GDPR For Access Control Guide

By: IPVM Team, Published on Jul 03, 2018

Electronic access control is common in businesses plus organizations are increasingly considering biometrics for access control. With GDPR coming into force this Spring, it is important to understand how this will impact these systems.

IPVM has already published an extensive guide about the GDPR’s effect on video surveillance. This new 13-page guide covers GDPR’s effect on the access control industry since much of the data collected for access control purposes – e.g., names, addresses, fingerprints – are personal data whose processing is clearly regulated by the GDPR.

The guide has the following core sections:

  • Where Access Control Providers Fit into GDPR categories of controllers and processors
  • Why Processors Aim To Keep Distance
  • Legal Basis for Processing Access Control
  • Impact of Biometrics on Access Control GDPR Requirements
  • Dealing With Employees Who Refuse Biometrics Consent
  • Access Control Systems Excluded From Biometrics Claim
  • Guidelines for Storing Access Control data
  • Handling Right to be forgotten/Right to information requests for access control systems
  • Encrypting / Anonymizing access control information
  • Concerns with AD / LDAP integrations
  • Data breach response for access control
  • Data Protection Impact Assessments for access control systems
  • Dealing with Data Specific to Access Control, e.g. Physical Activity Log
  • Manufacturer GDPR guides including Avigilon, Brivo, Genetec, Lenel, Paxton, RS2, S2, Tyco

Introduction

To start, it’s important to realize that the GDPR is a broad set of regulations which do not mention particular industries, including access control or its products.

Therefore, anyone claiming to provide “GDPR certification” for particular products in access control or any other industry is wrong. (See IPVM’s previous report: Dahua Products Are Not GDPR Compliant, No Products Can Be.)

Data Controller and Data Processors

The GDPR creates two distinct categories – data controllers and data processors. Controllers are the firms which gather and control the use of peoples’ personal data, and processors are the ones who process that data on behalf of controllers.

The distinction is important as data controllers typically have more responsibilities under the GDPR; for example, only controllers have a duty to report data breaches to authorities.

Access Control GDPR Category Examples

As in video surveillance, access control end users would typically be considered “data controllers.” For example, if a pharmaceutical company buys an access control system for a new building and its employees, the pharma company is the data controller.

Data processors are the companies which handle the personal data collected by end users. For access control, in most cases this means firms like Genetec, Lenel, Software House, S2 Security, etc..

Access control integrators/installers could also be considered data processors depending on whether they handle their end users’ personal data or not. For example, an integrator with temporary access to employees’ personal addresses for maintenance purposes would be considered a data processor in this instance.

Processors Keep Distance

Many data processors in the access control industry emphasize that they can only provide the means to comply with the GDPR’s provisions, rather than assuring compliance in and of themselves.

Because access control involves data which is very easy to immediately identify people with (unlike video surveillance), processors are keen to distance themselves from end users/data controllers in case those end users mishandle the data.

For example, S2 Security says in its public GDPR guide that it may not be considered a data processor in some cases because “on-premises deployments of access monitoring and video management systems often do not involve a Data Processor because the Data Controller handles all personal data.” S2 is correct when it comes to on-premise deployments.

However, it is worth remembering that firms providing cloud-connected access control solutions would be considered data processors under the GDPR. Moreover, as more systems are moving to the cloud, either for hosting, management or access, access control providers are more likely to fall under the data processor category.

Main Points of Compliance for Access Control

Legal Basis of Processing

********** ****** ******* ** common ** ********** **** organizations *** ************ *********** biometrics *** ****** *******. With **** ****** **** force **** ******, ** is ********* ** ********** how **** **** ****** these *******.

**** *** ******* ********* an********* ***** ***** *** GDPR’s ****** ** ***** surveillance. **** *** **-**** guide ****** ****’* ****** on *** ****** ******* industry ***** **** ** the **** ********* *** access ******* ******** – e.g., *****, *********, ************ *** ******** **** whose ********** ** ******* regulated ** *** ****.

