GDPR. Enough to send a shiver down anyone’s spine. Even if you haven’t got business interests to consider in light of the new regulations, you will have spent hours deleting (or if you’re more conscientious, responding to) hundreds of emails asking for your continued cooperation in being marketed to.
If you conduct video surveys that involve research with EU citizens, the new General Data Protection Regulation is something you will need to have a grasp of so that your business activity complies with the law. With penalties of up to 4% of a company’s global revenue for non-compliance, it’s not something you’ll want to fall foul of. But, let’s face it, it’s not the most scintillating topic, and it’s also very complex. Try reading the regulations in full and your eyes will glaze over within seconds. So, in the interests of detailing some of the actions you’ll need to take whilst also keeping you awake, we thought we’d give a few pointers here.
1) Update your privacy policies
You might think you already have it covered. After all, video research respondents having to give consent for their image to be used is nothing new, and you probably already have data protection procedures in place. What is new, however, is the way in which consent from respondents can be validly obtained.
Those slips of paper that people sign to say they permit the research team to use the video ‘for research purposes only’? They’re unlikely to satisfy a GDPR inspector. Likewise, you can’t assume that because somebody has been happy enough to be filmed they give permission for that film being used for absolutely any part of the project in question. Instead, they now need to consent to footage being used for each separate purpose (e.g. a presentation, a marketing campaign, a website…)
2) Consider what makes someone identifiable
The GDPR is clear on this: any information that can identify a living person constitutes personal data. This means that your research respondents need to consent to this data being processed by your company or by your suppliers. And when we say any information, we really mean any – from obvious ones like credit card details right down to those you might never have thought of, like the hours of somebody’s work shifts. Clearly, video, often showing someone’s face and body as well as their possessions, location and their voice – is packed to the rafters with personal data. Any company using this needs to be clear on which parts of the data it will process and whether the respondent is happy with that. And talking of location, if there are people milling about in the background who will appear in the video too, their consent also needs to be obtained or else they need to be edited out.
3) Remember the rules are open to interpretation
As with any legal concept, GDPR contains room for manoeuvre. According to law firm Briffa, ‘if businesses can demonstrate they have a legitimate interest, most processing [of video data] will remain lawful even without having explicit consent.’ This is important because although an individual might give consent, new GDPR laws mean he/she can withdraw that consent at any time.
‘Legitimate interest’ is not clearly defined under GDPR, but would need to be proven if data to which consent has been given, but then later withdrawn, continues to be processed. A company using footage would need to show that processing it is necessary to pursue a real business interest, that that interest could not be pursued in any other way, and that the company has balanced this against how it would affect the rights and freedoms of the individual concerned. Naturally, if a company using video wants to avoid a breach of GDPR, it is always best to obtain unambiguous consent from individuals. But according to Briffa, if a company demonstrates it has thought about how its data processing will affect individuals and has taken measures to limit negative impact, it will be in a solid position should its activity be questioned.
4) Choose your provider carefully
How you use and share the videos you obtain from a video survey is in your hands, but how you obtain them in the first place is just as important. Using a reputable video provider and processor that takes GDPR seriously is a must. At Plotto we are fully GDPR-compliant, as is the video host we use, so you can be confident that part of the process is taken care of.