection Regulationl

For recommendations for European institutions and bodies on how to design and operate video
surveillance systems, see the European Data Protection Supervisor (EDPS) guidelinesl

For more information on how to secure your XProtect VMS installations against cyber-attacks, see thehardening guide.

l

For information about how the components of the Milestone XProtect VMS interact, see the Milestone
document describing the system architecture.

Milestone GDPR templateslMilestone On-the-spot notice template.

l

Record of Processing Activities template.

lMilestone Video Surveillance Policy template.

lMilestone Data Processor Agreement templatel

Milestone Data Subject Request template.
Note that this is only an example. There are no formal requirements for therequests of data subjects.

lMilestone Data Breach Notification template.

28 | Summary

| GDPR Privacy Guide

Appendixes
For additional information, refer to the following sections:
Appendix: GDPR compliance29

Do you have a lawful basis for collecting data?

29

Individual rights

34

Privacy by design

40

Accountability

47

Checklist for securing integrity and confidentiality

48

Appendix: On-the-spot notice51

Appendix: Video Surveillance Policy

51

Appendix: Data Protection Impact Assessment

53

Inherent risks with using VMS

54

Appendix: Data Processor Agreement

55

Appendix: The Milestone XProtect VMS system and GDPR

56

Additional safeguards

60

Appendix: Data processing in the Milestone XProtect VMS environment

67

Appendix: Data processing performed in external cloud services

70

Appendix: GDPR complianceThis section provides an overview of GDPR regulations relevant for video surveillance. It describes what GDPR
is and how it impacts video surveillance usage in the following sections:l

Do you have a lawful basis for collecting data? on page 29lIndividual rights on page 34

lPrivacy by design on page 40lAccountability on page 47

lChecklist for securing integrity and confidentiality on page 48

Do you have a lawful basis for collecting data?
GDPR requires that all organizations have a valid, lawful basis for collecting and processing personal data.
Video surveillance on the basis of consent or vital interests may be possible in exceptional situations, forexample in the health and care sector if a person has to be monitored permanently.

29 | Appendixes

| GDPR Privacy Guide

You are required to keep track of processing activities in a Record of processing activities (Article 30, GDPR). For asample template of a Record of Processing Activities, see the Record of Processing Activities template.
Check the legitimacy of processing video data and user data in accordance with the following levels of
regulation:
1. General Data Protection Regulation (Article 6, GDPR)
Particularly Article 6 (1)(b) of the GDPR:
Processing is necessary for the performance of a contract to which the data subject is party or in order totake steps at the request of the data subject prior to entering into a contract.
And Article 6 (1)(e)(f) of the GDPR:
Processing shall be lawful if and to the extent processing is necessary for the purposes of the legitimate
interests pursued by the controller or by a third party, except where such interests are overridden by theinterests or fundamental rights and freedoms of the data subject which require protection of personal data,in particular where the data subject is a child.
2. Directive (EU) 2016/680 Law Enforcement or the national law based on that directive
Comply with national law based on the Directive (EU) 2016/680 Law Enforcement in order to establish alegal basis to check the legitimacy of the processing.
3. National law
Comply with national law, for example, Section 4 German Federal Data Protection Act (FDPA), though
this provision does not apply to video surveillance conducted by enterprises.
Before you implement video surveillance, assess the potential benefits and the impact on the rights to privacy
and other fundamental rights and legitimate interests of those in the covered area.
When you decide to use video surveillance, document the purpose of the video system, what information iscollected, what it will be used for, by whom, and for how long, and provide adequate supporting evidence suchas statistical data on the actual number of security incidents that occurred, as well as evidence of pasteffectiveness of the cameras to deter, prevent, investigate, or prosecute those incidents.
The extent of assessment depends on the size of the proposed system and the impact on people’s privacy andother legitimate interests or fundamental rights.

Processing based on a legal obligation or a public task
When is the lawful basis for legal obligations likely to apply? In short, when you are obliged to process the
personal data to comply with the law. Article 6 (3) of the GDPR requires that the legal obligation must be laid
down by EU law or Member State law.
This does not mean that there must be a legal obligation specifically requiring the specific processing activity.
The point is that your overall purpose must be to comply with a legal obligation that has a sufficiently clear
basis in either common law or statute. For example, a court order may require you to process personal data
for a particular purpose and this also qualifies as a legal obligation.

30 | Appendixes

| GDPR Privacy Guide

Public institutions usually use video surveillance to perform a public task. Be aware that the balancing ofinterests is not a legal basis for public authorities in the performance of these tasks.
For public institutions, video surveillance is only legitimate if it is necessary to perform the public task. Whenperforming a public task, you must conduct a proportionality assessment (see Balancing ofinterests/proportionality assessment on page 31). The data controller must consider the principles of data
minimization (for example, privacy masking), storage limitation (retention time), and purpose limitation (Article
5 (1), GDPR).

Balancing of interests/proportionality assessment
Private bodies usually operate a VMS to pursue the legitimate interests of the data controller or a third party(Article 6 (1)(f), GDPR). Therefore, a balancing of interests is necessary to check the legitimacy of theprocessing. The data controller needs to identify and weigh his interests versus the interests or fundamental
rights and freedoms of the data subjects, which require protection of personal data.
The processing of audit and alarm history data can usually be based on the legitimate interest of the data
controller (Article 6 (1)(f), GDPR). The same is applicable for user management data (account data,authentication credentials, authorization data, configuration data) if the user is an employee of a security
company.
You must be clear, open, and honest with people from the start about how you will use their personal data. In
your assessment, address the following questions:lWhat are the benefits of using video surveillance? Do the benefits outweigh any detrimental effects?

lIs the purpose of the system clearly specified, explicit and legitimate? Is there a lawful ground for thevideo surveillance?

l

Is the need to use video surveillance clearly demonstrated? Is it an efficient tool to achieve its intended
purpose? Are there less intrusive alternatives available?

More so, the data controller can only use the personal data for a new purpose if it’s compatible with theoriginal purpose, or the data controller gets consent or has a clear basis in law.

Typical interests of the data controller
Typically, the data controller:l

Exercises the right to determine who shall be allowed or denied access to datalSafeguards legitimate interests for specifically defined purposes

In the context of employment, the data controller should be informed that the processing of employees’
personal data – video data as well as user data – in the employment context may be subject to more specificrules under member state law (Article 88, GDPR), for example Section 26 FDPA (Germany).

31 | Appendixes

| GDPR Privacy Guide

Typical interests and rights of the data subjects
Data subjects have the right of:l

No long-time surveillancelNo monitoring of intimate situationslShort retention timeslAdequate safeguards if special categories of personal data (Article 9, GDPR) are processed

How XProtect reduces the impact on the interests or fundamental rights and freedoms of the data
subject
Milestone XProtect reduces the impact on the interests and fundamental rights of the data subject by:lProtection of personal data by:ll

Role-based access controllSupervisor only liftable privacy masksl

Access LogginglEncryption of recordingslEncryption of all communication between XProtect VMS servers and clientsl

Automated video retention (automated deletion)l

Privacy maskinglSecure and verifiable video export

CybersecuritylSystem hardening. For more information on how to secure your XProtect VMS installations
against cyber-attacks, see the hardening guide.

l

Reporting & patching of known vulnerabilities. For more information see Reporting & patchingof known vulnerabilities.

l

Education and AwarenesslPartner education certification programslPartner product certification programs (see Milestone Technology Partner Program andMilestone Marketplace)l

Milestone GDPR e-learning for VMS Operators

32 | Appendixes

| GDPR Privacy Guide

Transfers and disclosures
There are three main rules in the GDPR governing transfers, depending on whether the recordings aretransferred:l

To a recipient within the organization or in another organization
In this case, the GDPR provides that the recordings can be transferred to others within the organization
or in another organization if this is necessary for the legitimate performance of tasks covered by thecompetence of the recipient.

l

To others within the European Union
In this case (transfers outside the organizations but within the European Union), these are possible if
this is necessary for the performance of a task carried out in the public interest or subject to theexercise of public authority, or if the recipient otherwise establishes that the transfer is necessary andthere is no reason to assume that the legitimate interests of those whose images are transferred might
be prejudiced.

l

Or to outside the European Union
In this case, transfers outside the European Union can be made: (i) if done solely to allow theorganization’s tasks to be carried out and (ii) only subject to additional requirements, mainly to ensurethat the data will be adequately protected abroad.

Summed up
Ensure that you do not do anything with the data in breach of any other laws.
You must use personal data in a fair way. This means you must not process the data in a way that is unduly
detrimental, unexpected, or misleading to the individuals concerned.
You can only use the personal data for a new purpose if it’s compatible with your original purpose, or you getconsent or have a clear basis in law.
In some cases that are deemed high risk of encroaching on privacy, you must conduct a formalized impact
assessment (see Appendix: Data Protection Impact Assessment on page 53).
Conducting an impact assessment
Before installing and implementing video surveillance systems, you should conduct a privacy and Data
Protection Impact Assessment.
The purpose of an impact assessment is to determine the impact of the proposed system on individuals'
privacy and other fundamental rights, and to identify ways to mitigate or avoid adverse effects.
How much effort should go into the impact assessment? It depends on the circumstances. A video surveillancesystem with a high risk of encroaching on privacy warrants a greater investment than a video surveillancesystem with limited impact on privacy, for example, a conventional static CCTV system.