*** ***** *** *** following **** ********:

  • ***** ****** ******* ********* Fit **** **** ********** of *********** *** **********
  • *** ********** *** ** Keep ********
  • ***** ***** *** ********** Access *******
  • ****** ** ********** ** Access ******* **** ************
  • ******* **** ********* *** Refuse ********** *******
  • ****** ******* ******* ******** From ********** *****
  • ********** *** ******* ****** Control ****
  • ******** ***** ** ** forgotten/Right ** *********** ******** for ****** ******* *******
  • ********** / *********** ****** control ***********
  • ******** **** ** / LDAP ************
  • **** ****** ******** *** access *******
  • **** ********** ****** *********** for ****** ******* *******
  • ******* **** **** ******** to ****** *******, *.*. Physical ******** ***
  • ************ **** ****** ********* Avigilon, *****, *******, *****, Paxton, ***, **, ****

************

** *****, **’* ********* to ******* **** *** GDPR ** * ***** set ** *********** ***** do *** ******* ********** industries, ********* ****** ******* or *** ********.

*********, ****** ******** ** provide “**** *************” *** particular ******** ** ****** control ** *** ***** industry ** *****. (*** IPVM’s ******** ******:***** ******** *** *** GDPR *********, ** ******** Can **.)

Data ********** *** **** **********

*** **** ********** ******** **********– **** *********** *** data **********. *********** *** the ***** ***** ****** and ******* *** *** of *******’ ******** ****, and ********** *** *** ones *** ******* **** data ** ****** ** controllers.

*** *********** ** ********* as **** *********** ********* have **** **************** ***** the ****; *** *******, only *************** * ****** ****** **** ******** to ***********.

Access ******* **** ******** ********

** ** ***** ************, access ******* *** ***** would ********* ** ********** “data ***********.” *** *******, if * ************** ******* buys ** ****** ******* system *** * *** building *** *** *********, the ****** ******* ** the **** **********.

**** ********** *** *** companies ***** ****** *** personal **** ********* ** end *****. *** ****** control, ** **** ***** this ***** ***** **** Genetec, *****, ******** *****, S2 ********, ***..

****** ******* ***********/********** ***** also ** ********** **** processors ********* ** ******* they ****** ***** *** users’ ******** **** ** not. *** *******, ** integrator **** ********* ****** to *********’ ******** ********* for *********** ******** ***** be ********** * **** processor ** **** ********.

Processors **** ********

**** **** ********** ** the ****** ******* ******** emphasize **** **** *** only ******* *** ***** to ****** **** *** GDPR’s **********, ****** **** assuring ********** ** *** of **********.

******* ****** ******* ******** data ***** ** **** easy ** *********** ******** people **** (****** ***** surveillance), ********** *** **** to ******** ********** **** end *****/**** *********** ** case ***** *** ***** mishandle *** ****.

*** *******, ** ******** says ***** ****** **** ********* ** *** *** be ********** * **** processor ** **** ***** because “**-******** *********** ** access ********** *** ***** management ******* ***** ** not ******* * **** Processor ******* *** **** Controller ******* *** ******** data.”** ** ******* **** it ***** ** **-******* deployments.

*******, ** ** ***** remembering **** ***** ********* cloud-connected ****** ******* ********* would ** ********** **** processors ***** *** ****. Moreover, ** **** ******* are ****** ** *** cloud, ****** *** *******, management ** ******, ****** control ********* *** **** likely ** **** ***** the **** ********* ********.

