GDPR Video Processing Requirements

Video as Personal and Biometric Data

Under GDPR, video containing identifiable people is personal data. But it's often more:

Special Category Data (Article 9)

Video becomes special category data when it contains:

• Biometric data: Faces processed for identification
• Health data: Medical conditions visible in video
• Racial/ethnic origin: Visible characteristics
• Religious beliefs: Symbols, clothing, settings

Special category data requires explicit consent or another Article 9(2) exception.

The Video Enhancement Exception

BetterVideo's enhancement processing doesn't identify or categorize — it improves visual quality. This distinction matters for lawful basis:

• Processing for identification = biometric data
• Processing for quality improvement = regular personal data

Lawful Basis for Video Processing

You need one of six lawful bases (Article 6) to process video:

Consent (6(1)(a))

Explicit, informed consent from data subjects. Challenging for video because:

• You may not know who's in the video
• Consent must be withdrawable
• Children require parental consent

Contract (6(1)(b))

Processing necessary for a contract with the data subject. Example: enhancing a customer's wedding video that they've contracted you to edit.

Legal Obligation (6(1)(c))

Processing required by law. Example: retaining CCTV for required periods.

Vital Interests (6(1)(d))

Emergency situations. Rarely applicable to video processing.

Public Task (6(1)(e))

Public authority functions. Example: police evidence processing.

Legitimate Interest (6(1)(f))

Most common for B2B video processing. Requires:

• Legitimate interest identified
• Processing necessary for that interest
• Interest not overridden by data subject rights
• Documented Legitimate Interest Assessment (LIA)

Data Subject Rights

Video data subjects have rights that you must honor:

Right of Access (Article 15)

Subjects can request copies of video containing them. For large datasets, this is challenging — you may need to search by face or other identifier.

Right to Erasure (Article 17)

Subjects can request deletion. With zero-retention architecture, there's nothing to delete after processing completes — this is a feature, not a limitation.

Right to Restriction (Article 18)

Subjects can pause processing while disputes are resolved.

Right to Object (Article 21)

Subjects can object to processing based on legitimate interest. You must stop unless you can demonstrate compelling legitimate grounds.

Practical Implementation

Zero-retention architecture simplifies rights compliance:

• No video retained = nothing to access, erase, or port
• Processing is transient = objection stops future processing
• Minimal collection = fewer rights requests

Cross-Border Transfers

Transferring video outside the EU requires a legal mechanism:

Adequacy Decisions

Some countries have adequate protection: UK, Switzerland, Canada (commercial), Japan, others. Transfer freely to these jurisdictions.

Standard Contractual Clauses (SCCs)

EU-approved contract terms for transfers to non-adequate countries. BetterVideo includes SCCs in our DPA for US processing.

Derogations (Article 49)

Exceptions for specific transfers: explicit consent, contract necessity, public interest.

The Schrems II Complication

Post-Schrems II, SCCs alone may not be sufficient for US transfers. You may need:

• Technical measures (encryption, zero-retention)
• Transfer Impact Assessments
• Evaluation of destination country laws

BetterVideo's zero-retention architecture is a technical measure — video doesn't persist in the US, it's processed and gone.