33 | Appendixes

| GDPR Privacy Guide

At a minimum, according to Article 35 (7) of the GDPR, the assessment must contain at least:l

A systematic description of the envisaged processing operations and the purposes of the processing,including, where applicable, the legitimate interest pursued by the data controllerl

An assessment of the necessity and proportionality of the processing operations in relation to the
purposesl

An assessment of the risks to the rights and freedoms of data subjects referred to in Article 35 (1) of the
GDPR:
Where a type of processing in particular using new technologies, and taking into account the nature, scope,
context, and purposes of the processing, is likely to result in a high risk to the rights and freedoms ofnatural persons, the controller shall, prior to the processing, carry out an assessment of the impact of theenvisaged processing operations on the protection of personal data. A single assessment may address a setof similar processing operations that present similar high risks.

l

The measures envisaged to address the risks, including safeguards, security measures, andmechanisms to ensure the protection of personal data and to demonstrate compliance with GDPR
taking into account the rights and legitimate interests of data subjects and other persons concerned

In any event, and in all cases, you must assess and justify whether to resort to video surveillance, how to place
the cameras, select and configure the systems, and how to implement the required data protection
safeguards. For information about securing your XProtect VMS installations, see the hardening guide and thecertificates guide.

Individual rights
One of the main purposes of GDPR is to give individuals greater protection and a set of rights governing theirpersonal data.
There are some very specific requirements under the terms of the regulation, all of which mean that the party
processing or storing personal data has a responsibility to keep this data private.
GDPR gives individuals the right to be made aware of when their personal data is being collected (at the pointof capture), and how it will be used. In the case of video surveillance, for example, these will mean appropriate
signage in and around the area where video surveillance is being used.
Articles 12 to 23 of the GDPR cover the rights of the data subject.
lSection 1: Transparency and modalitiesl

Article 12: Transparent information, communication, and modalities for the exercise of the rightsof the data subject

34 | Appendixes

| GDPR Privacy Guidel

Section 2: Information and access to personal datal

Article 13: Information to be provided where personal data are collected from the data subjectl

Article 14: Information to be provided where personal data have not been obtained from thedata subjectll

Article 15: Right to access from the data subject (see Right to access on page 36)

Section 3: Rectification and erasurel

Article 16: Right to rectificationl

Article 17: Right to be forgotten (Right to erasure) (see Right to be forgotten (Right to erasure) on
page 37)l

Article 18: Right to restriction of processing (see Right to restriction of processing on page 39)lArticle 19: Notification obligation regarding rectification or erasure of personal data or
restriction of processing

l

l

l

Article 20: Right to data portability

Section 4: Right to object and automated individual decision-makingl

Article 21: Right to objectl

Article 22: Automated individual decision-making, including profiling

Section 5: Restrictionsl

Article 23: Restrictions

Of these, the rights that are most relevant in the context of video surveillance are:

The right tobe informed(Articles 12 to
14 and 34,
GDPR)

Article 12 deals with transparency and modalities, whereas Articles 13 and 14 deal withinformation and access to personal data. These articles provide the data subject with theability to be informed of what personal data is collected and how long it is retained. In
the VMS context, see Appendix: On-the-spot notice on page 51.
Article 34 provides the data subject with the right to be informed in case of a data
breach if it is likely to result in a high risk to the rights and freedoms of the data subject.
This right provides the data subject with the ability to get access to his or her personal

The right ofdata that is being processed, for example, video recordings of the data subject.

access (Article

The data subject is granted the right to ask a company for information about what

15, GDPR)

personal data (about him or her) is being processed and the rationale for suchprocessing.

35 | Appendixes

| GDPR Privacy Guide

The right toerasure ("rightto beforgotten")(Article 17,
GDPR)

This right provides the data subject with the ability to ask for the deletion of their data.
In the VMS context, the erasure upon the data subjects' requests is exceptional due tothe interests of the data controller and the short retention times. (See Appendix: Video
Surveillance Policy on page 51 and Deleting video recordings partially in Appendix: The
Milestone XProtect VMS system and GDPR on page 56).

This right provides the data subject with the ability to object to the processing of theirpersonal data. In the VMS context, other interests such as Legitimate interests (fraud
The right todetection, health, and safety), Legal obligation (bookkeeping, anti-money laundry), or

object (Article

even contractual fulfillment (employment contracts) may override the interests and21, GDPR)

rights of the data subject. In all cases, this must be fully transparent so the data subject
can know and object. If the data subject objects, the data controller must assess theobjection, or otherwise he might face a fine.

For GDPR compliance in VMS systems, three rights are especially relevant: the right to be informed, the right toaccess, and the right to erasure.
Right to access
Under Article 15, the GDPR gives individuals control over their personal data, including the right to see that
data. Particularly important is the right that data subjects can get a copy of their data and that third persons
are masked (using third-party tools).
Upon request, organizations need to deliver to a data subject all the personal data collected about them,including video collected by a video surveillance system.
Ensure that you establish formal procedures and policies for handling right to access requests, described in
Register of transfers and disclosures.

Transfers and disclosures
There are three main rules in the GDPR governing transfers, depending on whether the recordings aretransferred:l

To a recipient within the organization or in another organization
In this case, the GDPR provides that the recordings can be transferred to others within the organization
or in another organization if this is necessary for the legitimate performance of tasks covered by thecompetence of the recipient.

36 | Appendixes

| GDPR Privacy Guidel

To others within the European Union
In this case (transfers outside the organizations but within the European Union), these are possible if
this is necessary for the performance of a task carried out in the public interest or subject to theexercise of public authority, or if the recipient otherwise establishes that the transfer is necessary andthere is no reason to assume that the legitimate interests of those whose images are transferred might
be prejudiced.

l

Or to outside the European Union
In this case, transfers outside the European Union can be made: (i) if done solely to allow theorganization’s tasks to be carried out and (ii) only subject to additional requirements, mainly to ensurethat the data will be adequately protected abroad.

Register of transfers and disclosures
The organizations should keep a register—whenever possible, in an electronic form—of transfers anddisclosures. In it, each transfer to a third party should be recorded. (third parties also include anyone within
the organization to whom a transfer is made by those having access to the recordings in the first place. Thistypically includes any transfer outside the security unit.) The register, in addition, should contain all instanceswhere, although the copy of the video surveillance recording was not transferred, third parties were shown therecordings or when the content of the recordings was otherwise disclosed to third parties.
The register should include at least the following:lDate of the recordingslRequesting party (name, title, and organization)lName and title of the person authorizing the transferlBrief description of the content of the recordingslReason for the request and the reason for granting itlWhether a copy of the recording was transferred, the recording was shown, or verbal information was
given

Right to be forgotten (Right to erasure)
Under Article 17, the GDPR gives individuals control over their personal data, including the right to have theirpersonal data erased if it is no longer necessary for the intended purpose of the system.
According to Article 17 (1)(c) of the GDPR, the data controller must handle objections of data subjects. Since
deleting a specific subject from video is not practical, data-processors should strictly limit how long video isretained in accordance with the documented purpose of the system.

What should you do?
Review retention time for all cameras, and ensure it is set in accordance with the documented system purpose.

37 | Appendixes

| GDPR Privacy Guide

The right to be forgotten does not often apply to video surveillance, since retention time is usually short andsince other lawful basis overrule 'reasonable' technical and legal interests such as legal obligation(employment act), public interest (crime prevention, public health & security), vital interests (life & healthcritical data, hazardous and dangerous environments), legitimate interests (fraud detection, employment,
product development), or even contractual fulfillment (employment, subscriptions and licensing). An example
of a legitimate interest is that video surveillance recordings must be a trusted source of evidence at any given
time, therefore, the VMS primarily protects video evidence from being tampered with and assuring its
authentication, making the right to be forgotten secondary.
There are usually two reasons for data subjects to object to the storage of video recordings:l

The interests of the data controller to store the data are overridden by the interests or fundamental
rights and freedoms of the data subject which require protection of personal data (Article 17 (1)(c),
GDPR)

l

The personal data have been unlawfully processed, for example the surveillance of a kindergarten or alocker room (Article 17 (1)(d), GDPR)

Therefore, each request must be examined thoroughly.

How long should the recordings be kept?
The general principle is that recordings must not be retained longer than necessary for the specific purposes
for which they were made. It must also be considered whether the recording is necessary in the first place andwhether live monitoring without recording would be enough.
If an organization opts for recording, it must specify the period for which the recordings will be retained. Afterthe lapse of this period, the recordings must be erased. Milestone XProtect VMS automates the process oferasure, by automatically deleting recordings older than the set retention time.
When files containing the recorded video data are deleted by the VMS, the files and their content are actually
not erased from the data blocks on the storage system but simply marked as free in the file system, allowing
other files to be written to this location on the storage system. Until the data blocks are actually overwrittenwith new data, the old deleted video data may potentially be restored, providing access to recordings older
than the set retention time.
Because of this, it is recommended not to over-dimension the storage system, because the risk becomes larger
with the size of the overhead.
For example, if the allocated storage system is twice as large as the amount of video data stored for the set
retention time – for example seven days - the deleted data blocks containing old deleted video data may
statistically lurk around on the storage system for an additional seven days before they are overwritten.
To further reduce the risk of accessing old video data that has been deleted, and for security in general, it isrecommended to enable encryption of the media databases, because this, in addition to restoring the deleted
files, now also requires the encryption to be broken.
Regardless if the video data has been encrypted or not, once the disks in the storage system are no longer
useable, it important that you sanitize or physically destroy the hard disks that have been used to store media
databases before you dispose of them (for example, by shredding or other equivalent means).