Main ****** ** ********** *** ****** *******

Legal ***** ** **********

[***************]

*** ****’******** ******* ******* ***** ***** for **** **********, ** which *** ** *** following ***** ** ****** control:

  • *** **** ******* *** given********* *** ********** ** his ** *** ******** data *** *** ** more ******** ********
  • ********** **necessary *** *** *********** ** * ********** ***** *** **** subject ** *****
  • ********** ** ********* *** the *********** ** * task ******* ***in *** ****** ********** ** *** ******** of ******** ********* ****** in *** **********
  • ********** ** ********* *** thepurposes ** *** ********** ********* ******* ** *** ********** ** ** * ***** *****, ****** ***** **** interests *** ********** ** the ********* ** *********** rights *** ******** ** the **** ******* ***** require ********** ** ******** data, ** ********** ***** the **** ******* ** a *****.

Biometrics *** *******

********** (************, **** *****, facial ***********, ***) *** an **** **** **** likely **** ****** ******* firms ******* ** ****** with *** ****’* ********* consent ************.

********** ********* ** ********** under *** **** **** several **********. *** **** that ***** ***** ** access ******* *** “*********** public ********” *** “******** consent.”(******* *).

*********, ****** ** ****** control **** *** *********** their ********** ********* *** a “*********** ****** ********,” it ***** **** ** make *****, ******-*****, *** informed ******* * ********. That *****:

  • ******* ***** **** ** written** * *******, ***********, intelligible *** ****** ********** form, ***** ***** *** plain ********(******* *)
  • **** ******** *** ******* and ***“******** *** ** *** consent ** *** ****” with ****(******* *)
  • ** ****** ********* *, *** ******* ***** must ******* **** **** of ********** *** ***** used *** ***
  • ******* **** ** “****** given”, *.*. “******* ****** *** ** regarded ** ****** ***** if *** **** ******* has ** ******* ** free ****** ** ** unable ** ****** ** withdraw ******* ******* *********.” (******* **.)

**** ***** ** * consulting **** ** ********** access ******* *** *** employees ***** ******** **** scans, ** ***** ** obtain ********, *****, *** freely-given ******* **** ****.

Refusing ******* *** **********

************* *** **** * problem **** ********* ** people ** ***** *********-***** access ******* ****** ********* ********:

******* ****** *** ** regarded ** ****** ***** if *** **** ******* has ** ******* ** free ****** ** ** unable ** ****** **withdraw ******* ******* *********. [emphasis added]

** **** ***, ** is ******** **** ** organization *** **** ** punish ***** *** ** not **** ******* *** their ********* *********** ** be ****. ** *********** may ******* ***-********* ***** access ******* *** ***** who **** *******.

**** *****, ** **** of ** ***** *** contesting **** *** ** will ****** ******* ******* challenging **** ******** *** clear ******** ** **** application. *******, ************* ****** carefully ******** *** ************ of ******* ** **** using ********** *** ****** control.

Access ******* ******* ******** **** **********?

**** ****** ******* ****** providers ******* **** ***** systems ** *** **** under **** ******* ******* they **** ***** **** that ****** ** **** to ******** ****** – unlike ******* * **** image ** * **** or ***********, *** *******. This *** ** ****** as * **** ** anonymization.*** **** ***** ********* applications, *** **** ********* and ****** ** *** reader ** ******** ** the ****** ******* ****** entirely, *** *** **** data ******** ** *** access ****** ** * Wiegand ** **** **** string *********** * **********.******, **** ********* ******* (like ***** **** ** ‘verification’ *****) *** *** store ********* **** ** the ****** ****** ** all, *** ****** ********* and **** *** ****** on ********** ***** ** inside ******-***** *********.

**** ** * ***** and ******** ******** ** the **** ****** **** not **** *** ********** to **** ** ********* to ** ********* ****, as **** ** ** is “********* **** *** the ******* ** ******** identifying * ******* ******” (******* *) - ******* **’* anonymized ** ***.

****** ******* ********* ****** err ** *** **** of ******* **** ******* with *** ********** ***** its “******* ******** ** personal ****” ****** ** the ****. ** *** take * **** *********/******* to ***** ******* ******* things **** **** **** strings *** ********** ********** under *** **** ** not.

