Once people can be identified in footage, you are processing personal data and the GDPR applies. If cameras are installed in the workplace, you need a legal basis, often legitimate interest. You must inform employees and obtain consent from the works council or employee representatives. You may not use footage to monitor how employees do their jobs. Facial recognition is generally prohibited unless a legal exception applies, and the EU AI Act prohibits emotion recognition in the workplace and in education, except for medical or safety reasons. A DPIA is mandatory for systematic, large-scale monitoring of publicly accessible areas.
It therefore pays to design the system to generate as little personal data as possible: process data at the camera where you can, store only counts and do not retain footage if it is not needed. At GVB, footage from the security cameras is not viewed or shared; it is only analysed by the model. Your privacy officer or legal adviser should assess whether your application is permitted and on what legal basis.
A model may perform differently in practice than it does on the test set, and its performance can change: seasons, new products and repositioned cameras alter the images it receives. This is called drift. The built-in monitoring in Azure Machine Learning is designed for tabular data, so for images we set up our own indicators, such as the distribution of confidence scores and the number of detections per hour. For Rijkswaterstaat, we built a generic monitoring package to detect drift and outliers in production models.