GDPR / ICO Complaint Filed Against Dahua

It seems conceivable in the (near) future that security trade shows are going to have some click-wrap disclaimer when you register that says "I give my consent to be filmed and biometrically analyzed".

Reactions:

(5)

John Honovich

In reply to Undisclosed #1

IPVM

At least, in the UK, the ICO ruled that it was the responsibility of each individual exhibitor, rather than the show itself. UK ICO Denies IPVM GDPR Complaint Against IFSEC, Decides Each Exhibitor Responsible That's sensible since the show (whether it's IFSEC or ISC West or whoever is not the 'data collector' of the facial recognition systems that exhibitors use, it is the exhibitors themselves).

Reactions:

(6)

Undisclosed #1

At least, in the UK, the ICO ruled that it was the responsibility of each individual exhibitor, rather than the show itself.

Understood, though I would think that a "service" the shows could offer exhibitors is in notifying the collective audience and gathering their consent.

It would be somewhat difficult, if not impossible, for any exhibitor to handle this on their own if they plan to demonstrate facial analytics openly in their booth. You can't approach the booth and acknowledge consent without likely be captured and analyzed by the cameras in that booth.

Further, how do attendees even know there are potential compliance issues they could run into, if the show organizer does not provide a "top-level" notification?

ICO ruling aside, I think the show needs to either find a way to collect global consent, or ban (and patrol/enforce) exhibitors from displaying anything that violates GDPR.

Reactions:

(1)

Mark Costello

John your some arsehole, no better things to be doing than acting like a tabloid newspaper, subscription cancelled

Reactions:

(1)

(10)

(1)

(6)

Undisclosed #1

In reply to Mark Costello

I disagree with you on that. I think it is very interesting to see surveillance-related GDPR cases tested and analyzed this way. We have already seen some degree of unwillingness of the ICO to pursue "frivolous" claims, even when backed up by evidence.

I think the initial kick-back of IPVM's first complaint was very informative and telling.There was some early speculation that the governing bodies might rain down obscene fees on anyone violating GDPR. We have now seen, at least in one instance, evidence to the contrary.

Further, Dahua, and others, have to know by this point that GDPR is a "thing", and they might potentially be violating GDPR with in-booth demos. It is not like IPVM baited them into running a face-rec test on attendees, or filed this on speculative guesses.

Reactions:

(7)

(1)

(5)

John Honovich

In reply to Undisclosed #1

IPVM

It is not like IPVM baited them into running a face-rec test on attendees, or filed this on speculative guesses.

Indeed, the opposite, IFSEC and exhibitors knew we were investigating this and that we had filed last year. And even IFSEC posted a sign this year notifying / warning that exhibitors might be asking for consent to do facial recognition:

And, despite, all of that, Dahua still did facial recognition and still made no attempt to get consent.

Reactions:

(4)

Undisclosed Integrator #5

In reply to Undisclosed #1

I’d agree with you in part on the proviso that the systems in use were in a commercially deployed environment. If this test case was in a shopping mall I’d be with you, but at a security trade show nit a chance!

Reactions:

(3)

(1)

John Honovich

In reply to Undisclosed Integrator #5

IPVM

at a security trade show nit a chance!

If it declares that security trade shows are not subject to biometrics processing rules, that would be fascinating to see. Let's see what the ICO says. That is the point of filing so that the ICO can give some guidance about how these rules are applied in practice.

Reactions:

(1)

Undisclosed Integrator #2

I am continuing to question the value of paying the subscription fees to IPVM. Actions like this are not valuable to me as a member.

Reactions:

(2)

(3)

(2)

John Honovich

In reply to Undisclosed Integrator #2

IPVM

IPVM does many things - we doing testing, we do reporting, we develop software (e.g., the Calculator), etc. We charge one price for all of it. It's like a buffet, our goal is not to ensure everyone finds everything valuable, it is to ensure we provide enough overall value to justify the cost of membership and what those things are will vary by the member.

