Duty to provide information to visitors

BACKGROUND

This document contains general information to fulfill the duty to provide information to visitors according to the GDPR, as well as factors that can be taken into account when using Indivd X.

Article 12 of the GDPR says that the data controller shall take appropriate measures to provide the data subject with all information to be provided if the personal data is collected from the data subject. The information must be provided in a concise, transparent, intelligible and easily accessible form. Furthermore, the principle of transparency in Article 5 (1) (a) states that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subjects.

Article 13 of the GDPR states the information to be provided if personal data is collected from the data subject. There are no exceptions to Article 13. However, the controller may provide information in different layers, where the first layer in relation to camera surveillance usually consists of a sign with the most important information at an overall level. Complete information can be provided, for example, on a website or in a brochure which acts as the second layer of information. The information in the second layer should not come as a surprise to the people to whom the information is addressed. 

As Indivd is a new technology, where complex concepts such as AI, neural networks and anonymisation become relevant, the need to be clear to those registered is of particular importance.

We have used publicly available information from the Swedish Data Protection Authority and the European Data Protection Board to produce this document. An impact assessment has been carried out for the product, Indivd X, with subsequent prior consultation, which resulted in a positive decision on 26 June 2020.

The information in the document does not constitute legal advice and we encourage you to seek such support if necessary.

FIRST LAYER- INFORMATION ON A SIGN

The sign must be placed at eye level at the entrance to the relevant location so that the registered can get the information before entering the area. If there are several different entrances to the area, each entrance should have a separate sign.

Furthermore, the European Data Protection Boards’ guidelines on the processing of personal data with video devices must be followed.

The following information must be included on the sign:

1. The identity of the personal data controller and, where applicable, the representative.

2. Contact information for the personal data controller, including any data protection representatives.

3. Information about the processing that has the greatest consequences for the data subject.

4. Purpose of the processing, including that the visitors’ faces will be analyzed and then categorized for the purposes you have decided.

5. Information about the data subject’s rights.

6. If the surveillance material is stored outside the EU, long storage times, real-time surveillance, or if sound is recorded.

7. Information/links to the second layer, for example via a QR code or web link to the second layer of information and/or reference to a brochure in the location.

8. The sign shall clearly state the data subjects’ rights, including how the data subjects may object to the processing according to Article 21 of the General Data Protection Regulation, have access to their personal data, and request that they are deleted.

SECOND LAYER

The second layer may consist of an information brochure that can be picked up at the information desk, reception, or checkout or which is available on a poster.

The first layer needs to clearly refer to the second layer. If the best option in the first layer is to refer to a digital source as a web page or QR code as the second layer, the information should, according to the European Data Protection Board, also be available non-digitally. It should also be possible to access the information from the second layer without having to enter the environment where the processing takes place, especially if the information is provided digitally. Another suitable approach may be, for example, a telephone number. 

The important thing, however, is that the information provided is all the information required by Article 13 of the GDPR.

EXAMPLES OF PURPOSE OF THE PROCESSING

These purposes have been assessed within the framework of the prior consultation with the Swedish Data Protection Authority. We, therefore, presume that these 8 purposes are correct. They will be presented here, first in English and then in Swedish.

In English

1. Understand how different objects in the store environment (shelves, aisles, furnishings, entrance, signage, lightings, etc.) attract interest (attention, integracts with, leads to conversion) from visitors to be able to make changes that lead to the store environment becoming more efficient and relevant to all visitors.

2. Understand where and when queues are formed (e.g checkouts, dressing rooms, toilets, customer service counters) in order to be able to make changes that lead to a streamlining of store operations and minimization of queue formations.

3. Understand how visitor flows take place in order to be able to make changes that lead to a streamlining of customer flows in the store.

4. Streamline internal operations by understanding visitor flows and then adapting staffing at different locations / departments in the store.

5. Understand how visitors navigate the store’s planned visitor journey turns (i.e which paths visitors walk in the store) in order to implement changes that lead to increased efficiency and relevance of the visitor journey.

6. Enable clearer comparisons and thereby understand differences between different stores, e.g the impact of our store environments, queuing, visitor flows, the attraction of objects, visitors ‘navigation in the stores’ planned visitor journeys, etc. to learn about the differences and make changes that lead to a streamlining of our organization’s overall operations. We could, for example, make two separate investments in two stores with similar conditions. In one store we invest in education for the staff, and in the other store we invest in a new store interior. If the results of such a study would show that it is more favorable to provide our staff with more education, it could lead us to restructure our investments and increase the efficiency of our organization’s overall operations.

7. Enable clearer comparisons and thereby understand differences between different stores, e.g the impact of our store environments, queuing, visitor flows, the attraction of objects, visitors ‘navigation in the stores’ planned customer turns, etc. to streamline / adapt planned establishments, including identifying new cities / areas for establishment.

