Smart Campus AI: A Compliance-First Guide to Campus Video Analytics

2025-03-05 | Smart Solutions

Compliance first: purpose, minimal collection, honest limits for campus analytics.

The Limits of Traditional CCTV: After-the-Fact Evidence Is Not Enough

Traditional campus CCTV is most often used to review footage after an event. When an accident, theft, or dispute happens, the school searches the recorder for the relevant period and watches the footage to reconstruct what happened. That is useful for investigation, but it has a fundamental limit: it only helps after the event has already occurred. It does not provide any prompt while the event is happening.

Video analytics changes this pattern. A system can apply rules set in advance by the school to analyse objects and activity in the camera view. Examples include a person crossing a defined boundary, a person staying in a defined area, or a vehicle entering a defined zone. When a rule is triggered, the system can raise a prompt for a responsible person to verify and follow up. In other words, video analytics turns CCTV from passive recording into an active prompting tool.

Active prompting is not automatic judgement. Video analytics only filters the picture according to rules. Real judgement and real decisions still belong to people. If a school treats an analytics result as a conclusion, misjudgement becomes likely, and privacy compliance risks follow. This article therefore starts with the compliance framework, then explains how the technology works and where its limits lie, and finally discusses how to design a deployment responsibly.

Compliance First: Ask About Purpose Before Talking About Technology

In Hong Kong, the collection and use of campus video data are governed by the Personal Data (Privacy) Ordinance (Cap. 486). The Office of the Privacy Commissioner for Personal Data (PCPD) has also issued Guidance on the Use of CCTV Surveillance, which covers lawful and fair collection, necessity, proportionality, transparency, retention, and security. Before a school considers any video analytics function, it should address the questions below.

State the Collection Purpose and Meet DPP1

Data Protection Principle 1 (DPP1) requires personal data to be collected for a lawful purpose directly related to a function or activity of the data user. The data collected must be necessary for that purpose but not excessive. The means of collection must also be lawful and fair. Applied to campus video analytics, the school must be able to state a specific purpose for each function. For example, setting a virtual fence at the edge of a playground after school hours might have the purpose of prompting security staff when someone enters a restricted area outside opening hours. That purpose should be written specifically. A vague phrase such as improving security cannot cover every function.

Minimal collection is at the heart of DPP1. The school should ask whether the function is truly needed to achieve the purpose, and whether a less intrusive method could achieve the same result. If the problem is only that people occasionally enter a sports ground after school, better fencing, locked gates, and patrol arrangements may already be enough, without switching on video analytics. PCPD guidance also reminds data users to consider less privacy-intrusive alternatives.

Carry Out a Privacy Impact Assessment, Not a Gut Feeling

The PCPD encourages data users to conduct a privacy impact assessment before using a CCTV surveillance system, so that privacy risks can be identified and operational and technical measures can be devised to prevent or reduce them. For a school, the assessment should cover which areas will be monitored, which functions will be switched on, who will see prompts and footage, how long data will be kept, how data will be secured, and how complaints and access requests will be handled. The assessment result should be kept as a written record.

Have a Clear Policy, Then Communicate With Stakeholders

The school should have a written policy that states the purpose, scope, functions, retention arrangements, access rights, security measures, and enquiry channels of the video system. The policy should not sit in a filing cabinet. It should be made known to the relevant stakeholders. The school should use appropriate channels to tell staff, parents, and students which areas are monitored, what the monitoring is for, and who is responsible. At the entrance to, or in a prominent position within, a monitored area, there should be clear signage. Transparency is not only a compliance requirement. It is also the basis of trust.

Retention, Access, and Security: The Whole Data Lifecycle Matters

Compliance is not only about the moment of collection. Data Protection Principle 2 (DPP2) requires data to be accurate and not kept longer than is necessary to fulfil the purpose for which it is used. Data Protection Principle 3 (DPP3) requires personal data to be used only for the purpose for which it was collected, or for a directly related purpose. Data Protection Principle 4 (DPP4) requires all practicable steps to be taken to safeguard personal data against unauthorised or accidental access, processing, erasure, loss, or use. In other words, the school must also think through how footage is stored, who can view it, when it is deleted, and how leakage is prevented.

For overall planning of a campus CCTV system, see school CCTV solutions. For campus network foundations, including wireless coverage and segmentation design, see campus Wi-Fi solutions.

Biometrics Need Extra Care: A Face Is Not Ordinary Data

A face is biometric data. Unlike a passcode, a face cannot simply be changed on request. Once it is leaked or misused, the impact can last a long time. PCPD CCTV guidance also reminds data users to consider whether functions such as facial recognition and individual tracking are needed, and to avoid them unless there is a clearly justified and compelling need to do so. For schools, this reminder matters even more, because students are minors.