38 | Appendixes

| GDPR Privacy Guide

For information about how to set this up in Milestone XProtect, see the Storage and archiving (explained)
section in the administrator manual for XProtect VMS.
If the purpose of the video surveillance is security, and a security incident occurs and it is determined that therecordings are necessary to further investigate the incident or use the recordings as evidence, the relevant
recording may be retained beyond the normal retention periods for as long as it is necessary for these
purposes. Thereafter, however, they must also be erased.
Retention period for typical security purposes: one week to one month
When cameras are installed for purposes of security, one week to one month should be enough time forsecurity personnel to make an informed decision whether to retain a recording for a longer period to further
investigate a security incident or use it as evidence.
An example of local law: according to some German Data Protection Authorities and most of the dataprotection literature, this retention period is from 48 to 72 hours as a guideline for access control andinvestigation of criminal offenses.
Member State or third-country territory: 48 hours
In case the surveillance covers any area outside the buildings on Member State (or third-country) territory(typically those near entrance and exit areas) and it is not possible to avoid that passers-by or passing cars arecaught on the cameras, it is recommended to reduce the retention period to 48 hours or otherwise
accommodate local concerns whenever possible.
Right to restriction of processing
The data subject may, with reference to Article 18 (1) of the GDPR, claim the right to restriction of theprocessing. In a basic VMS scenario, the data subject may claim that the VMS processing is unlawful, forexample if the data subject is unaware that video surveillance of a public space is performed with privacy mask
protection. It is recommended to use a Data Subject Request template to document the claim (see Data subject
request on page 14). For a sample template of a Data Subject Request, see the Milestone Data Subject Request
template.
The claim should be processed within a reasonable time-frame, faster than the retention period to avoid
automated retention or deletion of the VMS evidence in the claim. It is generally advised to seek legal counsel
concerning the restriction of processing. One way to handle such a request is to let the VMS administrator limit
VMS supervisors or operators by role assignment to only be able to playback recordings within a short timeafter they have been recorded – for instance, four hours or one day (see What should you do? on page 40:"Consider restricting access to recorded video for operators, either completely, to only the video recorded in
the past few hours, or only with dual authorization"). Limitations of playback also apply to evidence locks. Iffurther restrictions of processing are required, it is recommended to conduct both a business impact
assessment and a Privacy Impact Assessment (see Conducting an impact assessment on page 33) as part ofthe claim handling.

39 | Appendixes

| GDPR Privacy Guide

Privacy by design
The GDPR mandates that privacy must be a priority throughout system design and commissioning. The
approach taken with respect to data privacy must be proactive, not reactive. Risks should be anticipated, andthe objective must be to prevent events before they occur.
Organizations must carefully consider and document how systems are designed to stay within the statedobjectives.
Care must be paid not to capture personal data of subjects who fall outside of the domain of the system (forexample, adjacent public areas).
Careful consideration of who needs to see what information (for example, live/recorded, time frame,
resolution) and who can access what features (for example, search).
What should you do?
lDocument the resolution of different points in the camera scenelDocument the intended retention timelConsider applying privacy masking – permanent or liftablelConsider setting up permissions for viewing live videos, recordingslConsider restricting access for exporting recordings and for lifting privacy maskslRegularly review roles and responsibilities for operators, investigators, system administrators, andothers with access to the systemlConsider restricting access to groups tasked with investigations for cameras that are specifically
positioned to capture identity (for example, faces of people entering a store)lConsider restricting access to the recorded video for operators, either completely, to only the video
recorded in the past few hours, or only with dual authorizationlLimit the number of users who have an administrator role

Requirements for privacy by design

You must ensure the personal data you are processing is:
Dataminimization

40 | Appendixesladequate – enough to properly fulfill your stated purposelrelevant – has a rational link to that purpose

| GDPR Privacy Guidellimited to what is necessary – you do not hold more than you need for that
purpose.

Generally, for personal data:l

You should take all reasonable steps to ensure the personal data you hold is
not incorrect or misleading as to any matter of fact.

Accuracyl

You may need to keep the personal data updated, although this will depend on
what you are using it for.

l

If you discover that personal data is incorrect or misleading, you must takereasonable steps to correct or erase it as soon as possible.

l

You must carefully consider any challenges to the accuracy of personal data.

l

You must not keep personal data for longer than you need it.

l

You need to think about—and be able to justify—how long you keep personal
data. This will depend on your purposes for holding the data.

lcomply with documented requirements.

Storage period
limitation

You need a policy that sets standard retention periods wherever possible, tol

You should also periodically review the data you hold, and erase or anonymize
it when you no longer need it.

l

You must carefully consider any challenges to your retention of data.
Individuals have a right to erasure if you no longer need the data.

l

You may keep personal data for longer if you are only keeping it for public
interest archiving, scientific or historical research, or statistical purposes.

Privacy by design and privacy by default
According to GDPR, the controller of personal data, when processing such data, must implement technical ororganizational measures which are designed to implement the data protection principles set out in GDPR.
GDPR refers to this as privacy by design.
In the context of a camera, a relevant example of privacy by design would be a feature that digitally allows theuser to restrict image capture to a certain perimeter, preventing the camera from capturing any imagery
outside this perimeter that would otherwise be captured.

41 | Appendixes

| GDPR Privacy Guide

In the XProtect VMS, there is support for privacy masking in two forms: permanent masks that cannot be
removed, and liftable masks that (with the appropriate permissions) can be lifted to reveal the image behindthe mask.
The data controller must also implement technical or organizational measures which by default ensure theleast privacy intrusive processing of the personal data in question. GDPR refers to this as privacy by default. In
the context of a camera, a relevant example of privacy by default could be using privacy masking to keep asensitive area within the view of the camera private.

What is an example of an XProtect feature that supports the privacy by design approach?
Milestone develops its portfolio of products continuously, and privacy by default is a key evaluation criterion in
making XProtect GDPR compliant. For more information, see the guide about the secure development lifecycleat Milestone. This guide is an integral part of privacy by default, applying principles such as "defense-in-depth,""least privileges," and avoiding less secure default settings and turning off infrequently used features bydefault.

What should you do to ensure privacy by design?
lConsider the resolution of different points in the camera scene and document these settings
Different purposes require different image qualities. When identification is not necessary, the camera
resolution and other modifiable factors should be chosen to ensure that no recognizable facial images
are captured.

l

Encrypt your recordings
Milestone recommends that you secure your recordings by enabling at least Light encryption on yourrecording servers' storage and archives. Milestone uses the AES-256 algorithm for encryption. Whenyou select Light encryption, only a part of the recording is encrypted. When you select Strong
encryption, the entire recording is encrypted.

lEncrypt investigations database
Milestone recommends that you secure the investigations database on the Mobile Server.

42 | Appendixes

| GDPR Privacy Guidel

Secure the network
Milestone recommends that you select cameras that support HTTPS. It is recommended that you set
the cameras on separate VLANs and use HTTPS for your camera to recording server communication, as
well as clients to recording server communication.
It is recommended that you enable encryption for all communication between all servers and clients.
For information about securing your XProtect VMS installations, see the hardening guide and thecertificates guide.
It is recommended that XProtect Smart Client and XProtect Smart Wall are on the same VLAN as theservers.
Use a VPN encrypted network or similar if using Smart Client or Smart Wall from a remote location.

lEnable and document the intended retention time
According to Article 17 (1)(a) of the GDPR, recordings must not be retained longer than necessary forthe specific purposes for which they were made. Milestone recommends that you set the retention time
appropriately. This, then, automates the disposal of video.

lSecure exports
Milestone recommends that you only allow access to export functionality for a select set of users thatneed this permission.
Milestone also recommends that the Smart Client profile is changed to only allow export in XProtect
Format with encryption enabled. AVI and JPEG exports should not be allowed, because they cannot bemade secure. This makes export of any evidence material password-protected, encrypted, and digitally
signed, making sure forensic material is genuine, untampered with, and viewed by the authorizedreceiver only.

lEnable privacy masking – permanent or liftable
Use privacy masking to help eliminate surveillance of areas irrelevant to your surveillance target.

43 | Appendixes

| GDPR Privacy Guidel

Restrict access permissions with roles
Apply the principle of least privilege (PoLP).
Milestone recommends that you only allow access to functionality for a select set of users that need thispermission. By default, only the system administrator can access the system and perform tasks. All newroles and users that are created have no access to any functions until they are deliberately configuredby an administrator.
Set up permissions for all functionality, including viewing live video and recordings, listening to audio,
accessing metadata, controlling PTZ cameras, accessing and configuring Smart Wall, lifting privacy
masks, working with exports, saving snapshots, and so on.
Restrict access to recorded video, audio, and metadata for operators, either completely, or restrict
access to only the video, audio, or metadata recorded in the past few hours or less.
Regularly assess and review roles and responsibilities for operators, investigators, systemadministrators, and others with access to the system. Does the principle of least privilege still apply?

lEnable and use two-step verification
Milestone recommends that you specify an additional login step for users of XProtect Mobile orXProtect Web Client by enabling two-step verification.

l

Restrict administrator permissions
Milestone recommends that you limit the number of users that have an Administrator Role.

Setting up and configuring the video surveillance system
The guiding principle in connection with all items addressed in this section should be to minimize any negative
impact on the privacy and other fundamental rights and legitimate interests of those under surveillance.

Camera locations and viewing angles
Camera locations should be chosen to minimize viewing areas that are not relevant for the intended purposes.
As a rule, where a video surveillance system is installed to protect the assets (property or information) of theorganization or the safety of staff and visitors, the organization should restrict monitoring tolcarefully selected areas containing sensitive information, high-value items, or other assets requiring
heightened protection for a specific reason,lentry and exit points to the buildings (including emergency exits and fire exits and walls or fences
surrounding the building or property), andlentry and exit points within the building connecting different areas which are subject to different accesspermissions and separated by locked doors or another access control mechanism.

44 | Appendixes

| GDPR Privacy Guide

Number of cameras
The number of cameras to be installed will depend on the size of the buildings and the security needs, which,in turn, are contingent upon a variety of factors. The same number and type of cameras may be appropriate
for one organization and may be grossly disproportionate for another. However, all other things being equal,
the number of cameras is a good indicator of the complexity and size of a surveillance system and may
suggest increased risks to privacy and other fundamental rights. As the number of cameras increases, there isalso an increased likelihood that they will not be used efficiently, and information overload occurs. Therefore,
the European Data Protection Supervisor (EDPS) recommends limiting the number of cameras to what isstrictly necessary to achieve the purposes of the system. The number of cameras must be included in the Video
Surveillance Policy.