Storage ****** ******* ***********

*** **** *** ** precise ********** ** *******, but******* ****** ** ***** **** personal **** ****** *** be ****** *** "****** than ** ********* *** the ******** *** ***** the ******** **** *** processed".

** ****** *******, **** would **** ****** ***** policies ***** ******* *** making **** **'* *** kept ****** **** ** indefinitely ****** *** *** prove **'* *** “****** interest, **********, ** ********** research ********”. **** ***** employees *** ***** * firm ****** **** ***** data ******* ********.

**** ******* ** *** personally ************ ***********, **** as ****** **** ********* when * ******** ****** goes ******* * **********. However, ** **** ****** data ** *** **** to * ******** ******, it ***** ****** *** fall ***** *** **** and **** ** ******** storage **********. (*** **** on ****, *** “***** ** **** ******** to ****** *******.” *****)

Right ** ** *********/***** ** *********** ********

*** **** ***** ***** rights *** ****** ** access *** ****** ***** personal **** ********** *******, ** ****** ******* firms **** ** **** established ********** ** ******* these ******** *** *** users **** ** ***** of *** ** *** them.

***** *** **** ******** to ****** ******** **** require **** ************** **** simply ********* *** ****, and **** ******* ** least *** ***********, **** whether *** **** ** “no ****** ********* ** relation ** *** ******** for ***** **** **** collected” (******* **.)

*** ****** ******* **** told **** **** **** struggling **** *** ** implement *** ****’* ****** and ******** ************. ** would ********* **** ****** end ***** *** ***** within ***** ****** ******* software ** ***** **** subjects ** *******, ****, and ****** ***** *** data. *** *******, ******** from **** ******* ****’* identity ********** **** ****** individual ********* ******** ***** “****** **” requests.

*** ****** ******* *******, most ********* ** ****** allow *** ******** ** all **** *********** *** activity, ******** *** ***** needed ** ** **** are ***** ****** ****** ‘user *******’ ********* ****** operators *** ***** ** management *******.

*** ****** ** ‘*********** destroy’ *** ******* ** a ****** *** ******* a ***** ****, *************, or ******* ********** ****** simple ******** ** ****** records, *** ** ***** records *** ****** **** other ***********, **** ** ‘Time & **********’ ** ‘Visitor **********’****, **** ******** record ******** *** ******* interaction **** ******** *******.

***** ********* **** *** right ** ** ********* and *** ***** ** their ******** ****. *** that ******* ** **** the **** ******** *** data, *** *** **** subject’s ********** ******. *******, this ***** *** ** possible ** *** ********’* personal **** *** **** deleted ********* *** ** her ********* **** * firm – ** ****** be **** ** ********** with *** ****’* ******* recommendations (*** “*******.”)

*******, **** ** **** that ***** ***** ** need ** ******* ** information ********, **** **** 1 ***** ** ** so, ***** *** ** extended ** ********** * months. **** **** ** not **** ** ******* them ** **** *** “manifestly ********* ** *********.” (******* **.)

Encryption *** *************

******* ****** ******* ********* handle *********** ******* ** sensitive *** ******* ******** data, ****** ********** ** key. *** **** ********** encourages ****** ********** ********* **** ****** *******’ ******** data ** *********, ** it’s ****** ********* *** access ******* ********* *** users ** **** **** they *** ******** ***** passwords *** ******** ****-**** practices **** ******* ****** Sign **.******* **** ********** ***** two-factor **************, ********* ***** Security, ** ******* *********, etc.

*******, **** ****** ******* systems ******* ************ **** Microsoft ****** ********* ** LDAP ** ******** ***** processes, *** ***** ******* utilities *** *** ** Article ** **********. ** proxy, ****** ******* *******, especially ***** **** ** large ********** *** *****-******** deployments **** *****, ******** House, *******, **, *** Avigilon *** *** ** at ****.

