The City filed a Privacy Threshold Analysis with DHS last year. They wrote the DAC would collect surveillance video but no Personally Identifiable Information (PII). PII usually refers to fields of data from a form, a database record, an ID. Examples are typically Social Security Number, Drivers License, a full name, or an address.
But what about a photo or video of you walking down the street? What about an audio recording of you and your friends talking? Why aren’t those also PII? Facebook detects and matches faces. Tineye finds similar photos on the web. And the better-funded intelligence and law enforcement agencies have access to tools that identify people from photos and recordings. Software can recognize the unique shape of your ear, your distinctive gait, your height, the things that make your voice distinctive, the pattern of veins under your skin, your body art.
So why aren’t surveillance videos, like those proposed for the DAC, and surveillance audio, like that collected by Shotspotter, also consider PII? How about body cameras worn by police officers? Do privacy laws distinguish between PII in raw form and PII fully analyzed and extracted? Aren’t the handwritten name on a form and the typed version both PII?
Resolved: So let’s start considering all the raw sensor data we collect from observing people to be PII, and also all the data we derive from it.
Then let’s apply all the rules for protecting, retaining, and disclosing PII to all the data streamed from government cameras and microphones and scanners.