Times of monitoring
The time when the cameras are set to record should be chosen to minimize monitoring at times that are not
relevant for the intended purposes. If the purpose of video surveillance is security, whenever possible, thesystem should be set to record only during times when there is a higher likelihood that the purported security
problems occur.

Resolution and image quality
Adequate resolution and image quality should be chosen. Different purposes will require different image
qualities. For example, when the identification of the individuals is crucial, the resolution of the cameras,
compression settings in a digital system, the location, the lighting, and other factors should all be considered
and chosen or modified so that the resulting image quality would be sufficient to provide recognizable facial
images. If identification is not necessary, the camera resolution and other modifiable factors can be chosen to
ensure that no recognizable facial images are captured.
Who should have access to the VMS?
Access permissions must be limited to a small number of clearly identified individuals on a strictly need-toaccess basis. VMS access policies should be defined following the principle of “least privilege”: access ispermitted to users for only those resources that are strictly necessary to carry out their tasks.
Only the data controller, the system administrator, or other staff members specifically appointed by the data
controller for this purpose should be able to grant, alter or annul access permissions of any persons. Any
provision, alteration, or annulment of access permissions must be made in accordance with criteria
established in the organization's Video Surveillance Policy.
Those having access permissions must always be clearly identifiable individuals.
The Video Surveillance Policy must clearly specify and document who has access to the video surveillance
recordings and/or the technical architecture, for example VMS servers, of the video surveillance system, forwhat purpose and what those access permissions consist of. In particular, you must specify who has thepermissions to

45 | Appendixes

| GDPR Privacy Guidel

View the video/audio in real-timelOperate the pan-tilt-and-zoom (PTZ) cameraslView the recordingslExport, orlDelete any recording

In addition, you must configure access to the following VMS features:lBookmarkslEvidence lockslLift privacy maskslExportl

Trigger eventslStart/stop recordinglCreate/edit/delete/activate/lock/release PTZ presetslCreate/edit/delete/start/stop PTZ patrolling schemeslSmart searchlAudio, metadata, I/O and event permissions

Protecting stored and transmitted data
First and foremost, an internal analysis of the security risks must be carried out to determine what security
measures are necessary to protect the video surveillance system, including the personal data it processes.
In all cases, measures must be taken to ensure security with respect tolTransmissionlStorage (such as in computer databases)l

Access (such as access to servers, storage systems, the network, and premises)

Transmission must be routed through secure communication channels and protected against interception, forexample by doing the following:lEncrypt the media database in the Recording Server and encrypt all communication between servers
and clients. For information about securing your XProtect VMS installations, see the hardening guideand the certificates guide.

lConnect HTTPS camera to the Recording Serverl

Use VPN for Smart Client or Management Client connected via internetl

Use HTTPS for XProtect Mobile client and XProtect Web Client

46 | Appendixes

| GDPR Privacy Guide

Protection against interception is especially important if a wireless transmission system is used or if any data istransferred via the internet. In these cases, the data must be encrypted while in transit, or equivalent
protection must be provided.
Encryption or other technical means ensuring equivalent protection must also be considered in other cases,
while in storage, if the internal analysis of the security risks justifies it. This may be the case, for example, if thedata is particularly sensitive. This is done by enabling encryption of the media database.
All premises where the video surveillance data is stored and where it is viewed must be secured. Physicalaccess to the control room and the server room where the VMS servers are placed must be protected. No third
parties (for example, cleaning or maintenance personnel) should have unsupervised access to these premises.
The location of monitors must be chosen so that unauthorized personnel cannot view them. If they must benear the public areas, the monitors must be positioned so that only the security personnel can view them.
The XProtect VMS logs basic information by default, but we recommend that you enable user access logging in
the Management Client for the audit log.
This digital logging system is in place to ensure that an audit can determine at any time who accessed thesystem, where, and when. The logging system can identify who viewed, deleted, or exported any video
surveillance data (this requires that you enable user access logging).
In this respect, and elsewhere, attention must be paid to the key functions and powers of the systemadministrators, and the need to balance these with adequate monitoring and safeguards.

Accountability
Article 5 (2) of the GDPR states:
The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
Where the principles relating to the processing of personal data are: lawfulness, fairness, and transparency,
purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.
The accountability principle requires you to take responsibility for what you do with personal data.
More specifically, Article 30 of the GDP states:
Each controller and, where applicable, the controller's representative, shall maintain a record of processing activities
under its responsibility.
The record must contain all of the following information:a.

the name and contact details of the controller and, where applicable, the joint controller, the controller's
representative, and the data protection officerb.

the purposes of the processingc.

a description of the categories of data subjects and of the categories of personal datad.

the categories of recipients to whom the personal data have been or will be disclosed including recipientsin third countries or international organizations

47 | Appendixes

| GDPR Privacy Guidee.

where applicable, transfers of personal data to a third country or an international organization, including
the identification of that third country or international organization and, in the case of transfers referred toin the second subparagraph of Article 49 (1), the documentation of suitable safeguardsf.

where possible, the envisaged time limits for erasure of the different categories of datag.

where possible, a general description of the technical and organizational security measures referred to in
Article 32 (1).

Accountability is one of the data protection principles - it makes you responsible for complying with the GDPR
and says that you must be able to demonstrate your compliance.
You need to put in place appropriate technical and organizational measures to meet the requirements ofaccountability.
There are several measures that you can take, and in some cases must take, including:lAdopting and implementing data protection policieslTaking a ‘data protection by design and default’ approach (for more information, see Privacy by design
on page 40)lPutting written contracts in place with organizations that process personal data on your behalflMaintaining documentation of your processing activitieslImplementing appropriate security measureslRecording and, where necessary, reporting personal data breacheslCarrying out Data Protection Impact Assessments for uses of personal data that are likely to result inhigh risk to individuals’ interestslAppointing a data protection officerlAdhering to relevant codes of conduct and signing up to certification schemes

Use a Record of Processing Activities template to identify and track accountability issues. For a sample
template of a Record of Processing Activities, see the Record of Processing Activities template.
Accountability obligations are ongoing. You must review and, where necessary, update the measures you put
in place.
If you implement a privacy management framework this can help you embed your accountability measuresand create a culture of privacy across your organization.
Being accountable can help you to build trust with individuals and may help you mitigate GDPR enforcement
action.

Checklist for securing integrity and confidentiality
The GDPR requires organizations have comprehensive policies and procedures ensuring personal data always
remains within the control of the organization. Additionally, personal data breaches must be reported within
72 hours to the competent supervisory authority appointed by their country’s government.

48 | Appendixes

| GDPR Privacy Guide

Take all appropriate organizational and technical measures to protect against compromising personal data.

What should you do?
lReview security policies around password control and account use.

lConsider setting minimum password strength requirements for all domain groups. Consider settingstronger requirements for administrative accounts on the domain level.

lHave processes in place to audit protection status and detect breaches.

lEnsure users do not share accounts, whether by sharing passwords or by not logging off/on at theend/start of their shift.

l

Maintain a documented policy and procedure governing appropriate actions in the event of a data
breach.

l

You must ensure that you have appropriate security measures in place to protect the personal data you
hold.

l

A key principle of the GDPR is that you process personal data securely by means of ‘appropriatetechnical and organizational measures’ – this is the ‘security principle’.

l

Doing this requires you to consider things like risk analysis, organizational policies, and physical andtechnical measures.

l

You must also take into account additional requirements about the security of your processing – andthese also apply to data processors.

l

You can consider the state of the art and costs of implementation when deciding what measures to take– but they must be appropriate both to your circumstances and the risk your processing poses.

lWhere appropriate, you should look to use measures such as pseudonymization (for example, using
privacy protection with a blurring mask), and encryption.

lYour measures must ensure the ‘confidentiality, integrity and availability’ of your systems and services
and the personal data you process within them.

l

The measures must also enable you to restore access and availability to personal data in a timely
manner in the event of a physical or technical incident.

l

You also need to ensure that you have appropriate processes in place to test the effectiveness of yourmeasures and undertake any required improvements.

Policies to safeguard use of mobile devices
It is recommended that you set up a policy for mobile devices and app usage with measures that include:

49 | Appendixes

| GDPR Privacy GuidelConsider using Mobile Device Management (MDM) softwarelLimit the number of employees with access to XProtect Mobile client or XProtect Web Clientl

Do not allow XProtect Mobile client installations on private devicesl

Do not use private e-mail addresses for accounts on business devices because Google or Apple might
be able to identify the data subjects and may be able to link work and private profileslCreate roles for mobile users that make use of time profileslCreate pseudonymous accounts on mobile devices that will be used by roaming guards. These Google
and Apple accounts could link to a pseudonymous business e-mail address such as"guard01@company-name.com" with the account name "Guard 01".
Using such pseudonymous accounts limits the amount of personal data being processed by Google
and Apple. As such, push notifications do not violate the Schrems II CJEU ruling because personal data
involved with push notifications cannot be de-pseudonymised by any US-based organization or
authority without the help of the organization that operates the VMS.

l

Use two-step authenticationl

If you use the operating system's biometric authentication feature, ensure that using thisauthentication mechanism provides an adequate security level. Biometric authentication improves theoverall security as long as it is used in combination with a strong password policy.
By adopting biometric authentication, you may become data controllers for theprocessing of special categories of personal data, according to Article 9 of the
GDPR on biometric data.

l

Limit the retention time of investigations to a minimum, and document itlAdvise mobile operators to delete screenshots immediately when they are not relevant anymorelDisable automatic backup of image libraries from mobile devices to remote servers such as Google andApple