*************/**************** ** **** ********** by *** ****. ***** these **********, ***** ****** leaked **** ***’* ** immediately **** ** ****** people, ** ****** ** it ******* ********* ************ in **** ** * breach. *** *******,******* *********** **** ********** **** subjects *** *** **** to ** ********* ** appropriate ************* ********** *** used.

****** ******* ********* ***** anonymize/blur *********** **** ** lessen *** ****** ** a ******, *** ********. Names *** **** ** anonymized ** ********* **** person * ****** *** instead ** ********* ** them ******** ** ***** full ****.

Data ******** – ********** ***** *** ******* ******

****** **** ** ****** control, *** ***** *** most ****** ** ** considered **** ***********, ***** larger ****** ******* ***** like ******* *** **** likely ** ** ********** data **********.

***** *** ****, *********** have ** ***** ** inform *********** ** *** case ** * ******. Controllers **** *********** **** inform ********** **** ******** as **** ** **** the ****** ***** “* **** **** ** the ****** *** ******** of ******* *******”(******** **&**.)

**** *********** **** ****** in * *** ************ communication **** ****** ********** or ****** **** *** exist ** *******. ************* of **** ******** *** non ********, ********, ** highly ********** **** ******* distributions, *** **** **** introduce ********* *** ******* breach ************ ************.

****** ******* ********* ***** biometrics ****** **** *** special ********* ** ****** reporting ************, ** *** EU’s ******* ** ******* Party, ** ******** ** advisory ****,*** ********* ****** ********* ********** ** particularly **** ****, **** requiring ************ ** ********** data ******** ***** **** authorities:** ******* ********** ** personal **** [**********] *** disclosed ******, *** ********** should *** ******* ***** delay ** ******* *** breach *** ** *********** it ** *** *********** concerned.”

**** ********** **** **** responsibility ** *** ***** that **** *** **** obliged ** ******* **** controllers, ****** **** *********** and **** ********, ****** 72 ***** ** ******* to * ****** ***** discloses ******** **** **** controllers.

Data ********** ********

***** ** ** *** mandatory *** *** ****** control ***** ** ******* a *** (******* ****** with ********** **** **********), an ****** ******* **** using ********** *** **** to ** **.

*** **** **** *** 3 ********* ********* ****** **** **** ** be *********, ********* **** *** **** ********** ** the ********** ** *** processor ******* ** ********** on * ***** ***** of ******* ********** ** data [**** ******** **********]”.

***** **** ****** ******* providers’ ********** *** ** biometric ***********, ********** * DPO ***** ** ****. This **** *** ** especially **********, ** *** GDPR ****** **** * DPO *** ** ********** or ** ** ******** employee ****** **** *** more ****.

Data ********** ****** ***********

******* ******** **** ***** *** required ** ***** “****** ** ****** ** a **** **** ** the ****** *** ******** of ******* *******”, ********** **** "********** on * ***** ***** of ******* ********** ** data [*.*. **********]" ***** place.

*******, ***** **** *** GDPR *****’* ****** “***** scale” *** **** ********** based ** ******* ** “legitimate ********” – **** access ******* – ** not ****** ** ****** in * **** ** people’s ********, ** ***** unlikely ***** ***** ** required ** ***** ******** of ****** *******.

******* ** ***** **** yet ** *** *** EU ********* **** ***** these **** ************ ** practice, **** ***** ******. So *** **** *** seen ** ******** ** access ******* ***** ********* for ********* *****.

Data ******** ** ****** *******, *.*. ******** ******** ***

*** **** ********* ******** data, ** "*********** ******** to ** ********** ** identifiable ******* ******". (******* *). *******, ***** *** types ** **** ** access ******* ***** **** under * **** ****, specifically *** **** ** physical ******** **** ****** every **** ******* **** a ********* ** ***** a ********, *** *******.

