The internet of things is virtually everywhere. Billions of IoT devices are deployed to monitor people through CCTVs, capture police footage from a body cameras and to see what products people gravitate toward when they shop.

As the IoT continues to become all-encompassing, those devices stand to gather plenty of images. Think Privacy Co-Founder and CEO Alexander Hanff, CIPP/E, believes this can be a problem, however, when IoT cameras capture people’s faces without their knowledge and for reasons that are not related to the devices’ original purpose.

“This is an issue we are going to see more and more of over time," said Hanff. "These cameras are very small, so they are very easy to deploy. We need to make sure that the people who are captured by these devices have their privacy rights maintained.”

This is what motivated Think Privacy to join forces with the Irish-based data privacy consultancy company Castlebridge Ltd. to develop a solution to redact people’s faces when they are incidentally captured by IoT devices. The project received a big boost after the Swedish Innovation Agency awarded the companies a grant worth 1.5 million Swedish Kronors to create a prototype.

The solution redacts the images by leveraging machine learning in a cloud infrastructure. It scans any videos or images gathered by an IoT device, then redacts the faces based on pattern recognition. The process all takes place before any data reaches its final destination.

The two organizations must produce deliverables to the Swedish Innovation Agency by the end of the year, but Hanff expects the majority of the development will take place in 2019. Toward the end of the project, Hanff hopes to partner with municipalities and public authorities in Sweden to test out the prototype.

Ultimately, Hanff hopes the yet-to-be-named solution will be used around the world. 

“I want to see these solutions go global. I think any way we can facilitate safe and responsible use of technology is a good thing for society,” said Hanff. “Any way that we can help secure and maintain fundamental rights will be seen as beneficial.”

Think Privacy and Castlebridge received the grant from the Swedish Innovation Agency at a time when IoT privacy concerns have made news. Hanff cited the departure of former Ontario Privacy Commissioner Ann Cavoukian from the Waterfront Toronto smart city project as a development that could be detrimental to future projects that may want to use IoT devices.

Hanff describes himself as a privacy advocate and a technologist. His project may focus on the protection of citizens’ rights, but the goal is never to hinder the evolution of technology.

“I became a privacy geek because of the issues surrounding how these technologies are being used to control and monetize people, not because I wanted to stop technology from evolving. I would still love to see technology evolve and to see the future be one which is full of useful technologies which will enhance our lives and bring great utility. At the same time, we need to do that in a respectful and responsible way.”

With the advent of the EU General Data Protection Regulation, an increased emphasis on privacy by design principles and more research dollars funding these projects, Hanff said companies are allowed to innovate, but should do so responsibly.

For manufacturers of the internet of things, and those operating in the space, the responsibility will continue to grow. Hanff acknowledges his prototype may be coldly received in more authoritarian parts of the world and could be rebuffed by governments that may see it as a tool designed to hinder law enforcement investigations.

He notes the network of IoT devices only continues to grow, and they are only going to get better from here.

“We have literally billions of IoT devices, which are going to increase at an exponential rate over the next 10 to 15 years,” said Hanff. “With that will come much higher resolution, much smarter and cheaper camera technologies or visual technologies, and we need to safeguard against that. We need to ensure that we don’t become a society which is surveilled 24/7 simply because of the technologies we use.”

Hanff wants privacy professionals to pay attention to the prototype, as they almost certainly work in a field where they have interacted with the IoT. He believes privacy professionals need to understand the responsibility placed upon them, to realize that the protection of individuals’ facial images, and their rights overall, are part of the job.

“I would urge them to understand that we have a responsibility as a profession to protect the fundamental data subject, and I really hate the term ‘data subjects.’ We are all people at the end of the day and we have dignity,” said Hanff. “We need to take into account the world we are creating. We all have a responsibility, especially as privacy professionals to just think about these things because we won’t find solutions if we don’t realize the problem exists in the first place.”

photo credit: SnaPsi Сталкер Surveillance via photopin (license)