You must also have policies and procedures in place in the event of lost or stolen equipment, particularly if that
equipment can expose personal data.
If equipment such as a mobile device or smartphone is lost or stolen, you should:lDisable the user accountl

Force a password change for re-enabling the device

50 | Appendixes

| GDPR Privacy Guide

Appendix: On-the-spot noticeOn-the-spot notices should include a pictogram (for example, the ISO pictogram or the pictogram customarily
used where the building is located. The pictogram must also be understandable for children. You can find this,for example, on the ISO graphical symbols page (https://www.iso.org/obp/ui/#search/grs/). The notice must:l

Identify the data controllerlSpecify the purpose of the surveillance:l

For public bodies to perform their tasksl

To exercise the right to determine who shall be allowed or denied accessl

To safeguard legitimate interests for specifically defined purposeslClearly mention if the images are recordedlProvide contact information and a link to the online Video Surveillance Policyl

If any area outside the buildings is under surveillance, this should be clearly stated

Security staff and reception must be trained on the data protection aspects of video surveillance practices andmust be able to make copies of the detailed data protection notice (see Appendix: Video Surveillance Policy on
page 51), available upon request. They must also be able to tell members of the public whom to contact withadditional questions or to access their data.
The signs must be placed at such locations and be large enough that data subjects can notice them before
entering the monitored zone and can read them without difficulty. This does not mean that a notice must beplaced next to every single camera.
The signs within the buildings must be in the language (or languages) generally understood by staff members
and most frequent visitors. Signs outside the buildings (if any areas outside are monitored) must also be
posted in the local language (or languages).
For a sample template of an on-the-spot notice, see the Milestone On-the-spot notice template.

Appendix: Video Surveillance Policy
The Video Surveillance Policy has many purposes and serves to meet the following needs:lAdopting this document is often necessary to complete and specify the legal basis and thus, help
establish a lawful ground for the video surveillance (see Article 5 of the GDPR).

l

Putting practices in writing and thinking through what other additional measures need to be taken arelikely to improve procedures and ensure better compliance.

l

Adopting a policy and making it publicly available will help fulfill the obligation under the GDPR toprovide the public with the information necessary to guarantee fair processing.

l

The policy establishes a set of rules against which compliance can be measured (for example, during an

51 | Appendixes

| GDPR Privacy Guide

audit).
l

By increasing transparency and demonstrating compliance efforts, organizations induce trust in theiremployees and in third parties, and help facilitate consultation with stakeholders.

The Video Surveillance Policy should provide the following:lGive an overview of the video surveillance system and describe its purposeslDescribe how the system is operated, personal data are used, and what data protection safeguards are
put in placelExplicitly confirm compliance with GDPRl

Outline any necessary measures required for implementation

Organizations should make their Video Surveillance Policies publicly available on their intranet and internet
sites. If this document contains confidential information, then a non-confidential version should be madepublicly available.
To be able to serve as an adequate data protection notice, the following information must be integrated into
your Video Surveillance Policy in user-friendly language and format:l

Identity of the data controller (for example, organization, Directorate General, Directorate and unit)lBrief description of the coverage of the video surveillance system (for example, entry and exit points,
computer rooms, archive rooms)l

The legal basis of the video surveillance, for example Article 6 (1)(f) of the GDPRl

The data collected and the purpose of the video surveillance (any limitations on the permissible uses
should also be clearly specified)l

Who has access to the surveillance material, and to whom the recordings may be disclosedl

How the information is protected and safeguardedl

How long the data is keptl

How data subjects can verify, modify or delete their information (including contact information forfurther questions and information on how to obtain recourse in-house)

In addition, the Video Surveillance Policy should provide references to:l

The organization's audit reportsl

The organization's impact assessment reports

For a sample template of a Video Surveillance Policy, see the Milestone Video Surveillance Policy template.
Disclaimer: The sample Video Surveillance Policy must be checked by the data controller.
GDPR compliance using this sample is his area of responsibility.

52 | Appendixes

| GDPR Privacy Guide

Appendix: Data Protection Impact Assessment
According to Article 35 of the GDPR, a Data Protection Impact Assessment is required if the surveillanceis likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to theprocessing, carry out an assessment of the impact of the envisaged processing operations on the protection of
personal data.
The data controller must consult the supervisory authority prior to processing where a Data Protection Impact
Assessment under Article 35 indicates that the processing would result in a high risk in the absence of measurestaken by the data controller to mitigate the risk (Prior Consultation, Article 36 of the GDPR).
Create and maintain a Data Protection Impact Assessment, a notice to individuals affected. This document:lDescribes the purpose of surveillancelIs kept by the data controller or data processorlDefines the retention policy

A Data Protection Impact Assessment should be carried out before installing and implementing video
surveillance systems whenever this adds value to the organization's compliance efforts. The purpose of theData Protection Impact Assessment is to determine the impact of the proposed system on individuals' privacy
and other fundamental rights and to identify ways to mitigate or avoid any adverse effects.
At a minimum, according to Article 35 (7) of the GDPR, the assessment must contain at least:l

A systematic description of the envisaged processing operations and the purposes of the processing,including, where applicable, the legitimate interest pursued by the data controllerl

An assessment of the necessity and proportionality of the processing operations in relation to the
purposesl

An assessment of the risks to the rights and freedoms of data subjects referred to in Article 35 (1) of the
GDPR:
Where a type of processing in particular using new technologies, and taking into account the nature, scope,
context, and purposes of the processing, is likely to result in a high risk to the rights and freedoms ofnatural persons, the controller shall, prior to the processing, carry out an assessment of the impact of theenvisaged processing operations on the protection of personal data. A single assessment may address a setof similar processing operations that present similar high risks.

l

The measures envisaged to address the risks, including safeguards, security measures, andmechanisms to ensure the protection of personal data and to demonstrate compliance with GDPR
taking into account the rights and legitimate interests of data subjects and other persons concerned

The effort that is appropriate to invest in a Data Protection Impact Assessment depends on the circumstances. A
video surveillance system with large inherent risks, or one raising complex or novel issues, warrants theinvestment of much more effort than one with a comparatively limited impact on privacy and otherfundamental rights, such as a conventional static CCTV system operated for typical security purposes.

53 | Appendixes

| GDPR Privacy Guide

In any event and in all cases, whether in a formal Data Protection Impact Assessment or otherwise, theorganizations must assess and justify whether to resort to video surveillance, how to site, select and configure
their systems, and how to implement the data protection safeguards.
In addition, there may be cases where an organization proposes a non-standard system. In this case, theorganization should carefully assess the planned differences from the practice and recommendations, discussthese with their Data Protection Officer and with other stakeholders, and document its assessment in writing,whether in a formal Data Protection Impact Assessment or otherwise. The organization’s audit of the systemshould also address the lawfulness of the customization of the system.
Finally, due to their complexity, novelty, specificity, or inherent risks, it is strongly recommended that you carryout a Data Protection Impact Assessment in the following cases:lVideo surveillance for purposes other than security (including for investigative purposes)lVideo surveillance of public spaceslEmployee monitoringl

Monitoring on Member State territory and in third countrieslSpecial categories of datalAreas under heightened expectations of privacylHigh-tech and/or intelligent video surveillancelInterconnected systemsl

Audio recording

The Data Protection Impact Assessment may be carried out in-house or by an independent contractor. The
assessment should be conducted at an early stage of the project. Based on the results of the Data Protection
Impact Assessment an organization may decide:l

To refrain from or modify the planned monitoring and/orl

To implement additional safeguards

Inherent risks with using VMS
When maintaining the Data Protection Impact Assessment, you should be aware of the risks that are inherent
with using VMS.
The Data Protection Impact Assessment should be adequately documented. As a matter of principle, a Data
Protection Impact Assessment report should clearly specify the risks to privacy and/or other fundamental rightsthat the organization identified, and the additional safeguards proposed. Be aware of the following risks ofimpinging on personal rights:

54 | Appendixes

| GDPR Privacy GuidelCompany / employer, using the video feeds, alarms or audit logs to:lMonitor the work hours of the employees at the surveyed site – for example arrival anddeparture timelMonitor the effectiveness of the employees by monitoring where they spend their time, amountof time spent at the coffee machine, time spent in restrooms, as long as they effectively work at
whichever task they havel

Monitor what the employee is looking at on their computer screenslMonitor if employees comply with work or safety requirements – for example on building siteslShow video recordings of employees to other employees or managers to bully the employee orthreaten other employees to do the samel

Check if security guards / operators perform their duties effectively – for example checking
whether they are actively using the clients, selecting cameras, running playbacks, etc.

lCompany / owner / operator / guards, using the video feeds to:lShare video recordings of people (company employees or the general public) in embarrassing or
sensitive situations on social medial

Use PTZ cameras to zoom in on people to get intimate / inappropriate close-up recordings ofthem without their knowledgelCompany / owner / operator / guardslExport video or providing access to recorded video uncritically to whomever asks for it

Additional sources to identify risk are:l

The Milestone Hardening Guide provides the Cyber Risk Management Framework, describing therecommended six steps of categorizing, selecting, implementing, assessing, authorizing andmonitoring risks. The Milestone Hardening Guide provides a series of technical risks and recommended
implementations to mitigate the risks. These include but are not limited to the protection of VMS
privacy in terms of a series of data breaches and unauthorized access risks from weak technicalconfiguration, design, and maintenance operations. For more information on how to secure yourXProtect VMS installations against cyber-attacks, see the hardening guide.

l

The Milestone Privacy Guide (this) provides recommendations on handling the non-technical operationalrisks, including handling of data subject rights and requests, roles, and responsibilities of a VMS,
templates for On-the-spot-notice, Video Surveillance Policy, and Data Processor Agreements.

l

The Milestone end-user privacy e-learning provides awareness training for VMS operations andsupervisors on how, in everyday operation, to handle VMS-related privacy risks. See more informationon the Milestone GDPR-ready website.