****** ******* ***** ********* by **** **** **** did *** ******** **** sort ** **** ** be ******** ** ********* data, ***** ** *** exist ************* ** * specific ****** *** ***** not ** **** ** identify *******. **** ***, if *** ******* ** employee ****** * *******, the **** ********** ***** delete *** ******** *********** but **** *** *********** anonymous ******** *** (** is ******* *** ******** for **** *****).

***** *** ********** ** personal **** ***** ** the ****, **** ******** makes *****. *******, ** remains *** **** ********* realize **** *** **** they ******* ***** *** be **** ** ******** a ******** ****** ***** under *** ****** ******* of *** ****.

GDPR ********** ** ****** ******* *****

**** ****** ******* ******** providers **** ********* **** statements, ****** ********* **** are ***** ** *** specifics ** ****'* ****** on ****** ******* *******. Below *** ***** ** ****** **** statements ** ****** ******* firms, **** ******** **** commentary:

******** **** *********:******** ********** (**** ** Avigilon ******* ****** (***) video ********** ********) ****** itself ** **** *********, all ********** ********* **** consider *** ***** ******** and ********* *** ****** enterprises ** ********* *** operating * **** ********* system. ******** *** ***** care ** ****** **** its ***** ******** ********* include ******** *** ************* that **** ******* **** compliance.”

**** *******: ******** ********* states **** *** **** is ** ******* *** means ** **** ********** rather **** *** ********** itself.

***** **** *********:“*********** **** **** ****** in ***** ***** ** individuals ***** ***** ************ are ********** **** ********. Brivo ***-***** *** ** some ***** ***** ********* are ********** **** ***********. Brivo ** * **** Processor.”

**** *******: **** *** **** *********** ** the **** ***** ******* to ****** *******. **** that ***** ** *** statement, ***** ********* ** has ********* * *** and ***** ** ***** to ******* **** **** GDPR *******.

******* ****** **** *****:“**** ******* *** ***** requirements *** ********* ***** to ********* *** ****** data ******** **** ****** PII. ****** **** *** data *** ******* ** protected ******* ************ ****** is *** ***** **** in ********* *** ****. Our ********* ******* *** the ***** *** **** to ****** **** *** PII ******** *** ****** by *** ******** ******* is ***** *******.”

“**** ****, *********** *** now ******* ****** ** a **** ** *** data ** ************ *** collected ***** ****. ********** *********™ ******* ******** ********** platform ***** **** *** are ***** ** ******* to ***** ********. ** provides * ****** ***-***** portal ***** *** *** easily *** *********** ***** private ****. ** **** you ******* *********** ****** to ***** ******** *********** in * ********** *** common ******.”

**** *******: * ******** of *******’* ***** ** its ******* ***** ************ rather **** ****** ******* solutions, ******* ** ******** identifies *** ********** ** strong ************* ********* *** offering ******** ** **** GDPR ********** ******.

***** **** *****: “***** *** ******** *** products ** ***** ********* to *** **** ** GDPR-compliant ****. ***** ******* offers ******* ****** ** security ** ******* *** Personal **** ** ********* and ********. ********* ******** standards *** ***-********* ********** methods *** ** ********** in *** ***** ******* system **** ** ******* between **** *** ******, OSDP ******* ****** *** controller, ****.* ******* ********** and ******, *** ***** for * ****** ******** experience. ********, ***** ******* supports ************* ****** ************ to ***** ****** ** authorised ********* *** ******** the *********** ** ******* data ******, ** **** which ** ********* ******** for *** ****** ** function.”

**** *******: *****'* ***** was *** ** *** most ******** *** ******** about ****'* ****** ** access *******.

****** **** *********: “** **** **** **** that *** ******** **** provide *** ***** ******** to ***** ********** ** used *********, *******, ****** is *** *********** *** a ****’* ********** **** GDPR *** ** *** offer ****** ** *** to ** *********.”