The following practices carry high privacy risk. They should not be presented as general recommended practice. Before a school considers any of them, it must carry out a strict necessity and proportionality assessment and seek professional legal advice:

• Facial recognition blocklists: placing individuals on a list and having the system automatically match and track them across campus. This involves continuous biometric matching and carries a risk of misidentification. A school should not treat a blocklist as a routine security measure.
• Stranger identification: automatically labelling every unrecognised person as suspicious. On an open campus, visitors, parents, delivery workers, and maintenance workers may all be unknown to the system. Treating unfamiliar as suspicious creates a large volume of false prompts.
• Student behaviour analysis: using video to infer student behaviour, emotion, attention, or conduct. Such inferences often lack a reliable basis, and they damage trust between teachers and students and the learning environment. A school should not use video analytics to judge student behaviour.
• Audio monitoring to prevent bullying: using microphones or audio analysis to listen to student conversations and infer whether bullying is happening. Audio is more intrusive than video alone, because conversation content is itself highly private data. Bullying should be handled through education, counselling, reporting channels, and human intervention.

In short, facial recognition is not a case of install it and be done. If a school believes that one specific scenario genuinely requires it, for example managing access to one highly restricted area where lower-intrusion methods have already been shown not to work, the school must still carry out a privacy impact assessment, set out a clear policy, limit the scope of use and access rights, put security measures in place, and explain the arrangement clearly to stakeholders. The school should also review the arrangement regularly, and consider whether it can return to lower-intrusion methods such as access cards, codes, or manual verification.

How Video Analytics Works: From Pixels to Rules

To judge whether a function is suitable, it helps to understand how it works. Most campus video analytics builds on object detection and classification, plus rules set by people. The system finds moving objects in the picture, classifies them as people, vehicles, or other objects, and tracks their positions and movement paths. It then checks whether those paths match rules set in advance, such as crossing a line, entering an area, or staying longer than a set time. If a rule matches, the system raises a prompt. Real performance depends heavily on camera position, lighting, occlusion, weather, and rule settings.

Virtual Fences and Perimeter Intrusion Detection

A virtual fence is a line or an area drawn in the camera view, used as the boundary for a trigger rule. When an object classified as a person or a vehicle crosses the line or enters the area, the system raises a prompt. Common campus uses include a playground after school hours, a rooftop exit that is not open for use, and a rear gate. The advantage of a virtual fence is that the school can target a specific location and a specific period, for example switching the rule on only outside opening hours, so that normal daytime activity does not generate prompts.

The limits are equally clear. First, the system can only see what the camera can see. If the camera angle is wrong, the view is blocked by trees or buildings, or night lighting is poor, the system may miss a crossing. Second, object classification is not fully reliable. Animals, moving branches, shadows, and reflections can all be misread. Third, if an area is drawn too widely, or the schedule is wrong, the school will receive many prompts unrelated to real security. The school should test the rules under different lighting and weather conditions after installation, and adjust the area, schedule, and sensitivity according to real results, rather than setting the rules once and leaving them alone.

Licence Plate Recognition: Principles and Limits

Licence plate recognition works by first finding the plate in the picture, then recognising the characters on the plate one by one. In a campus setting, a common use is managing a car park entrance, for example allowing registered vehicles to enter, or recording vehicle entry and exit times for management purposes. In a controlled setting, where vehicles slow down at a gate, the camera faces the plate directly, and lighting is adequate, licence plate recognition can be a useful aid. Even so, a school should not treat a plate recognition result as the sole basis for allowing entry. An important entrance should still have manual verification.

The limits come mainly from capture conditions. A plate viewed at a sharp angle appears distorted, which makes characters hard to read. Strong light can cause glare and overexposure, while weak light can leave characters blurred. Rain, fog, dirt, plate damage, or obstruction can all affect recognition. A vehicle moving too fast can also blur the image. Plate formats, fonts, and colours differ across regions, and the system must be able to handle the plate styles commonly seen locally. When planning, the school should place the camera where vehicles must slow down, keep the camera as directly facing the plate as possible, avoid a large side angle, and clean the lens and check lighting regularly.

People Counting and Loitering Detection

People counting counts how many people appear in an area, or how many pass through an entrance or exit. A school can use it to understand how spaces such as halls, libraries, or playgrounds are used, as a reference for staffing and space management. Loitering detection raises a prompt when a person stays in a defined area longer than a set time. A common example is a classroom corridor or stairwell after school, where a prompt reminds security staff to carry out a patrol.