Appendix: Data Processor Agreement
The data controller must have a Data Processor Agreement with any third party with whom the data controller
shares video surveillance media except for sharing video surveillance media with law enforcement.

55 | Appendixes

| GDPR Privacy Guide

If an organization outsources all or part of its video surveillance activities to a third party (a data processor), it
remains liable for compliance with GDPR as a data controller. For example, security guards monitoring live
surveillance video in the reception area of an organization working for a private company to whom theorganization outsourced the task of live monitoring. In this case, the organization must ensure that the
security guards carry out their activities in compliance with the provisions of the GDPR.
For a sample template of a Data Processor Agreement, see the Milestone Data Processor Agreement template.
Disclaimer: The sample Data Processor Agreement must be checked by the data
controller. GDPR compliance using this sample is his area of responsibility.

Appendix: The Milestone XProtect VMS system and GDPR
Components and devices that are not covered
The following components are not covered here:lPlug-ins available on Milestone marketplacelXProtect Access (disabled by default)lXProtect LPR (disabled by default)lXProtect Transact (disabled by default)lMilestone InterconnectlXProtect DLNA ServerlMilestone Open Network Bridge (secure private-to-public video integration)lXProtect Rapid REVIEWl

XProtect Event Server plug-inslProcessing of audio data (disabled by default)l

Processing of metadata (disabled by default)l

Processing of data from input and output devices (disabled by default)lXProtect BYOL as provided via https://aws.amazon.com/marketplace/pp/prodview-ryozifnbg4kas

Upgrade guideIf you are upgrading a Milestone XProtect VMS installation version 2018 R2 or earlier, the old log files must be
deleted manually for the installation to be GDPR compliant.
After you have upgraded the XProtect VMS, the old log files can be deleted using the information and the tool
described in this Knowledge Base article.

56 | Appendixes

| GDPR Privacy Guide

Backup the SQL Server databases
It is recommended to make a backup of the SQL Server database, particularly before starting an upgrade, sothat you can restore the previous working installation in case the upgrade fails. Whether the upgrade is madefrom the XProtect installer or the Management Client, or made through the native SQL Server functions, youmust keep the backup data in a secure place and not store it on a cloud drive if the cloud vendor is outside EU,
such as Microsoft.

Do not use a managed SQL Server service
While XProtect supports the use of externally managed databases such as Azure SQL Database, this possibly
exposes personal data outside the EU. For GDPR compliancy, do not use a managed SQL Server service.

Secure network for authentication and data transmission
Design a network infrastructure that uses physical network or VLAN segmentation as much as possible.
Milestone recommends that you select cameras that support HTTPS. It is recommended that you set thecameras on separate VLANs and use HTTPS for your camera to recording server communication, as well as
clients to recording server communication.
It is recommended that XProtect Smart Client and XProtect Smart Wall are on the same VLAN as the servers.
Use a VPN encrypted network or similar if using Smart Client or Smart Wall from a remote location.
Enable encryption for all communication. For information about securing your XProtect VMS installations, see
the hardening guide and the certificates guide.

Data collection and privacy settings
While you are able to collect usage data in XProtect Mobile server, XProtect Mobile client, and XProtect Web
Client, this may risk violating the GDPR.
From the XProtect Management Client, you can enable usage data collection in the Options dialog box on the
Privacy settings tab.
This usage data provides information on crashes and usage statistics. The data is processed using Google
Firebase.
If you enable data collection, you risk violating the GDPR by activating Google Analytics.
Processing by Google occurs outside the EU.

Although the data is set to be anonymized, Milestone cannot guarantee that Google
cannot derive personal data from the data processed by them.

57 | Appendixes

| GDPR Privacy Guide

When conducting a Legitimate Interests Assessment (LIA), refer to the following:lMilestone Privacy PolicylGoogle Privacy and Security in Firebase

The European Data Protection Board (EDPB) is of the opinion that a consent according Article 49 (1)(a) of the
GDPR is not applicable to Google Analytics, because the processing for the purpose of analytics is not an
exception (see International Association of Privacy Professionals on Schrems II).
Refer to any updates to the Schrems II judgment by the EU Commission on the official website.

Masking individuals in the case of accessAccording to Article 15 of the GDPR, the data subject has the right to get access to his or her personal data thatis being processed, for example, video recordings of the data subject.
The data subject is granted the right to ask a company for information about what personal data (about him orher) is being processed and the rationale for such processing.
Because XProtect VMS does not support automatic identification of individuals, you must put in place
additional measures to safeguard the individuals’ rights. In the VMS context, see Appendix: On-the-spot noticeon page 51.
More so, XProtect VMS does not support the masking of other persons who are moving who are recorded
together with the claimant for the right of access.
Several Milestone technical partner solutions for dynamic blurring of all or other persons before export can befound on Milestone Marketplace. Alternatively, blurring can be added to single images or video streams either
manually or assisted after export. Some companies offer blurring as a service (for example, FACIT Data
Systems).

Deleting video recordings partially
According to Article 17 of the GDPR, the data subject has the right to ask for the deletion of their data. In the
VMS context, this is often not fulfilled due to overriding legitimate interests (fraud detection, health, andsafety) or other business purposes stated in the Video Surveillance Policy (see Right to be forgotten (Right toerasure) on page 37 and Appendix: Video Surveillance Policy on page 51). The Video Surveillance Policy defines
the automatic retention (default 7 days) that ensures automatic deletion of footage, and this must fairly
balance data subjects' rights against reasonable business purposes.
If a data subject requests their data to be deleted, it is recommended that the data controller uses a Data
Subject Request to document the claim (see Data subject request on page 14). For a sample template of a Data
Subject Request, see the Milestone Data Subject Request template.
You must delete all recordings from the camera or cameras in question.
To retain all the other recordings that should not be deleted, export all of the data and keep it secure. You
cannot restore this data back to the VMS.

58 | Appendixes

| GDPR Privacy Guide

Any export must be encrypted and digitally signed, and exclude the specified time intervals from the specificspecified camera or cameras. That is, export up to the time/date and export after the time/date. This may
result in multi-time period backups.
The Smart Client – Player can then be used to view the data.
It’s recommended that the data controller seek legal counsel, conduct both a business impact assessment anda Privacy Impact Assessment (see Conducting an impact assessment on page 33) before the right to beforgotten of the data subject is executed, since deletion may introduce new business risks that may tip thebalance of interest and introduce risks affecting the privacy protection of other data subjects negatively.

Using geographic backgrounds in XProtect Smart Client
XProtect Smart Client supports the use of geographic backgrounds. These backgrounds display map
backgrounds.
You risk violating the GDPR if you use any of the following map services:l

Bing Mapsl

Google Mapsl

Milestone Map Service

These services do not provide adequate safeguards regarding the processing of personal data in the US. The
customer becomes (joint) controller regarding the processing of the user data.
Refer to any updates to the Schrems II judgment by the EU Commission on the official website.
As an alternative, it is recommended that you set up the private OpenStreetMap service for the geographic
background.

Integrations from registered partners
When a license is activated, Milestone collects data on a "per integration" basis. The XProtect VMS gathers data
about plugins and plugin manufacturers and about the plugins and integration that the customer uses.
The data that is collected from each installation are:l

Integration namelIntegration manufacturerlIntegration versionlIntegration type (standalone, Smart Client, Management Client, Event Server) and number of instancesof each type (that is, how many clients are running the plugin)

Plugin developers must never use personal names when registering their product. Only use the company
name.

59 | Appendixes

| GDPR Privacy Guide

The data is only processed by Milestone if the plugin manufacturer is listed in the marketplace and has
approved the processing of the data for the purpose to improve Milestone XProtect Corporate (and not formarketing and market research). If the plugin is not registered, then the data is immediately deleted. The legal
basis of processing is Article 6 (1)(f) of the GDPR, which shows legitimate interests of Milestone and the usersof the VMS.

Additional safeguards
To better ensure that the Milestone XProtect VMS configuration is GDPR compliant, this list provides you withsome additional safeguards to keep in mind when configuring the system.

Hints for the data

Issue

Negative impact on privacy

PTZ cameras and privacy

The privacy enhancing effect of theMilestone recommends

masking do not work

masking can be circumvented.

that you do one of thetogether. The maskings do
not follow the PTZ motions.

controller

following:l

You should not use
the XProtect built-in
privacy masking
feature on PTZ
cameras because
the mask is static
relative to theimage's decoded
pixels and not theactual direction /location of the PTZ
camera.

l

Deactivate PTZ
functionality when
you use masks.

60 | Appendixes

| GDPR Privacy Guide

Issue

Negative impact on privacy

Hints for the data
controllerlPurchase PTZ
cameras that
support dynamic
privacy masking (sothe selected areas
always are masked
no matter thelocation and zoomof the camera).

Use of microphone or

The usage of microphones may easily

Before you activate

metadata devices may

violate GDPR compliance.

microphones or metadata

impinge on personal privacy.

devices, you must ensure(In XProtect Corporate, thesethat you have a clearly

are by default deactivated.)justified purpose forcollecting data. See Do you
have a lawful basis forcollecting data? on page 29

Operators andPersonal data leaves the governance

Data controllers shall takeadministrators can export orborders of XProtect VMS. The data is nottechnical andcopy video data, video

protected by XProtect VMS's access control

organizational measuresarchives, configuration

mechanisms anymore and it cannot be

to protect data that leaves

backups, and audit logs todeleted by XProtect VMS when thethe boundary of XProtect

local hard drives orretention period is reached. This bears theVMS. See Handlingremovable media like CDs,

risk that the data is stored longer thanexported data on page 22

DVDs, USB flash drives, etc.

allowed, that it is used for different

for possible measures topurposes, and that the confidentiality oftake.

the data is violated.
Audit log data and other

Especially, the sensitive audit log data may

personal data are not

be disclosed to unauthorized users. See

encrypted by the productProtecting stored and transmitted data on

before it is stored in the SQL

page 46. For more information on how toServer databases.

secure your XProtect VMS installations

Database administrators canaccess audit log data using

61 | Appendixes

against cyber-attacks, see the hardening
guide.