#2, if there are specific things we are not doing that would provide value to you, please let us know here.

Reactions:

(1)

Undisclosed #3

IPVMU Certified

Philosophical question:

is it a violation even if your technology doesn’t work?

Reactions:

(1)

(19)

John Honovich

•Jun 28, 2019

IPVM

While signs do not cover biometric processing such as facial recognition, a Dahua UK partner has pointed out on LinkedIn that Dahua did have a small sign buried inside their stand, as the images below show:

And the zoom in to the small sign:

Interesting, it does not even mention the facial recognition they did, only 'facial images'.

Reactions:

Undisclosed #3

•Jun 29, 2019

IPVMU Certified

Hitchhikers Guide to The Galaxy

Reactions:

(2)

(1)

(6)

Undisclosed #4

•Jun 30, 2019

Good work. These criminal companies need to be held accountable by someone. Too many laws are being broken by these multinational Chinese companies with virtually no consequences. If a US company went to China and disregarded Chinese law they would certainly be held accountable there.

Reactions:

(2)

(3)

Undisclosed Integrator #7

In reply to Undisclosed #4

If a US company went to China and disregarded Chinese law they would certainly be held accountable there.

it certainly warrants getting a caning.

Reactions:

Undisclosed Integrator #5

Plenty of other stands were processing biometric data, including facial recognition.

Would the reason that Dahua has been singled out be that IPVM staff were (rumoured to have been) asked to leave the stand or that (rumoured) Hikvision took out an injunction to prevent IPVM staff from going on their stand or talking to staff?

The show was tiny this year and very poorly attended...

Reactions:

(1)

John Honovich

In reply to Undisclosed Integrator #5

IPVM

that (rumoured) Hikvision took out an injunction to prevent IPVM staff from going on their stand or talking to staff

#5, what? Seriously, where do you get these 'rumors' from? First, it's completely false. Second, Hikvision talked to us in their booth. Third, we actually mentioned this in the IFSEC report:

Hikvision was the most knowledgeable of the various companies IPVM spoke with about how GDPR worked

Do a little due diligence before throwing out obviously false things, fair enough #5?

Reactions:

(1)

Undisclosed Integrator #5

I have no idea if the comments I made were true as they were 2nd hand rumours... it’s a rumour, clearly marked as that - you can’t do due dil on rumours.

Happy if this is not the case of course as we’d hate for HIK to try to restrain IPVM as there’d be little to read ;)

So did Dahua ask your staff/journalists to leave the stand?

Reactions:

(1)

John Honovich

In reply to Undisclosed Integrator #5

IPVM

you can’t do due dil on rumours.

Of course, you can. I expect that of my summer job high school assistant, certainly, an industry veteran like yourself can.

The false 'rumor' was: Hikvision had an injunction against IPVM for IFSEC 2019. What can you do to check? Search IPVM for our IFSEC 2019 coverage, pretty obvious, no? It says it right in the middle of the exact report relevant to your 'rumor' that we did speak with them.

So did Dahua ask your staff/journalists to leave the stand?

Again, it's in the IFSEC 2019 report, to quote:

He did so before realizing we were from IPVM. Once we had identified ourselves, he beat a hasty retreat and shouted that he couldn't speak to us.

No, we were not asked to leave the stand and Dahua made clear that they were running live facial recognition including people in the aisle and that they were not requesting consent for performing such facial recognition.

I am happy to answer all questions though if you want to be respected as an industry veteran, you should be able to spend a minute trying to fact check it in the obvious place.

Reactions:

Undisclosed #3

IPVMU Certified

you can’t do due dil on rumours.

“Of course, you can.”

but then they’re not rumors anymore ;)

Reactions:

John Honovich

In reply to Undisclosed #3

IPVM

Sure, it's more fun to throw out anything and then shield yourself by saying 'rumor' <sarcasm>

Reactions:

(2)

Undisclosed Integrator #6