The limits of both functions come from crowding and occlusion. When many people stand close together, people at the back are hidden by people at the front, and the system may undercount or double-count. Loitering detection faces a similar problem: a person standing still waiting for a friend looks the same, on stay time alone, as a person standing still for another reason. A loitering prompt should therefore be treated as a reminder to go and have a look, not as a conclusion that the person has done something wrong. Staff who attend should use normal communication and patrol practice to understand the situation, rather than treating the prompted person as an offender.

Where the Analysis Runs: On-Camera, On-Recorder, and in the Cloud

Video analytics can run in different places. The school should ask clearly where the analysis happens, whether footage will leave the campus, and who can access the related data.

On-Camera Analytics: Analysis Inside the Camera

On-camera analytics means that initial analysis happens inside the camera itself. The camera sends only the analysis result, for example which rule was triggered and in which area an object appeared, to the recorder or management platform, rather than sending all video onwards. The advantage is lighter network load, and identifiable video can stay within the campus, which reduces the risk of data leaving the site. The limit is that a camera has limited computing power. Complex analysis may not be possible, and analytics capability varies greatly across camera models, so the school needs to confirm each model.

Recorder or Local Analytics Host: Analysis Inside the Campus

Another common arrangement places analysis on the network video recorder or on a local analytics host inside the campus. Cameras send video to local equipment, and analysis is completed inside the campus network. The advantage is stronger computing power than a single camera, with the ability to handle many cameras at once, while video still stays within the campus. Local equipment is itself a security focus. Access control, system updates, and physical security all need attention.

Cloud Analytics: Sending Video Away for Analysis

Cloud analytics means sending video to servers outside the campus for analysis. Identifiable video leaves the campus, travels over the internet, and is stored in third-party facilities. The school needs to ask where the data will be sent, how it will be encrypted, who can access it, how long it will be kept, how it will be deleted when the contract ends, and whether the provider will use the data for other purposes. If a function can be done with local analysis, the school should prefer the local arrangement, rather than sending identifiable video to the cloud for convenience alone. That trade-off is itself a practical application of the minimal collection and proportionality principles.

Whichever arrangement is chosen, the school should require the provider to state the data flow clearly, and to put the relevant commitments in the contract. Written terms provide a basis for follow-up.

Network Foundations: PoE Power and VLAN Segmentation

PoE Power: Power and Data Over the Same Cable

PoE means power over Ethernet. The same network cable carries both power and data. For a campus, the advantage is that a camera does not need a separate power cable, so camera positions can be more flexible, and power can be managed centrally at the switch. When planning, the school and the engineering team should calculate the total power draw of all cameras and leave a margin, so that the switch can supply all cameras. For outdoor or rooftop locations, waterproofing, surge protection, and temperature also need to be considered.

VLAN Segmentation: Separating the Monitoring Network From Everyday Networks

VLAN segmentation means separating the monitoring network from everyday office and teaching networks in a logical way. Cameras, recorders, and related equipment are placed in a dedicated virtual local area network, and firewall rules control which equipment can communicate with which. For example, the rules can allow only the recorder to initiate connections to cameras, while cameras themselves cannot connect directly to the internet and cannot reach computers and servers on the office network. Segmentation has two advantages. First, if one camera is compromised, an intruder cannot directly use that camera to reach other systems. Second, video traffic does not compete with everyday teaching and office traffic for bandwidth.

After segmentation, controlled cross-network access still needs to be arranged. For example, a computer in the security office may need to view recorder footage. That access should be limited to specified equipment and specified ports, rather than opening the whole monitoring network to everyone. Remote viewing should go through a virtual private network or another controlled method, rather than exposing the recorder or cameras directly to the internet. Default login credentials must be changed, unneeded management services should be switched off, and firmware should be updated regularly. These are basic practices under the DPP4 security principle.

Retention Periods, Access Rights, and Security Measures

A retention period should be set by purpose, not by how large the hard drive is. DPP2 requires personal data not to be kept longer than is necessary to fulfil the purpose for which it is used. The school should set retention arrangements for different types of data. For example, general footage and footage kept because of an incident should be handled differently. When a retention period expires, footage should be overwritten automatically or deleted securely, rather than stored without limit. If a particular clip needs to be kept longer because of an investigation or legal process, there should be a written record stating the reason for retention and the person responsible, and the clip should be deleted promptly once the reason ends.