Do the following:lImplement anadequate roleconcept for the
databaseadministration.

| GDPR Privacy Guide

Issue

Negative impact on privacy

database clients. XProtect

Hints for the data
controllerlLimit the access to

Corporate cannot control or

the database tolog this access.

authorized
personnel only.
l

If possible, activate
encryption of thedatabase using
databasemechanisms.

The backups of the SQL

Set a system configuration password toProtect the overall system

Server configuration

protect sensitive account information in

configuration by assigning

database are not encrypted.

extension to encrypting the SQL Servera system configuration

database.

password.

Backups of the SQL Server configuration

After you assign a system

database are automatically encrypted

configuration password,when the configuration database isbackups are protected bypassword protected.

this password.
The password settings are
stored on the computerthat is running themanagement server in asecure folder. You willneed this password to:lRestore theconfiguration froma configuration
backup that was
created withpassword settings
different than thecurrent password
settings

62 | Appendixes

| GDPR Privacy Guide

Issue

Negative impact on privacy

Hints for the data
controllerlMove or install the
management
server on anothercomputer due to a
hardware failure(recovery)lConfigure an
additional
management
server in a systemwith clustering

For more information, see
the administrator manualfor XProtect VMS.
The product implements aA physical destruction of the data carrier

Consider creating audit log

backup feature. This featurethat holds the audit log database might

database backups.

backs up the configuration of

prevent the data controller from fulfilling

the VMS but not the audit log

its accountability duties when no backups

database.

of the audit logs exist.

If the data controller
decides to create backupsof the audit log database,one should also establish aprocess to delete thebackups when theretention period is reachedand protect it against
unauthorized access (forexample, encrypting the
backup, locking away the
backup media, etc.). For
more information, see theadministrator manual for
XProtect VMS.

Operating a VPN in split

When split tunneling is enabled, users

mode might reveal the

bypass gateway level security that might

private IP address of

be in place within the network

63 | Appendixes

Do the following:

| GDPR Privacy Guide

Issue

Negative impact on privacy

XProtect VMS users.

infrastructure.

Hints for the data
controllerl

Use a secure VPN
connection (a VPN
is secure by default,
but some old VPN
protocols do notencrypt the dataexchanged
between the server
and the client)l

Always use Fulltunnelingl

Use the highest
supported
authentication
protocols (ifpresent)l

Use Active Directory
to authenticate VPN
users

For more information on
how to secure yourXProtect VMS installations
against cyber-attacks, see
the hardening guide.
The product allows for

Setting the retention time to periods that

The retention times mustsetting retention times forare too long might violate the GDPR

be adapted to theaudit logs, video data,requirements for storage limitations

processing purposes (seealarms, and other personal(Article 5 (1)(e) and Article 17 of the GDPR).

Right to be forgotten

data.

(Right to erasure) on page
37).

Administrators can configure

A typo might possibly lead to a data

Make the data controller

email recipients that may

breach when a third party receives emails

aware of this risk.

receive video snippets orwith video data and system alarms.

image stills from the VMS

64 | Appendixes

Milestone recommends

| GDPR Privacy Guide

Issue

Negative impact on privacy

Hints for the data
controller

when certain events occur. It

that you establish an

is not possible to configure aorganizational process

whitelist of allowed domains

such as a four-eyes

for such email recipients.

principle that reduces therisk for failures whenentering email addresses.

Notifications are emails that

Because the attached snapshots and AVI

Since emails and theirare sent to a specified email

sequences in notifications leave the VMS,

content leaves the user

address. When creating athey are outside the control of the VMS foraccess and retention

notification, theuser access and retention.

control of the VMS, it isadministrator can choose torecommended not toinclude a set of snapshots or

attach images or AVI

an AVI of a sequence.

sequences to email
notifications.
If the customer needs thisfeature, they at least mustensure that there areorganizational procedures
and controls for who
receives the emails andhow they are handled. See
Handling exported data in
notifications and email on
page 23.

When push notification is

Although the content of push notification

According to Article 49 (1)enabled, the vendor of themessages is set to be anonymized,(a) of the GDPR, a consent

mobile operating system

Milestone cannot guarantee that Google

from the VMS operator is(that is, Google or Apple)

and Apple cannot derive personal datanecessary if pushprocesses data to deliver thefrom the data processed by them. The

notification is activated.

push notifications to thevendors of the mobile operating systemsmartphones.

(that is, Google or Apple) use a message
addressing scheme. This scheme involves
registration tokens and Installation IDs of
the mobile client app. This enables thevendors to deliver the messages to the

65 | Appendixes

It is recommended toacquire consent orotherwise deactivate pushmessages.

| GDPR Privacy Guide

Issue

Negative impact on privacy

Hints for the data
controller

corresponding apps on the devices. For
Google and Apple, the token and theInstallation ID are pseudonyms.
The XProtect Incident

When incident reports are made available

Only include the controller

Manager enables

outside the controller's or operator’sor operator names inorganizations to document

sphere, personal data may be revealed.

incident reports if there isincidents and combine themControllers or operators should only

a specific and reasonablewith sequence evidence

create reports with clear, identifiablepurpose for including the(video and, potentially,

names of the controller or operator whennames.

audio) from their XProtect

there is a clear need, depending on the

VMS. Controllers or

purpose and recipient of the report.

operators can create incident

Controllers or operators
should only select theShow user name check

reports that contain thebox if there is a specifictextual information added toand reasonable purpose

an incident project. Thesefor including the names inreports may contain thethe report.

controller’s or operator’s
personal data, that is, theirname.
Controllers or operators can

When alarms are made available outside

Only include the controller

create alarm reports thatthe controller's or operator’s sphere,or operator names incontain information about

personal data may be revealed. Controllers

alarm reports if there is a

the alarm, including theor operators should only create reports

specific and reasonable

alarm history and, if

with clear, identifiable names of the

purpose for including theavailable, a still image fromcontroller or operator when there is a clear

names.

the time of the alarm. These

need, depending on the purpose andreports may contain therecipient of the report.

controller’s or operator’sControllers or operators
should only select the
Display names check box

personal data, that is, their

if there is a specific andname.

reasonable purpose forincluding the names in thereport.

Alarm reports may containIf reports are given to third parties, theConsider to manually

images that show

rights of non-involved bystanders might

blacken or mask the

bystanders.

be violated.

images on PDF reports orprintouts.

66 | Appendixes

| GDPR Privacy Guide

Appendix: Data processing in the Milestone XProtect VMS
environment
The Milestone System Architecture Document describes the components of the system and the way how theyinteract with each other and with system components of the environment. For each of the relevant use casesof the product, you find a diagram that illustrates the communication flow between the components that are
involved in the use cases. These diagrams give a general overview of the transferred data. For information
about how the components of the Milestone XProtect VMS interact, see the Milestone document describing thesystem architecture.
This section lists the default XProtect installation processes of personal data, authentication and configuration
data that are relevant for privacy and security settings.

Personal data from the VMS
The main data type is the video data from video cameras. This data is stored by the Recording Server service.
Video data can be either streamed live or in playback modus to the XProtect Smart Client. The other piece ofdata is the master data of VMS users which is stored in the SQL Server database.

Personal data from the environment
Personal data about the VMS users comes from the environment in two circumstances:l

From the Windows environment where Active Direct (AD) is used for user authentication and as asource for group memberships. The Milestone XProtect Management Server service queries the AD
through the LDAP protocol to get information about the users who are logging on to the system.

l

From third-party external IDP services, where Basic Users are managed in this service.

Personal data from the system
This personal data encompasses all kinds of data that is needed to secure, configure, operate, maintain, orotherwise support the system. Types of personal data include:l

Log data
IT systems usually log user and system data into audit and debug log files in order to help operate andmaintain the systems. XProtect Corporate does so, as well. The VMS logs information about user actions
and saves it in the Log Server (SQL Server). This audit log is used to comprehend the accountability forpast actions and system behavior and to track misuse of the system. Debug log files are used to identify
defects and flaws in the system. Debug data does not contain personal data.
Log entries may reveal detailed information about the operators and administrator’s usage of thesystem and may be suitable to monitor employee behavior and performance.

67 | Appendixes

| GDPR Privacy GuidelAuthentication logging
The Duende OAuth authorization server and Identity Provider (IDP) create audit log files. These files are
saved in the Log Server (SQL Server), and all debug logs have had personal data and identity markers
removed. These audit logs can be seen from the XProtect Management Client.

Authentication and authorization datal

User authentication at the VMS
There are three options to authenticate VMS users of XProtect Management Client and XProtect Smart
Client. You can either use the Windows logon mechanisms, the VMS native authentication, or use an
external IDP.
In a Windows Active Directory environment, you can configure to use the built-in Windows logon
mechanism. Authentication with Windows logon is based by default on the Kerberos protocol. This is
the most secure option. In legacy environments, domain controllers might not support Kerberos. In thiscase, Windows logon automatically falls back to the NT LAN Manager protocol (NTLMv2), which isdeemed to be less secure than Kerberos.
In environments without a Windows domain controller, you can use the XProtect native authentication
method, which is basic authentication with user ID and password against the local Identity Provider or
the Windows for workgroups authentication, if this is available.
Alternatively, you can use an external IDP. An external IDP is an external application and service inwhich you can store and manage user identity information and provide user authentication services toother systems. You can associate an external IDP with the XProtect VMS.
To ensure data protection, do not use third-party IDPs from the internet. If you
use an external IDP, it must be locally installed and managed by the sameorganization or company that runs the VMS.

