How privacy review and provenance actually work in the pipeline

"Privacy-by-design" and "rights-cleared" are frequently used as marketing phrases without any technical content behind them. This post describes what the terms actually mean in the context of the capture and processing pipeline, and what they do not mean.

Ingest and access control

Raw footage enters the pipeline over an encrypted upload channel. From the moment it lands in storage, access is restricted to processing and review roles scoped to that specific project. No analyst, annotator or external reviewer gets access to raw footage by default; access is granted per role per project and logged.

The storage region is EU-region only. Raw material does not leave that boundary in the normal course of processing.

Automated privacy detection

Every frame of every clip goes through automated detection. The detection pipeline targets:

- Faces (contributor and bystander) - Third-party persons who walked into the scene - Screens, monitors, and document surfaces - Vehicle licence plates - Identity documents, badges, and lanyards - Identifiable signage (company names, addresses, branded surfaces that would locate the site)

Detections are logged per frame. The detection log is not discarded after processing: it travels with the clip and becomes part of its provenance record.

Human privacy review

Automated detection has a known ceiling. High-motion frames, partial occlusions, and uncommon presentation formats produce misses. Every clip is reviewed by a person after automated processing.

The reviewer is checking for detection misses, for newly apparent context that identifies a location or a person, and for site-confidential material that the site owner has flagged. Clips that cannot be cleared are removed from the project. They are not delivered with a caveat or a disclaimer—they are removed.

This is not a comfortable policy for throughput. A clip with 40 minutes of usable material that contains one unresolvable identifiable element becomes zero minutes of accepted footage. The alternative—delivering flagged material and letting the customer decide—would transfer the privacy risk rather than resolve it.

Consent chain

Every capture is linked to an explicit consent record. The consent record names the contributor, the project, the task scope, the permitted uses, the retention period, and the withdrawal mechanism. Consent is collected per project, not once for all future projects.

Site authorization is separate. The party responsible for the capture site signs a location release that authorizes recording at that site, for that task scope, for that project. The site release and the contributor release are both stored against the relevant episodes.

Provenance records

After a clip passes privacy review, it receives a provenance record before it can enter a release. The provenance record captures:

- Capture date range (not exact timestamps, for privacy reasons) - Environment class (workshop, construction-site, residential, industrial) - Protocol version applied during capture - Processing pipeline version applied during privacy processing - Annotation schema version applied during annotation - Whether the contributor and site releases are on file

The provenance record is immutable once written. If a correction is needed, a new record is written and the old one is retained—the full history is preserved.

What this does not mean

This does not mean the resulting dataset is certified as GDPR-compliant. The pipeline is designed for GDPR-conscious physical-data collection; compliance is an ongoing operational state, not a badge awarded at one point in time.

This does not mean the dataset is fully anonymous. Anonymity is a technical standard with a precise definition, and professional footage of hands performing tasks carries residual re-identification risk that the processing pipeline reduces but does not eliminate. No dataset is presented as fully anonymous.

What it does mean is that the rights chain behind every episode is documented, that the privacy processing has both an automated and a human stage, and that the provenance record travels with the data so a downstream user can interrogate it.