Access rights should follow the least-need principle. Only staff who genuinely need to access footage or prompts because of their duties should have access rights, and rights should be divided by role. For example, front-line security staff may only need to receive prompts and view live pictures, while the right to search historical footage and export clips should be limited to designated managers. Every export of footage should be logged, including who exported it, when it was exported, for what purpose, and to whom the footage was given. Those logs support accountability.

Security measures should cover physical and technical aspects. On the physical side, recorders and servers should be placed in locked cabinets or rooms, not in places that anyone can reach. On the technical side, the school should use strong login credentials, update firmware regularly, switch off unneeded services, keep network segmentation in place, and add multi-factor authentication for remote access. The school should also review these measures regularly.

Linked Architecture: How Intercom, Access Control, and Broadcast Work Together

Video analytics rarely works alone. On a campus, it usually needs to work with intercom, access control, and broadcast systems to help handle an event. For example, when a virtual fence is triggered, the system can prompt security staff to view the relevant camera picture. Security staff can then use the intercom to speak with a person on site, understand the situation, and decide whether to open a door, send someone to the location, or make a reminder through the broadcast system. In this flow, video analytics provides the prompt, the intercom provides communication, access control governs entry, and the broadcast system delivers messages. Each system plays its part.

When designing a linked architecture, several points deserve attention. First, state the trigger conditions and follow-up flow clearly. Which type of prompt goes to which post, who verifies first, and how follow-up is graded after verification should all be written down, not passed on by word of mouth. Second, linkage should be based on human confirmation. A system prompt should not automatically trigger a door lock, a broadcast alarm, or any other action that directly affects people and movement, unless that action has itself been assessed strictly and is supported by a clear policy. An automated action that misfires can have serious consequences. Third, integration between systems should use standard protocols and documented interfaces, so that maintenance and future provider changes stay manageable.

Deployment Checklist

The following checklist can be used by a school during planning and acceptance, item by item:

• Each analytics function has a written purpose and has passed a necessity and proportionality assessment.
• A privacy impact assessment has been completed and a written record has been kept.
• A written policy states the purpose, scope, functions, retention, access rights, security, and enquiry channels.
• Monitored areas have clear signage, and staff, parents, and students have been informed.
• Facial recognition, blocklists, stranger identification, student behaviour analysis, and audio monitoring have all been through an especially strict assessment. None is switched on by default.
• The analysis location is stated clearly: on-camera, on local recorder, or in the cloud, and whether data will leave the campus.
• Camera positions, angles, lighting, and occlusion have been checked on site, and rules have been tested under different conditions.
• The PoE power budget and cabling plan have been calculated, and switch power capacity leaves a margin.
• The monitoring network has been separated from everyday networks by VLAN, with firewall rules controlling cross-network access.
• Default login credentials have been changed, unneeded management services have been switched off, and firmware updates are arranged.
• Retention periods, access rights, and export logging arrangements have been set out, with someone responsible for carrying them out.
• Intercom, access control, and broadcast linkage flows have been written down, with human confirmation as the precondition.
• Relevant staff have been trained, and drill records exist.
• There is a regular review arrangement to check whether each function is still needed, or whether a less intrusive method can be used instead.

Common Misunderstandings

Misunderstanding 1: Installing video analytics automatically makes a campus safe

Video analytics can only provide prompts. It cannot replace fencing, access control, patrols, reporting channels, and communication between people. A prompt that no one follows up is little different from no prompt at all. Video analytics is an aid, not the whole of security work.

Misunderstanding 2: Facial recognition can be used freely because it is convenient

A face is biometric data. Its collection and use face stricter necessity and proportionality requirements. Convenience is not the same as necessity. In many settings, an access card, a code, or manual verification is already enough.

Misunderstanding 3: Audio monitoring can prevent bullying

Audio monitoring involves continuous collection of conversation content. It is highly intrusive, and a sound clip alone can rarely show reliably whether bullying has happened. Bullying prevention needs education, counselling, trusted reporting channels, and timely human intervention.

Conclusion

The value of a smart campus does not come from how many functions it has. It comes from whether each function has a clear purpose, is proportionate, has been assessed, and has someone responsible for following up. Virtual fences, licence plate recognition, people counting, loitering detection, and left-object detection can all be useful aids for campus security, in the right scope and under the right conditions. Even so, these tools must be used within a compliance-first framework: state the purpose clearly, complete a privacy impact assessment, set out a policy, communicate well, limit access, secure the data, and review regularly. High privacy-risk practices such as facial recognition blocklists, stranger identification, student behaviour analysis, and audio monitoring deserve extra caution, and should not be treated as routine recommendations.

This article is for general reference only and is not legal advice. For specific compliance questions, please seek professional legal advice.

免費上門勘查及報價 | 收費指南