**** *******: ****** **** correctly ***** **** ***** it *** **** *** means ** ****** **** GDPR, *** ******** ****** automatically ****** **.

*** **** *********: “** *** **** ** access ** ***** *** other ******** **** ** hold ***** ***, ** to ******* **** ** delete *** *********** ***** you, *** *** ******* us ** ******** ***@***.***. We **** *********** **** request ****** *******-*** (**) hours *** ****** ** promptly. *** ******** *.*.*. will ******* ** ***** requests ****** * *****, with * *********** ** extend **** ****** *** particularly ******* ******** ** accordance **** ********** ***. We **** ****** **** information *** ** **** as **** ******* ** active, ** ****** ** provide *** ********, ** to ****** **** *** legal ***********, ******* ******** and ******* *** **********.”

**** *******: **’* *** actually ********* *** *********** or ********** ** ******* to ***** ******** ****** 72 *****, ***** ** the **** ******** ** report ********. *** **** gives *********** *** ********** up ** * ****** to ******* ** ***** requests.

** **** *****: “*** ******** ********** ****** falls ** *** **** Controller, *** ****** **** decides ***** ******** **** to ******* *** *** the ******** ************** *** safeguarding **.”

“********* **** ****** ***** regarding ******** **** *** prevent ****** ******. ****** the ***** ****** ** personal **** *** **** for ******** **********. ****** that *********** *** *** shortest ****** ** **** necessary. ***, ******* **** importantly, ** *********** ***** your ******** **** *********.”

**** *******: ***** *** all ******* ********** *** underline *** ******* ********** burden *** ****** ******* end *****/***********.

*** / **** ************ Kantech *** ******** ***** offer *** **** **** guides (*.*.*****) *** ***** ****** control ***** ****** ***** it ** *** ***** surveillance:“** ** ********* ** note **** ******* ***/** product ********* *** *** by ********** **** *********. Any ******* **** ** subject ** *** **** will **** ** ****** what ******** *** ********** are ******** ** ****** with ***** **************** ***** the **********, *** ** procure, ********* *** *** products ***/** ******* ********* in * ****** **** is *********.”

“******* ********’ ***** ******* portfolio ******** * ****** of ******** *** ********* that *** **** **** aspects ** **** ********** ************ *** ************ for ******** *** ********** of **** *********. **** features *** ******* **********, role-based ****** ******* ** limit ***** ***** *** access ****, *** **** to ***** ******* ***** trails *** **** ****** and *********. *******, ********** with *** **** *** only ** ******** ******* deployment ******* *** ******** policies ******* ************ ** meet *** *********** ***** of **** ********** ********. Therefore, **** ********** ****** be ****** ** * product’s ******* ***. ***** the *******’* ******* *** can **** **** ********** easier ** *******, ***** will ********** ** ********** specific *** ******** ******** actions ******** ** ****** compliance **** *** ****. GDPR ******* **** **** contain ************ ***** ***** data ** ******, **** information ** ****** *** user ******* ************ **** product ******** ****** *******.”

**** *******: **** ******* and ******** *****, **** owned ** ******* ********, offer *** ******* ******* of ****** ******* ***** distancing ********** **** *** users **** ** ***** to **** **********, ****** that ******* ******** ***** cannot ****** **********.

Future *******

**** **** ******* ******* updates ** *** **** related ****** ******* *********** arises *** ** ***** impacting **** *** ****** control *** *******.