There are three types of authentication credentials:lWindows logon tokens (either Kerberos or NTLM tokens)lBasic Authentication credentialslWindows for Workgroups authentication

After successful authentication, the user is logged on at the VMS and a user session is created by theManagement Server service, where the logon happens. The client can now access the Management
Server service functionality in the context of this user session. When the user wants to accessfunctionality in the Recording Server service, the XProtect Smart Client needs a user session with thisserver service as well.

68 | Appendixes

| GDPR Privacy Guidel

User authorization in the Recording Server service
Since the user session between the XProtect Smart Client / XProtect Management Client and theManagement Server service cannot be reused to access the Recording Server, the Recording Serverneeds to authorize the user as well. In order to authorize at the Recording Server service, theManagement Server service provides the client with an authorization token, which the client needs topresent to the Recording Server service. At the same time, the Management Server service sends theauthorization token to all Recording Server services in the VMS installation. These in turn can be used toauthorize users afterward.
XProtect VMS uses a simple GUID as such an authorization token, which the client sends to the
Recording Server service. The GUIDs are created and managed by the Management Server service,
which renews these tokens after a specified period. The GUID is simply an identifier for the user in the
SQL Server database.

lAuthorization data
The authorization data for VMS users is stored in the SQL Server database on SQL Server. At the start-up
time, the Management Server and Recording Server services pull the relevant authorization data,
including authentication tokens for all users from the SQL Server database in order to be prepared for
subsequent user access to the servers. When an administrator changes permissions or roles oranything else that affects user authorization, this update is stored by the Management Server service in
the SQL Server database on SQL Server and also actively propagated to all Recording Server services.
The Recording Server services store user authorization data and all authentication tokens locally andthus can immediately authenticate client users presenting their authentication token.

lConfiguration data
Apart from view data, which is set by the XProtect Smart Client, all configuration data for the VMS
system is configured through the XProtect Management Client of the VMS and stored in the SQL Server
database. There are different types of configuration data:l

User settings and preferencesl

User permissionslServer configurationl

System settingsl

Camera and device configuration

While configuration data may not contain personal data, it may affect the way how the VMS processes
personal data. For evaluation only, the authorization information and security and privacy settings
among the configuration data listed above are relevant.

Personal data and registered mobile devices
When you uninstall the XProtect Mobile app or disable the device, the device data may still be kept in the VMS
database.
The VMS removes the device registration data when:69 | Appendixes

| GDPR Privacy Guidel

You remove a user from the system.

lMilestone Care Plus has not been renewed for more than 180 days.

However, there are scenarios when the device registration data is not automatically removed.
You must manually remove one or all registered devices when:l

A user has lost his phone.

l

You want to uninstall the mobile server completely and remove its data.

l

A user has stopped using the XProtect Mobile client app or notifications.

l

You have added an Active Directory (AD) group to a VMS role and the permissions for a user havechanged. When you add an AD group, the VMS does not see the users in that role. If you remove a userfrom an AD group or restrict the user from using the mobile server, you must also manually remove theuser's device from the list.

Appendix: Data processing performed in external cloud services
Personal data is collected and processed in the following circumstances:l

When push notification is enabled:
In this case, both Milestone and the vendor of the mobile operating system (that is, Google or Apple)
process data to deliver the push notifications to the smartphones.

l

When the collection of usage data is enabled:
In this case, Milestone and Google process usage data and crash data from the XProtect Mobile clientand XProtect Web Client.
Processing by Google and Apple occurs outside the EU.

Although the data is set to be anonymized, Milestone cannot guarantee that Google andApple cannot derive personal data from the data processed by them.

The VMS controller is responsible for conducting a Legitimate Interests Assessment (LIA) and informing theVMS operators that data from the smartphone will be processed by the vendor of the mobile operating
system.
With regards to Google, Milestone products are compliant with privacy guidelines as described here:
Crashlytics and App Distribution Data Processing and Security Terms.
With regards to Apple iOS, Milestone products are compliant with privacy guidelines as described here: User
Privacy and Data Use.
If processing of this data is a concern, to avoid it:

70 | Appendixes

| GDPR Privacy Guidel

Do not use push notificationslDisable usage data collection. This can be done both in the installer during installation of the Mobile
Server and in the Management Client in the Options dialog box on the Privacy settings tab.

71 | Appendixes

| GDPR Privacy Guide

Index

data controller 10, 17, 66
accountability 47
interests 31

Aoperator 21, 66

access permissions 19, 44-45

responsibilities 17, 52, 56

accountability 47-48

roles 18

administrator 44, 61

security officer 19

alarm reports 66

system administrator 21

audit logs 47, 61, 63
access 19, 61

data processing 57, 67
in external cloud services 70

authentication 50, 68

data processor 10, 25

B

Data Processor Agreement 10, 18, 25, 28, 55

biometric authentication 50

Data Protection Impact Assessment 17-18, 24, 26,
33, 48, 53, 59

breach 25

data protection officer 18

C

appoint 18

cameras 44

responsibilities 18

PTZ 60

data subject 12compliance 29

request 14, 58

levels of regulation 30

rights 12, 32, 58

configuration password 62

Data Subject Request template 14, 28, 58

cybersecurity

delete data 58

training 20

DE
email 23, 50, 64

data backup 63

encryption 24

data breach 25, 48

exported VMS data 23

Data Breach Notification 28

retention 24

data collection 57, 70-71

encryption 42
evidence lock 24

72 | Index

| GDPR Privacy Guide

export of VMS data 22, 43, 61Lin email 23

legal obligation 30

in notifications 23, 65

Legitimate Interests Assessment 58, 70

training 20

log data 67

XProtect Smart Client 23, 43
XProtect Web Client 23

M
media galleriesG

mobile device 23

GDPR

metadata devices 61

compliance 29

microphone 61

definition 9

Milestone Interconnect 56

developments 27

Milestone Open Network Bridge 56

full-text reference 27

Milestone Privacy Policy 58

history 9

mobile device 49

penalties 10
purpose 9

media galleries 23
mobile device management 23, 50

requirements 26
responsible 10
rules concerning transfers 33, 36

N
network 43, 46, 57
VPN 63stakeholders 12
Google Analytics 57

noticeOn-the-spot notice 18, 27-28, 51, 58

Google Firebase 57

right of information 18, 27-28

I

notification

Identity Provider (IDP) 67-68

data breach 25

impact assessment See Data Protection Impact

exported VMS data 23, 65

Assessment
incident reports 66

O

investigations database 42

operator 21
privacy guide for VMS operators 21-22, 27
training 21-22, 27

73 | Index

| GDPR Privacy Guide

responsibilities

P

data controller 17

password 19, 21, 43, 49-50, 68

data protection officer 18

configuration 62
penalities 10

security officer 19

permissions 44

system administrator 21

personal dataretention 38, 43, 50, 64
scenarios 39

definition 14
handling 27

right of access request 14

stored by XProtect 16

rightsdata subject 12

policies and procedures 17-18, 26, 48-49, 51

individual rights 34

mobile device management 23

right to access 27, 36

privacy
by design 40

right to be forgotten 37, 58

by design versus by default 41

right to erasure 37, 58

guidelines 70

right to restriction of processing 39

how to ensure 40, 42

risks
inherent with using VMS 54, 64

impact on rights 30, 61
requirements for privacy by design 40
privacy masking 42-43, 58
privacy settings 57
PTZ cameras 60
public task 30
push notification 50, 65, 70-71

S
secure 43
secure development lifecycle 42
security officer
responsibilities 19
Smart Client Player 59
SQL database

R
Record of Processing Activities 17-18, 26, 30, 48
template 17, 28
requestdata subject 14

backup 57
managed service 57
stakeholders 12
stored data 16, 46, 58
system administrator 21

74 | Index

| GDPR Privacy GuideT

X

template 28

XProtect

Data Breach Notification 25, 28

access permissions 19

Data Processor Agreement 28, 56

components and devices not covered 56

Data Subject Request 14, 28

data processing 67

On-the-spot notice 27-28, 51

integrations 59

Record of Processing Activities 17, 26, 28

reduces impact on privacy rights 32

Video Surveillance Policy 28, 52

retention 38

third-party data processor 25

stored data 16, 46

training

transmitted data 46

cybersecurity 20

version 56

data protection 20, 25

XProtect Access 56

export of VMS data 20

XProtect DLNA Server 56

video push 20

XProtect Event Server 56, 59

two-step verification 44, 50

XProtect Incident Manager 66
XProtect LPR 56

U

XProtect Management Client 46-47, 57, 59, 68-69,

user permissions 19

71
XProtect Management Server 67-69, 71

V

XProtect Mobile Client 44, 46, 50, 57, 69-70

video push 24
training 20
Video Surveillance Policy 14, 17-19, 22, 26, 28, 45,
51, 58
VMS
access 19
risks 54
VMS owner 10

XProtect Mobile Server 42, 57, 69
XProtect Rapid REVIEW 56
XProtect Recording Server 46, 67-69
XProtect Smart Client 17, 43, 46, 57, 59, 67-69
alarms 66
export 23, 43
geographic backgrounds 59
XProtect Smart Wall 43-44, 57
XProtect Transact 56

75 | Index

| GDPR Privacy Guide

XProtect Web Client 44, 46, 50, 57, 70
export 23

76 | Index

helpfeedback@milestone.dk

About Milestone
Milestone Systems is a leading provider of open platform video management software; technology thathelps the world see how to ensure safety, protect assets and increase business efficiency. Milestone
Systems enables an open platform community that drives collaboration and innovation in the development
and use of network video technology, with reliable and scalable solutions that are proven in more than
150,000 sites worldwide. Founded in 1998, Milestone Systems is a stand-alone company in the Canon
Group. For more information, visit https://www.milestonesys.com/.