People counting and privacy

People counting and privacy: GDPR, the Privacy Act and DPIAs

People counting raises fewer privacy issues than recorded video when the system counts on the device and keeps only numbers, but it still deserves a documented assessment. What matters is what is captured, where it is processed, what leaves the site and how people are told.

Ask us about the CountIQ data flow Compare counting technologies

This page is general information, not legal advice. Privacy obligations depend on your jurisdiction, your organisation and how a system is configured. Check yours with your privacy officer or legal adviser.

What a people counting system collects

Privacy risk follows the data, so start by establishing what each approach captures and what it keeps.

Approach	What is captured	What is kept
Counting on the device	Video is analysed on the camera	Numbers: entries, exits and occupancy over time
Video sent to a server for analysis	Video leaves the camera	Video, at least temporarily, plus the counts
Wi-Fi or Bluetooth tracking	Signals from people's phones	Device identifiers, sometimes hashed
Thermal, LiDAR or beam counters	Heat, depth or beam breaks	Numbers

GDPR: is people counting personal data?

Under the GDPR, images of identifiable people are personal data. A total such as 412 entries between 10 am and 11 am, which cannot be linked to anyone, is not.

The step in between still counts. A camera that captures identifiable people in order to count them is generally treated as processing personal data, even if only the totals are kept. That means you need a lawful basis, which for counting is usually legitimate interests, and you need to tell people the processing is happening.

Counting on the device and keeping only numbers reduces the risk considerably. It does not remove the need to assess it.

When do you need a DPIA?

The GDPR requires a data protection impact assessment where processing is likely to result in a high risk to individuals. Systematic monitoring of a publicly accessible area on a large scale is one of the cases it names.

Many organisations complete a DPIA for people counting even where one may not be strictly required, because it records the decisions in one place. It should answer the following.

Purpose. What will the counts be used for, and is counting a proportionate way to achieve it?
Data. What is captured, what is derived from it, and what is stored?
Location. Where does the analysis run, and what leaves the site?
Retention. How long are counts kept, and is any image kept at all?
Access. Who can see the data, and who is the supplier acting for?
Transparency. How are visitors and staff told, and where is it signposted?
Hosting. In which country is the data stored?

Australia: the Privacy Act and surveillance laws

The Privacy Act 1988 and the Australian Privacy Principles apply to personal information, meaning information about an individual who is identified or reasonably identifiable. Aggregate counts are not personal information. Camera footage of identifiable people can be.

Cameras are also covered by state and territory surveillance laws, and some states have workplace surveillance laws that require employers to give staff notice of camera surveillance. State and local government bodies are generally covered by their own state privacy legislation.

In practice, people counting on existing cameras should be added to the privacy notice, signage and staff notification you already maintain for those cameras.

Questions to ask a people counting supplier

Does counting run on the device, or is video sent elsewhere for analysis?
Exactly what data leaves our site?
Is any image or video stored by your system, and for how long?
Where is the data hosted?
Can individuals be identified or tracked from the data you hold?
Who in your organisation can access our data?
Will you describe the data flow in writing for our privacy assessment?

How CountIQ handles counting data

We can describe the CountIQ data flow for your privacy assessment. Ask us before you start a trial.

Detection and counting run locally on the camera, using edge processing.
Count data is sent to CountIQ in the cloud, where dashboards and reports are built.
Dashboards and reports show numbers by site and zone.
CountIQ is hosted in Australia.
Network access, and any requirement for a private camera network, is assessed during setup.

Common questions

Is people counting GDPR compliant?

It can be. Compliance depends on how the system works and how you deploy it, not on the label. A system that counts on the device and keeps only aggregate numbers is much easier to justify than one that stores or transmits video, but you still need a lawful basis, clear notice and a record of your assessment.

Do I need a DPIA for people counting?

A DPIA is required under the GDPR where processing is likely to result in a high risk, and systematic monitoring of a publicly accessible area on a large scale is a named example. Whether your deployment meets that threshold depends on its scale and setting. Many organisations complete one anyway to document their decisions.

Is people counting covered by the Australian Privacy Act?

The Privacy Act applies to personal information. Aggregate counts are not personal information, but the camera footage a counting system analyses can be. State and territory surveillance laws also apply to cameras, so counting should be covered in the notices and signage you already use for them.

Do we need signage for people counting?

If cameras do the counting, the signage and notices you already need for those cameras should mention that they are also used for counting. Requirements vary by jurisdiction and by whether staff or the public are being counted.