Responsible video analytics: urban security without biometric identification

An operator can only watch a limited number of screens. In practice, many incidents are spotted late, or only when someone reports them, even though a camera recorded them from the very start.

Video analytics changes the camera’s role: instead of an archive that is checked afterwards, it becomes a signal that raises an alert when something relevant happens.

Most situations that matter to a municipal security service do not require knowing who anyone is:

• Incidents on public roads, such as accidents, vehicles stopped in dangerous places or abandoned objects.
• Crowd levels at events or busy areas, estimated in aggregate, to warn when occupancy approaches risky levels.
• Unauthorised access to municipal facilities, such as reservoirs, depots or buildings out of hours.

In all of these cases the system works with events and aggregate figures, not identities. And in all of them it raises an alert for human review: an operator decides the response.

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) has, since 2 February 2025, prohibited several practices involving biometrics. Among them is the use of “real-time” remote biometric identification systems in publicly accessible spaces for the purpose of law enforcement, except in narrowly defined cases that require prior authorisation (Article 5). It also prohibits creating or expanding facial recognition databases through the untargeted scraping of images from the internet or CCTV footage.

The General Data Protection Regulation treats biometric data used to uniquely identify a person as a special category of data (Article 9), and requires a data protection impact assessment for the systematic monitoring of a publicly accessible area on a large scale (Article 35).

In Spain, the recording of images in public places by the security forces is also governed by Organic Law 4/1997. The Spanish Agency for the Supervision of Artificial Intelligence (AESIA) and the Spanish Data Protection Agency (AEPD) each oversee the use of these technologies within their remit.

The practical conclusion is simple: a system that does not identify people stays, by design, outside the uses the law restricts most. It does not remove the other obligations, but it starts from a much sounder footing.

Surveillance AI is one of the three solutions Equilia runs today, and it was designed on these principles:

• No biometric identification by default: the system detects situations, not specific people.
• Human oversight in every decision: detections are alerts for an operator, not automatic actions.
• An audited event log, recording what was detected, when, and what was done.
• Aggregate crowd analytics, with no individual tracking.
• Municipal data under the council’s control.

It can work with the cameras the municipality already has or with new equipment from our network of manufacturers. And its detections can feed other services: a possible accident can trigger traffic management and information for residents in one coordinated response.

• Does the system identify, or can it identify, people? If so, on what legal basis and with what authorisation?
• Who reviews each alert before anyone acts, and is that recorded?
• How long are images and events kept, and who can access them?
• Where is the data stored and processed, and who has access to it?
• Has a data protection impact assessment been carried out, and does the supplier contribute to it?

A good supplier should be able to answer all of them in writing.