Comments (0)

Login to read this IPVM report.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

Related Reports

Sighthound Transforms Into Enterprise AI Provider on Jun 14, 2019
Sighthound is now rapidly expanding its R&D team, building an enterprise AI service. This may come as a surprise given their origins 6 years...
Farpointe Data Conekt Mobile Access Reader Tested on Jun 13, 2019
California based Farpointe Data has been a significant OEM supplier of conventional access readers for years to companies including DMP, RS2, DSX,...
Manufacturer Favorability Guide 2019 on Jun 12, 2019
The 259 page PDF guide may be downloaded inside by all IPVM members. It includes our manufacturer favorability rankings and individual...
Axis Will Not Block Resellers on Jun 10, 2019
While Axis generally has strong favorability amongst integrators, the biggest complaint is their channel model, which results in smaller integrator...
Dumber Techs, Bad Box Movers, Says Australian Distributor on Jun 10, 2019
Techs today are "dumber" than they used to be, despite better education and training and that makes a typical day "frustrating" for one...
Directory of 30+ VSaaS / Cloud Video Surveillance Providers on Jun 07, 2019
This directory provides a list of VSaaS / cloud video surveillance providers to help you see and research what options are available. 2019 State...
OpenALPR Doubles Prices on Jun 06, 2019
There is no 'race to the bottom' in cloud / AI video surveillance. In May, Verkada increased their prices. Now, OpenALPR is doing the same with a...
Nortek and SDS Fight Over Failed Settlement on Jun 05, 2019
Distributor SDS said they reached a deal with Nortek but Nortek says no settlement was reached and the suit is still on. In this post, based on...
Startup Rhombus Systems Says Twice the Features, Half the Price of Verkada on Jun 04, 2019
Closed cloud systems may be the fastest growing segment of video surveillance with Meraki and Verkada. Now another California company is joining...
OSDP Access Control Guide on Jun 04, 2019
Access control readers and controllers need to communicate. While Wiegand has been the de facto standard for decades, OSDP aims to solve major...

Most Recent Industry Reports

Sighthound Transforms Into Enterprise AI Provider on Jun 14, 2019
Sighthound is now rapidly expanding its R&D team, building an enterprise AI service. This may come as a surprise given their origins 6 years...
ADT Eliminating Acquired Brands, Unifying Under 'Commercial' Brand on Jun 14, 2019
ADT is eliminating the brands of the many integrators it has acquired over the past few years, including Red Hawk, Aronson Security Group (ASG),...
NSA Director Keynoting Dahua and Hikvision Sponsored Cybersecurity Conference on Jun 13, 2019
The technical director for the NSA’s Cybersecurity Threat Operations Center will be keynoting a physical security cybersecurity conference that is...
Farpointe Data Conekt Mobile Access Reader Tested on Jun 13, 2019
California based Farpointe Data has been a significant OEM supplier of conventional access readers for years to companies including DMP, RS2, DSX,...
Embattled $400 Million China Funded Philippines Surveillance System Proceeds on Jun 13, 2019
An embattled 12,000 camera surveillance system project that will cost ~$400 million will proceed.  The project contract was awarded, had its...
False Verkada 'Unrivaled' Low Light Performance Claim Removed on Jun 12, 2019
Verkada falsely claimed that it delivered 'UNRIVALED LOW LIGHT PERFORMANCE' until IPVM questioned. In fact, Verkada's low light performance is...
Manufacturer Favorability Guide 2019 on Jun 12, 2019
The 259 page PDF guide may be downloaded inside by all IPVM members. It includes our manufacturer favorability rankings and individual...
Camera Course Summer 2019 - Register Now on Jun 12, 2019
Register for the Summer 2019 Camera Course.  This is the only independent surveillance camera course, based on in-depth product and technology...
Favorite Wireless Manufacturers 2019 on Jun 12, 2019
Many wireless options exist for video surveillance but how are integrator's overall favorites? 170 integrators answered the question: What is...
Carnegie Mellon AI Startup Zensors Profile on Jun 11, 2019
Zensors is a startup formed by Carnegie Mellon graduates from a Carnegie Mellon research project, offering customized models per camera that they...

The world's leading video surveillance information source, IPVM provides the best reporting, testing and training for 10,000+ members globally. Dedicated to independent and objective information, we uniquely refuse any and all advertisements, sponsorship and consulting from manufacturers.

About | FAQ | Contact