Can Video Analytics Support a Claim Without Compromising Privacy?

What video analytics can and cannot prove in a claim

Video analytics answers narrow verifiable questions about a claim: did the incident occur, when and where, was an item scanned at a checkout before an alleged injury or theft, how did the claimant move, does the reported damage match the scene? It turns raw footage into structured event records — motion, zones, sequence of actions — that let an adjuster compare the policyholder's account against observable facts and flag staged or exaggerated losses. Virtual inspections driven by the policyholder's own phone video add a remote, documented view of property or vehicle damage.

The tool has hard limits. Analytics establishes observable facts, not intent, causation or the value of a loss — those conclusions remain with a human and need corroborating documents. False positives are unavoidable, and if error rates are too high the system stops being a proportionate response and can even undermine the legal basis for processing, because the measure must actually work for the stated purpose. Treat analytics as triage and verification, never as an automatic denial engine.

Start from the legal baseline, not the technology

The GDPR and UK GDPR treat any identifiable person on camera as personal data, and regulators are explicit that a system is not 'anonymised' just because faces are blurred or masked — people often remain re-identifiable through the wider CCTV estate or because staff intervene with them (CNIL). From that starting point follow the whole duty chain: lawful basis, purpose limitation, data minimisation, accuracy, storage limitation, security and transparency.

Regulation is layered. Beyond the GDPR you may rely on the UK 'crime compatibility condition' when reusing personal information to detect, investigate or prevent crime, including scams and fraud — an option that sits alongside recognised legitimate interest for insurers that are not public or competent authorities. In the EU, the AI Act adds a risk tiering that determines which analytics uses carry extra obligations or are banned. Sector codes and national guidance can tighten the picture further, so check your own regulator before rollout.

The lawful basis and the proportionality test

Legitimate interest is the common starting point for claim verification and fraud prevention, but it only holds if processing is necessary and not disproportionate. State a specific aim — verifying a slip-and-fall at a checkout, detecting a staged theft — and show why less intrusive checks (weighing scanned goods, RFID, random staff inspection, document review) are insufficient. CNIL recommends experimenting in real conditions to confirm the device is genuinely effective, lawful and low-impact before full deployment.

Where analytics detects criminal offences and the output feeds pre-litigation or litigation, the data may become offence-related data under Article 10 GDPR, triggering additional conditions and tighter restriction to preparing and pursuing legal claims. Document the necessity analysis, keep alert handling in a named-person workflow, and give people a realistic way to avoid the analytics lane — for example a checkout or payment path without the augmented camera — so the interference is not disproportionate.

• Purpose stated precisely and tied to one observable claim event.
• Less intrusive alternatives tested and rejected with recorded reasons.
• Real-world pilot measures accuracy, false positives and actual loss reduction.
• Effective opt-out or non-analytics path available without disadvantage.
• Offence-related data handled under Article 10 rules and restricted to legal-claim purposes.

Minimisation, retention and transparency by design

Minimisation is decided at design time, not after a privacy complaint. Restrict the camera to the area needed for the check — the scan zone, the aisle where the fall happened — and angle lenses to avoid faces where possible. Mask or blur areas of no interest, reduce resolution and capture rate to what detection needs, process locally on the device rather than in the cloud, disable audio, and strip functions that serve no purpose such as reading hesitation, emotion or physical characteristics.

Retention should be tied to purpose: data deleted as soon as detection is done, with the controller only keeping frames where a further lawful purpose (improving the algorithm or pursuing a claim) genuinely exists and for no longer than needed. When footage becomes evidence in a contested claim, treat that as a separate documented legal-hold decision. Transparency requires layered notice — clear signage at the location plus an on-device or on-screen message describing the algorithmic nature of the analysis — and a second layer online or via QR code with details of the processing and rights.

If you reuse images to train the model, remember they may still identify people through timestamps, distinctive hands, jewellery or purchase sequences; apply pseudonymisation such as pixelation and masking, allow objection through a checkbox, and keep a short training-data retention period.

• Camera covers only the zone needed; non-interest areas masked or never recorded.
• Audio disabled; emotion, age, gender and physical profiling excluded from scope.
• Local processing preferred; resolution and frame rate reduced to the minimum.
• Retention written into policy with automatic deletion and a separate legal-hold path.
• Layered notice: site signage, on-screen message, online policy and opt-out for training data.

The red line: biometrics and high-risk analytics

There is a clean distinction between event analytics and identification. Detecting that an item was not scanned or that a person fell is generally low-risk event processing. The moment the system identifies who someone is, categorises people, or infers emotions, it crosses into special territory. The EU AI Act treats remote biometric identification, emotion recognition and biometric categorisation as areas of concern, and bans several uses outright.

Specifically, the AI Act prohibits untargeted scraping of internet or CCTV footage to create or expand facial-recognition databases, and bans emotion recognition in workplaces and education, along with biometric categorisation used to deduce protected characteristics. These prohibitions entered into force in stages from February 2025. High-risk rules for sensitive areas including certain biometrics are scheduled to apply from December 2027, though the implementation timeline has been adjusted by the 'AI Omnibus' simplification and can change — always confirm current dates on the official AI Act pages before planning. Insurers that stay on the event side of this line face far lighter obligations; crossing it triggers impact assessments, documentation and, in many cases, a rethink of the whole design.

• Event detection (was it scanned, did they fall, where) is the low-risk lane.
• Identification, categorisation or emotion inference is the high-risk lane.
• Untargeted CCTV scraping to build face databases is prohibited.
• Emotion recognition in workplaces is prohibited under the AI Act.
• Confirm the evolving high-risk timeline on official EU sources before planning.

Keep the evidence usable and the decision human

Privacy compliance and evidential integrity converge. Footage obtained through covert or disproportionate surveillance can be challenged in civil proceedings, and courts in several EU states have declined to admit recordings collected in breach of data-protection rules, even where they appeared to support a party's case. An insurer that quietly hires a private investigator to film a claimant for weeks risks both an exclusion order and its own legal exposure. The robust alternative is open, documented and proportionate capture with a recorded basis.

Documentation is the evidence. Record when and why cameras were installed, the legal basis, capture parameters, who accessed footage and for what purpose, and keep an unbroken chain of custody through secure storage and access logs. Finally, keep the decision with a person: analytics generates alerts and structured facts, a named adjuster or investigator reviews them, and no outcome flows automatically. This human-in-the-loop design protects claimants' rights and shields the insurer from both privacy complaints and disputes over the reliability of the analytics.

• Capture is open, documented and proportionate; covert surveillance is a high-risk strategy.
• Purpose, legal basis, time, place and camera settings are recorded.
• Access to footage is logged; chain of custody is unbroken and secure.
• Every alert is triaged by a named human; no automatic denial or accusation.
• Outcomes are logged and reviewable so the claimant can challenge an error.