8. Enable clearer comparisons and thereby understand differences between our stores and other stores over time, for example regarding the impact of store environments, the attraction of objects, queuing, visitor flows, visitors ‘navigation in the stores’, planned visitor journeys, etc. to get and try new ideas and offers, e.g by introducing a yoga studio or running club to increase innovation and strengthen our competitiveness. For example, insights that a large proportion of visitors are attracted to (pay attention to, interact with) sports products could lead us to temporarily try to launch a running club in the store. A recurring activity in the store could lead to visitors gathering to run and discuss running in order to strengthen the store’s brand towards that target group. With an increased understanding of differences, the attractiveness of objects, visitor flows, etc. could lead to an increased understand about the investment’s profitability if (i) more visitors visit us (ii) new target groups visit us (iii) it leads to increased attractiveness for other products (iii) we have an increased frequency of visits and an increased attractiveness in relation to benchmark data, which in itself leads to increased competitiveness.

In Swedish

1. Förstå hur olika objekt i butiksmiljön (hyllor, gångar, inredning, entré, skyltning, belysning m.m) attraherar intresse (uppmärksammas, integreras med, leder till konvertering) från besökare för att kunna göra förändringar som leder till att butiksmiljön blir mer effektiv och relevant för alla besökare.

2. Förstå var och när köer bildas (t.ex. kassor, omklädningsrum, toaletter, kundtjänstdiskar) för att kunna göra förändringar som leder till en effektivisering av butiksdriften och minimering av köbildning.

3. Förstå hur besöksflöden sker för att kunna göra förändringar som leder till en effektivisering av kundflöden i butiken.

4. Effektivisera den interna driften genom att förstå besöksflöden och därefter anpassa bemanning på olika platser/avdelningar i butikslokalen.

5. Förstå hur besökare navigerar i butikens planerade kundvarv (dvs. vilken väg besökarna tar i butiken) för att kunna genomföra förändringar som leder till ökad effektivitet och relevans av kundvarven.

6. Möjliggöra tydligare jämförelser och därmed förstå skillnader mellan olika butiker, exempelvis våra butiksmiljöers inverkan, köbildning, besöksflöden, attraktiviteten av objekt, besökares navigation i butikernas planerade kundvarv m.m. för att lära oss om skillnaderna och göra förändringar som leder till en effektivisering av vår organisations totala verksamhet. Exempelvis så skulle vi kunna genomföra två separata investeringar i två butiker med liknande förutsättningar. I den ena butiken investerar vi i en vidareutbildning till personalen och i den andra butiken investerar vi i en ny butiksinredning. Om resultaten av en sådan studie skulle visa att det är mer gynnsamt i att ge personalen en vidareutbildning, så skulle det kunna leda till att vi omstrukturerar våra investeringar och ökar effektiviteten av vår organisations totala verksamhet.

7. Möjliggöra tydligare jämförelser och därmed förstå skillnader mellan olika butiker, exempelvis våra butiksmiljöers inverkan, köbildning, besöksflöden, attraktiviteten av objekt, besökares navigation i butikernas planerade kundvarv m.m. för att effektivisera/anpassa planerade etableringar, inklusive att identifiera nya städer/områden för etablering.

8. Möjliggöra tydligare jämförelser och därmed förstå skillnader mellan våra butiker och andra butiker över tid, exempelvis avseende butiksmiljöers inverkan, attraktiviteten av objekt, köbildning, besöksflöden, attraktiviteten av objekt, besökares navigation i butikernas planerade kundvarv m.m. för att få och prova nya idéer och erbjudanden, exempelvis genom att introducera en yogastudio eller löparklubb för att öka vår innovationskraft samt stärka vår konkurrenskraft. Exempelvis skulle insikter om att en stor andel av besökarna är attraherade av (uppmärksammar, interagerar med) sportprodukter kunna leda oss till att tillfälligt prova lansera en löparklubb i butiken. En återkommande aktivitet i butiken skulle kunna leda till att besökare samlas för att springa och prata om löpning i syfte om att stärka butikens varumärke mot den målgruppen. I och med en ökad förståelse för skillnader, attraktiviteten av objekt, besöksflöden osv. så kan vi förstå om detta var en lönsam investering genom att förstå om (i) fler besökare besöker oss (ii) nya målgrupper besöker oss (iii) det leder till ökad attraktivitet för andra produkter (iii) vi har en ökad besöksfrekvens och en ökad attraktivitet i förhållande till benchmark data vilket i sig leder till en ökad konkurrenskraft.

Version: 1.0
Date: 2020-08-26